MFC 7406

Sync OpenVPN with Peter A's latest version:

rootfs-1.2-ovpn2.tar.gz

5 files changed, 180 insertions, 119 deletions

diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc
index 2ba1068..8d1c454 100644
--- a/etc/inc/openvpn.inc
+++ b/etc/inc/openvpn.inc
@@ -53,13 +53,6 @@ function ovpn_link_tap() {
 		mwexec("/sbin/kldload if_tap");
 		$fd = fopen($g['vardb_path'] ."/ovpn_tap_link", 'w');
 	}
-	//else {
-	//	$fd = fopen($g['vardb_path'] ."/ovpn_tap_link", 'r+');
-	//	$link_count = fread($fd, filesize($g['vardb_path'] ."/ovpn_tap_link"));
-	//	$link_count ++;
-	//}
-	//fwrite($fd, $link_count);
-	//fclose($fd);
 	return true;
 }
 
@@ -89,8 +82,6 @@ function ovpn_unlink_tap() {
 function ovpn_config_server($reconfigure) {
 	global $config, $g, $d_ovpnsrvdirty_path;
 
-	if(!is_array($config['ovpn']['server']['tunnel']))
-		return;
 	foreach ($config['ovpn']['server']['tunnel'] as $id => $server) {
 		/* get tunnel interface */
 		$tun = $server['tun_iface'];
@@ -124,7 +115,7 @@ function ovpn_config_server($reconfigure) {
 				$lines = file($d_ovpnsrvdirty_path);
 
 			/* reconfigure server */
-			if (is_array($lines) && in_array($tun, $lines)) {
+			if (is_array($lines) && in_array($tun . "\n", $lines)) {
 
 				/* kill running server */
 				ovpn_server_kill($tun);
@@ -274,6 +265,19 @@ EOD;
 	if (isset($server['dynip']))
 		$ovpn_config .= "persist-remote-ip\n";
 
+	/* LZO compression (off by default) */
+	if (isset($server['comp_method'])) {
+		switch ($server['comp_method']) {
+
+			case 'lzo':
+				$ovpn_config .= "comp-lzo\n";
+				break;
+			case 'noadapt':
+				$ovpn_config .= "comp-lzo\n" . "comp-noadapt\n";
+				break;
+		}
+	}
+
 	/* Client to client routing (off by default) */
 	if (isset($server['cli2cli']))
 		$ovpn_config .= "client-to-client\n";
@@ -349,6 +353,55 @@ EOD;
 		if (isset($server['dupcn']))
 			$ovpn_config .= "duplicate-cn\n";
 
+		$push_options = "";
+	
+		/* Client push - redirect gateway */
+		if (isset($server['psh_options']['redir']))  {
+			if (isset($server['psh_options']['redir_loc']))
+				$push_config .= "push \"redirect-gateway local\"\n";
+			else
+				$push_config .= "push \"redirect-gateway\"\n";
+		}
+
+		/* Client push - route delay */
+		if (isset($server['psh_options']['rte_delay']))
+			$push_config .= "push \"route-delay {$server['psh_options']['rte_delay_int']}\"\n";
+
+		/* Client push - ping (note we set both server and client) */
+		if (isset ($server['psh_options']['ping'])){
+			$conflict = true;
+			$interval = $server['psh_options']['ping_int'];
+			$ovpn_config .= "ping {$server['psh_options']['ping_int']}\n ";
+			$push_config .= "push \"ping {$server['psh_options']['ping_int']}\"\n";
+		}
+
+		/* Client push - ping-restart (note server uses 2 x client interval) */
+		if (isset ($server['psh_options']['pingrst'])){
+			$conflict = true;
+			$interval = $server['psh_options']['pingrst_int'];
+			$ovpn_config .= "ping-restart " . ($interval * 2) . "\n";
+			$push_config .= "push \"ping-restart $interval\"\n";
+		}
+	
+		/* Client push - ping-exit (set on client) */
+		if (isset ($server['psh_options']['pingexit'])){
+			$conflict = true;
+			$ovpn_config .= "ping-exit {$server['psh_options']['pingexit_int']}\n";
+			$push_config .= "push \"ping-exit {$server['psh_options']['pingexit_int']}\"\n";
+		}
+
+		/* Client push - inactive (set on client) */
+		if (isset ($server['psh_options']['inact'])){
+			$ovpn_config .= "inactive {$server['psh_options']['inact_int']}\n";
+			$push_config .= "push \"inactive {$server['psh_options']['inact_int']}\"\n";
+		}
+
+		if (isset($server['client-to-client']))
+			$push_config .= "push \"route {$network} {$netmask}\"\n";
+
+		if (isset($push_config))
+			$ovpn_config .= $push_config;
+
 	} else {
 		/* 'authentication_method' == "pre_shared_key" */
 		$network = gen_subnet($server['lipaddr'], $server['netmask']);
@@ -363,61 +416,8 @@ EOD;
 			$ovpn_config .= "ifconfig {$server['lipaddr']} {$netmask}\n";
 		}
 
-		if (isset($server['client-to-client']))
-			$ovpn_config .= "push \"route {$network} {$netmask}\"\n";
-		else
-			$ovpn_config .= "push \"route {$server['lipaddr']}\"\n";
-
 	} /* end authentication_method */
 
-	$push_options = "";
-	
-	/* Client push - redirect gateway */
-	if (isset($server['psh_options']['redir']))  {
-		if (isset($server['psh_options']['redir_loc']))
-			$push_config .= "push \"redirect-gateway local\"\n";
-		else
-			$push_config .= "push \"redirect-gateway\"\n";
-		if ($server['method'] != "ovpn")
-			$push_config .= "push \"route-gateway {$server['ipblock']}\"\n";
-	}
-
-	/* Client push - route delay */
-	if (isset($server['psh_options']['rte_delay']))
-		$push_config .= "push \"route-delay {$server['psh_options']['rte_delay_int']}\"\n";
-
-	/* Client push - ping (note we set both server and client) */
-	if (isset ($server['psh_options']['ping'])){
-		$conflict = true;
-		$interval = $server['psh_options']['ping_int'];
-		$ovpn_config .= "ping {$server['psh_options']['ping_int']}\n ";
-		$push_config .= "push \"ping {$server['psh_options']['ping_int']}\"\n";
-	}
-
-	/* Client push - ping-restart (note server uses 2 x client interval) */
-	if (isset ($server['psh_options']['pingrst'])){
-		$conflict = true;
-		$interval = $server['psh_options']['pingrst_int'];
-		$ovpn_config .= "ping-restart " . ($interval * 2) . "\n";
-		$push_config .= "push \"ping-restart $interval\"\n";
-	}
-
-	/* Client push - ping-exit (set on client) */
-	if (isset ($server['psh_options']['pingexit'])){
-		$conflict = true;
-		$ovpn_config .= "ping-exit {$server['psh_options']['pingexit_int']}\n";
-		$push_config .= "push \"ping-exit {$server['psh_options']['pingexit_int']}\"\n";
-	}
-
-	/* Client push - inactive (set on client) */
-	if (isset ($server['psh_options']['inact'])){
-		$ovpn_config .= "inactive {$server['psh_options']['inact_int']}\n";
-		$push_config .= "push \"inactive {$server['psh_options']['inact_int']}\"\n";
-	}
-
-	if (isset($push_config))
-		$ovpn_config .= $push_config;
-
 	if (!isset($conflict))
 		$ovpn_config .= "keepalive 10 60\n";
 
@@ -648,7 +648,7 @@ function ovpn_server_crl_add() {
 					$lines = file($d_ovpncrldirty_path);
 
 				/* reconfigure crl file */
-				if (is_array($lines) && in_array($name, $lines)) {
+				if (is_array($lines) && in_array($name . "\n", $lines)) {
 
 					/* restart running openvpn daemon */
 					foreach ($config['ovpn']['server']['tunnel'] as $id => $server) {
@@ -744,7 +744,7 @@ function ovpn_srv_dirty($tun) {
 	
 	$fd = fopen($d_ovpnsrvdirty_path, 'a');
 	if ($fd) {
-		fwrite($fd, $tun);
+		fwrite($fd, $tun ."\n");
 		fclose($fd);
 	}
 }
@@ -755,7 +755,7 @@ function ovpn_crl_dirty($name) {
 	
 	$fd = fopen($d_ovpncrldirty_path, 'a');
 	if ($fd) {
-		fwrite($fd, $name);
+		fwrite($fd, $name ."\n");
 		fclose($fd);
 	}
 }
@@ -797,7 +797,7 @@ function ovpn_config_client() {
 				$lines = file($d_ovpnclidirty_path);
 
 			/* reconfigure client */
-			if (is_array($lines) && in_array($tun, $lines)) {
+			if (is_array($lines) && in_array($tun . "\n", $lines)) {
 
 				/* kill running client */
 				ovpn_client_kill($tun);
@@ -987,6 +987,19 @@ EOD;
 
 	} /* end authentication_method */
 
+	/* LZO compression (off by default) */
+	if (isset($client['comp_method'])) {
+		switch ($client['comp_method']) {
+
+			case 'lzo':
+				$ovpn_config .= "comp-lzo\n";
+				break;
+			case 'noadapt':
+				$ovpn_config .= "comp-lzo\n" . "comp-noadapt\n";
+				break;
+		}
+	}
+
 	/* Expert mode paramters */
 	if (isset($client['expertmode_enabled']) && is_array($client['expertmode'])) {
 		$ovpn_config .= ";begin expertmode\n";
@@ -1096,7 +1109,7 @@ function ovpn_cli_dirty($tun) {
 	
 	$fd = fopen($d_ovpnclidirty_path, 'a');
 	if ($fd) {
-		fwrite($fd, $tun);
+		fwrite($fd, $tun . "\n");
 		fclose($fd);
 	}
 }
diff --git a/usr/local/www/vpn_openvpn_cli.php b/usr/local/www/vpn_openvpn_cli.php
index fe01ee0..a5d2e1e 100755
--- a/usr/local/www/vpn_openvpn_cli.php
+++ b/usr/local/www/vpn_openvpn_cli.php
@@ -28,6 +28,7 @@
 	POSSIBILITY OF SUCH DAMAGE.
 */
 
+$pgtitle = array("VPN", "OpenVPN");
 require("guiconfig.inc");
 require_once("openvpn.inc");
 
@@ -81,12 +82,7 @@ if ($_GET['act'] == "del") {
 		exit;
 	}
 }
-
-$pgtitle = "VPN: OpenVPN";
-include("head.inc");
-
 ?>
-
 <?php include("fbegin.inc"); ?>
 <?php if ($input_errors) print_input_errors($input_errors); ?>
 <?php if (file_exists($d_sysrebootreqd_path) && !file_exists($d_ovpnclidirty_path)) print_info_box(get_std_save_message(0)); ?>
diff --git a/usr/local/www/vpn_openvpn_cli_edit.php b/usr/local/www/vpn_openvpn_cli_edit.php
index 1f4fca3..c22faf2 100755
--- a/usr/local/www/vpn_openvpn_cli_edit.php
+++ b/usr/local/www/vpn_openvpn_cli_edit.php
@@ -28,6 +28,7 @@
 	POSSIBILITY OF SUCH DAMAGE.
 */
 
+$pgtitle = array("VPN", "OpenVPN", "Edit client");
 require("guiconfig.inc");
 require_once("openvpn.inc");
 
@@ -170,8 +171,6 @@ if ($_POST) {
 
 			if (!empty($retval))
 				$input_errors[] = $retval;
-			else 
-				ovpn_cli_dirty($ovpnent['if']);
 		}
 
 		if ( $ovpncli[$id]['sport'] != $_POST['sport'] ||
@@ -192,17 +191,11 @@ if ($_POST) {
 			$input_errors[] = "Delete this interface first before changing the type of the tunnel to "
 			                . strtoupper($_POST['type']) .".";
 
-		/* Has the enable/disable state changed? */
-		if (isset($ovpnent['enable']) && isset($_POST['disabled'])) {
-			ovpn_cli_dirty($ovpnent['if']);
-		}
 		if (!isset($ovpnent['enable']) && !isset($_POST['disabled'])) {
 
 			/* check if port number is free, else choose another one */
 			if (in_array($ovpnent['cport'], used_port_list()))
 				$ovpnent['cport'] = getnxt_port();
-
-			ovpn_cli_dirty($ovpnent['if']);
 		}
 	} else {
 		/* Creating a new entry */
@@ -220,8 +213,6 @@ if ($_POST) {
 
 			if (!empty($retval))
 				$input_errors[] = $retval;
-			else
-				ovpn_cli_dirty($ovpnent['if']);
 		}
 	}
 
@@ -239,8 +230,10 @@ if ($_POST) {
 		$ovpnent['cli_cert'] = $pconfig['cli_cert'];
 		$ovpnent['cli_key'] = $pconfig['cli_key'];
 		$ovpnent['crypto'] = $_POST['crypto'];
+		$ovpnent['comp_method'] = $_POST['comp_method'];
 		$ovpnent['ns_cert_type'] = $_POST['ns_cert_type'] ? true : false;
 		$ovpnent['pull'] = $_POST['pull'] ? true : false;
+		$ovpnent['dupcn'] = $_POST['dupcn'] ? true : false;
 		$ovpnent['tlsauth'] = $_POST['tlsauth'] ? true : false;
 		$ovpnent['bridge'] = $_POST['bridge'];
 		$ovpnent['lipaddr'] = $_POST['lipaddr'];
@@ -292,12 +285,7 @@ if ($_POST) {
 	}
 }
 
-
-$pgtitle = "VPN: OpenVPN: Edit client";
-include("head.inc");
-
 ?>
-
 <?php include("fbegin.inc"); ?>
 <script language="JavaScript">
 function enable_change(enable_over) {
@@ -318,6 +306,7 @@ function enable_change(enable_over) {
 	document.iform.cli_cert.disabled = endis;
 	document.iform.cli_key.disabled = endis;
 	document.iform.crypto.disabled = endis;
+	document.iform.comp_method.disabled = endis;
 	document.iform.ns_cert_type.disabled = endis;
 	document.iform.pull.disabled = endis;
 	document.iform.tlsauth.disabled = endis;
@@ -342,7 +331,6 @@ function expertmode_change(enable_over) {
 	document.iform.expertmode_options.disabled = endis;
 }
 
-
 function tls_change(enable_over) {
 	var endis;
 	endis = !(document.iform.tlsauth.checked || enable_over);
@@ -659,13 +647,44 @@ function get_radio_value(obj) {
     <tr>
       <td colspan="2" valign="top" class="listtopic">Client Options</td>
     </tr>
+
     <tr>
+      <td width="22%" valign="top" class="vncell">Pull Options</td>
+      <td width="78%" class="vtable">
+        <input type="checkbox" name="pull" value="yes" <?php if ($pconfig['pull']) echo "checked"; ?>> 
+        <strong>Client-pull</strong><br>
+	This  option  must  be used on a client which is connecting to a
+	multi-client server.  It indicates to OpenVPN that it should
+	accept options pushed by the server, provided they are part of the
+	legal set of pushable options.
+	</td>
+    </tr>
 
-     <tr>
-       <td width="22%" valign="top" class="vncell">Options</td>
-       <td width="78%" class="vtable">
-         <input type="checkbox" name="pull" value="yes" <?php if ($pconfig['pull']) echo "checked"; ?>> 
-         <strong>Client-pull</strong></td>
+    <tr>
+      <td width="22%" valign="top" class="vncell">Compression method</td>
+      <td width="78%" class="vtable">
+	<select name="comp_method" class="formfld" id="comp_method">
+	<option <?php if (!$pconfig['comp_method']) echo "selected";?> value="">none</option>
+	<?php $compression_method = array('lzo' => 'LZO', 'noadapt' => 'LZO (no adaptive)');
+	    foreach($compression_method as $comp_method => $comp_methodname): ?>
+		<option value="<?=$comp_method;?>"
+		<?php if ($comp_method == $pconfig['comp_method']) echo "selected";?>>
+		  <?=htmlspecialchars($comp_methodname);?>
+		</option>
+	<?php endforeach; ?>
+	</select>
+	<br>
+	Choose which compression method to use.<br>
+	<br>
+	LZO compression generally improves performance on slow links,
+	but may add up to 1 byte per packet for incompressible data.<br>
+	<br>
+	With adaptive compression, OpenVPN will periodically sample the
+	compression process to measure its efficiency. If the data being
+	sent over the tunnel is already compressed, the compression
+	efficiency will be very low. Choose 'LZO (no adaptive)'
+	to disable OpenVPN's adaptive compression algorithm.
+	</td>
      </tr>
 
      <tr>
diff --git a/usr/local/www/vpn_openvpn_srv.php b/usr/local/www/vpn_openvpn_srv.php
index 5cd6ff1..9ad6b6b 100755
--- a/usr/local/www/vpn_openvpn_srv.php
+++ b/usr/local/www/vpn_openvpn_srv.php
@@ -29,6 +29,7 @@
 	POSSIBILITY OF SUCH DAMAGE.
 */
 
+$pgtitle = array("VPN", "OpenVPN");
 require("guiconfig.inc");
 require_once("openvpn.inc");
 
@@ -82,12 +83,7 @@ if ($_GET['act'] == "del") {
 		exit;
 	}
 }
-
-$pgtitle = "VPN: OpenVPN";
-include("head.inc");
-
 ?>
-
 <?php include("fbegin.inc"); ?>
 <?php if ($input_errors) print_input_errors($input_errors); ?>
 <?php if (file_exists($d_sysrebootreqd_path) && !file_exists($d_ovpnsrvdirty_path)) print_info_box(get_std_save_message(0)); ?>
diff --git a/usr/local/www/vpn_openvpn_srv_edit.php b/usr/local/www/vpn_openvpn_srv_edit.php
index e2ac9f1..4ba535f 100755
--- a/usr/local/www/vpn_openvpn_srv_edit.php
+++ b/usr/local/www/vpn_openvpn_srv_edit.php
@@ -29,6 +29,7 @@
 	POSSIBILITY OF SUCH DAMAGE.
 */
 
+$pgtitle = array("VPN", "OpenVPN", "Edit server");
 require("guiconfig.inc");
 require_once("openvpn.inc");
 
@@ -80,7 +81,6 @@ if ($_POST) {
 
 	unset($input_errors);
 	unset($check_ipblock);
-	unset($bridge_reset);
 
 	/* input validation */
 	$reqdfields = explode(" ", "type bind_iface");
@@ -170,6 +170,8 @@ if ($_POST) {
 		if ($_POST['ipblock'] && $check_ipblock) {
 			if (!is_ipaddr($_POST['ipblock'])) {
 				$input_errors[] = "A valid IP netblock must be specified.";
+			} else if ($_POST['type'] == "tun" && intval($_POST['prefix']) > 29) {
+				$input_errors[] = "Network mask too high for tun-style tunnels.";
 			} else {
 				$network = ip2long(gen_subnet($_POST['ipblock'], $_POST['prefix']));
 				$broadcast = ip2long(gen_subnet_max($_POST['ipblock'], $_POST['prefix']));
@@ -242,9 +244,6 @@ if ($_POST) {
 
 			if (ip2long($_POST['range_from']) > ip2long($_POST['range_to']))
 				$input_errors[] = "The range is invalid (first element higher than second element).";
-
-			if (!($_POST['type'] == "tap" && $_POST['authentication_method'] == "rsasig"))
-				$bridge_reset = 1;
 		}
 	}
 
@@ -295,8 +294,6 @@ if ($_POST) {
 
 			if (!empty($retval))
 				$input_errors[] = $retval;
-			else
-				ovpn_srv_dirty($ovpnent['tun_iface']);
 		}
 
 		/* port number syntactically valid, so lets check, if it is free */
@@ -344,12 +341,6 @@ if ($_POST) {
 
 		}
 
-		/* Has the enable/disable state changed? */
-		if (isset($ovpnent['enable']) && isset($_POST['disabled'])) {
-			/* status changed to disabled */
-			ovpn_srv_dirty($ovpnent['tun_iface']);
-		}
-
 		/* status changed to enable */
 		if (!isset($ovpnent['enable']) && !isset($_POST['disabled'])) {
 
@@ -367,8 +358,6 @@ if ($_POST) {
 					$input_errors[] = "OpenVPN binding already in use by another OpenVPN daemon.";
 				}
 			}
-
-			ovpn_srv_dirty($ovpnent['tun_iface']);
 		}
 
 	} else {
@@ -404,8 +393,6 @@ if ($_POST) {
 
 			if (!empty($retval))
 				$input_errors[] = $retval;
-			else
-				ovpn_srv_dirty($ovpnent['tun_iface']);
 		}
 	}
 
@@ -434,6 +421,7 @@ if ($_POST) {
 		$ovpnent['verb'] = $_POST['verb'];
 		$ovpnent['maxcli'] = $_POST['maxcli'];
 		$ovpnent['crypto'] = $_POST['crypto'];
+		$ovpnent['comp_method'] = $_POST['comp_method'];
 		$ovpnent['cli2cli'] = $_POST['cli2cli'] ? true : false;
 		$ovpnent['dupcn'] = $_POST['dupcn'] ? true : false;
 		$ovpnent['dynip'] = $_POST['dynip'] ? true : false;
@@ -525,11 +513,8 @@ if ($_POST) {
 	}
 }
 
-$pgtitle = "VPN: OpenVPN: Edit Server";
-include("head.inc");
 
 ?>
-
 <?php include("fbegin.inc"); ?>
 <script language="JavaScript">
 function enable_change(enable_over) {
@@ -568,6 +553,7 @@ function enable_change(enable_over) {
 	document.iform.netmask.disabled = endis;
 	document.iform.cli2cli.disabled = endis;
 	document.iform.dupcn.disabled = endis;
+	document.iform.comp_method.disabled = endis;
 	document.iform.psh_redir.disabled = endis;
 	document.iform.psh_redir_loc.disabled = endis;
 	document.iform.psh_rtedelay.disabled = endis;
@@ -609,7 +595,6 @@ function tls_change(enable_over) {
         document.iform.psk.disabled = endis;
 }
 
-
 function expertmode_change(enable_over) {
 	var endis;
 	endis = !(document.iform.expertmode_enabled.checked || enable_over);
@@ -676,6 +661,19 @@ function methodsel_change(enable_over) {
 			document.iform.lipaddr.disabled = 1;
 			document.iform.ripaddr.disabled = 1;
 			document.iform.netmask.disabled = 1;
+			document.iform.cli2cli.disabled = 0;
+			document.iform.psh_redir.disabled = 0;
+			document.iform.psh_redir_loc.disabled = 0;
+			document.iform.psh_rtedelay.disabled = 0;
+			document.iform.psh_rtedelay_int.disabled = 0;
+			document.iform.psh_inact.disabled = 0;
+			document.iform.psh_inact_int.disabled = 0;
+			document.iform.psh_ping.disabled = 0;
+			document.iform.psh_ping_int.disabled = 0;
+			document.iform.psh_pingexit.disabled = 0;
+			document.iform.psh_pingexit_int.disabled = 0;
+			document.iform.psh_pingrst.disabled = 0;
+			document.iform.psh_pingrst_int.disabled = 0;
 			tls_change();
 			break;
 		default: /* pre-shared */
@@ -715,6 +713,18 @@ function methodsel_change(enable_over) {
 			document.iform.dupcn.checked = 0;
 			document.iform.cli2cli.disabled = 1;
 			document.iform.cli2cli.checked = 0;
+			document.iform.psh_redir.disabled = 1;
+			document.iform.psh_redir_loc.disabled = 1;
+			document.iform.psh_rtedelay.disabled = 1;
+			document.iform.psh_rtedelay_int.disabled = 1;
+			document.iform.psh_inact.disabled = 1;
+			document.iform.psh_inact_int.disabled = 1;
+			document.iform.psh_ping.disabled = 1;
+			document.iform.psh_ping_int.disabled = 1;
+			document.iform.psh_pingexit.disabled = 1;
+			document.iform.psh_pingexit_int.disabled = 1;
+			document.iform.psh_pingrst.disabled = 1;
+			document.iform.psh_pingrst_int.disabled = 1;
 			break;
 	}
 
@@ -1090,6 +1100,33 @@ function get_radio_value(obj) {
     </tr>
 	 
     <tr>
+      <td width="22%" valign="top" class="vncell">Compression method</td>
+      <td width="78%" class="vtable">
+        <select name="comp_method" class="formfld" id="comp_method">
+        <option <?php if (!$pconfig['comp_method']) echo "selected";?> value="">none</option>
+        <?php $compression_method = array('lzo' => 'LZO', 'noadapt' => 'LZO (no adaptive)');
+            foreach($compression_method as $comp_method => $comp_methodname): ?>
+                <option value="<?=$comp_method;?>"
+		<?php if ($comp_method == $pconfig['comp_method']) echo "selected";?>>
+                  <?=htmlspecialchars($comp_methodname);?>
+                </option>
+        <?php endforeach; ?>
+        </select> 
+	<br>
+	Choose which compression method to use.<br>
+	<br>
+	LZO compression generally improves performance on slow links,
+	but may add up to 1 byte per packet for incompressible data.<br>
+	<br>
+	With adaptive compression, OpenVPN will periodically sample the
+	compression process to measure its efficiency. If the data being
+	sent over the tunnel is already compressed, the compression
+	efficiency will be very low. Choose 'LZO (no adaptive)'
+	to disable OpenVPN's adaptive compression algorithm.
+	</td>
+    </tr>
+	 
+    <tr>
       <td width="22%" valign="top" class="vncell">Client-push options</td>
       <td width="78%" class="vtable">
 	    <table border="0" cellspacing="0" cellpadding="0">