diff --git a/opnsense/fw01.ke.einsle.de b/opnsense/fw01.ke.einsle.de
index 418bc95..e979c01 100644
--- a/opnsense/fw01.ke.einsle.de
+++ b/opnsense/fw01.ke.einsle.de
@@ -228,6 +228,12 @@
       <member>2004</member>
       <priv>page-all</priv>
     </group>
+    <group>
+      <name>vpn</name>
+      <description>VPN Client Access</description>
+      <member>2000</member>
+      <gid>2000</gid>
+    </group>
     <user>
       <name>root</name>
       <descr>System Administrator</descr>
@@ -293,7 +299,7 @@
       <uid>2004</uid>
     </user>
     <nextuid>2005</nextuid>
-    <nextgid>2000</nextgid>
+    <nextgid>2001</nextgid>
     <timezone>Europe/Berlin</timezone>
     <timeservers>0.opnsense.pool.ntp.org 1.opnsense.pool.ntp.org 2.opnsense.pool.ntp.org 3.opnsense.pool.ntp.org</timeservers>
     <webgui>
@@ -1453,9 +1459,9 @@
     <column_count>2</column_count>
   </widgets>
   <revision>
-    <username>(system)</username>
-    <time>1568383321.3615</time>
-    <description>/usr/local/opnsense/mvc/script/run_migrations.php made changes</description>
+    <username>root@172.24.42.51</username>
+    <time>1568545541.6566</time>
+    <description>/vpn_openvpn_server.php made changes</description>
   </revision>
   <OPNsense>
     <Firewall>
@@ -1869,20 +1875,6 @@ PORT_mail</content>
       </zones>
       <templates/>
     </captiveportal>
-    <OpenVPNExport version="0.0.1">
-      <servers>
-        <server uuid="4d221ee2-b160-45e5-ae9e-856c1e6c0d40">
-          <vpnid>1</vpnid>
-          <hostname>re-ke.dnsalias.net</hostname>
-          <template>PlainOpenVPN</template>
-          <local_port>1194</local_port>
-          <random_local_port>1</random_local_port>
-          <validate_server_cn>1</validate_server_cn>
-          <auth_nocache>1</auth_nocache>
-          <plain_config/>
-        </server>
-      </servers>
-    </OpenVPNExport>
     <freeradius>
       <user version="1.0.2">
         <users/>
@@ -2317,6 +2309,21 @@ PORT_mail</content>
       <activeTimeout>1800</activeTimeout>
       <inactiveTimeout>15</inactiveTimeout>
     </Netflow>
+    <OpenVPNExport version="0.0.1">
+      <servers>
+        <server uuid="4d221ee2-b160-45e5-ae9e-856c1e6c0d40">
+          <vpnid>1</vpnid>
+          <hostname>re-ke.dnsalias.net</hostname>
+          <template>PlainOpenVPN</template>
+          <local_port>1194</local_port>
+          <random_local_port>1</random_local_port>
+          <validate_server_cn>1</validate_server_cn>
+          <cryptoapi>0</cryptoapi>
+          <auth_nocache>1</auth_nocache>
+          <plain_config/>
+        </server>
+      </servers>
+    </OpenVPNExport>
   </OPNsense>
   <gateways>
     <gateway_item>
@@ -2450,7 +2457,7 @@ PORT_mail</content>
   </wizardtemp>
   <openvpn>
     <openvpn-server>
-      <mode>server_tls</mode>
+      <mode>server_tls_user</mode>
       <protocol>UDP</protocol>
       <dev_mode>tun</dev_mode>
       <local_port>1194</local_port>
@@ -2463,6 +2470,7 @@ PORT_mail</content>
       <compression>adaptive</compression>
       <client2client>yes</client2client>
       <pool_enable>yes</pool_enable>
+      <local_group>vpn</local_group>
       <dns_domain>ke.einsle.de</dns_domain>
       <dns_server1>172.24.10.11</dns_server1>
       <dns_server2>172.24.10.12</dns_server2>
@@ -2470,8 +2478,9 @@ PORT_mail</content>
       <dns_server4>8.8.8.8</dns_server4>
       <push_register_dns>yes</push_register_dns>
       <netbios_ntype>0</netbios_ntype>
-      <verbosity_level>1</verbosity_level>
+      <verbosity_level>3</verbosity_level>
       <vpnid>1</vpnid>
+      <authmode>kedc01</authmode>
       <interface>any</interface>
       <custom_options/>
       <caref>5cbee047f2269</caref>