Document that --push-remove is generally more suitable than --push-reset

It's a long-standing and well-known problem that --push-reset removes
"critical" options from the push list (like "topology subnet") which
will then lead to non-working client configs.  This can not be
reasonably fixed, because the list of "critical" options depends on
overall server config.

So just document the fact, and point people towards --push-remove as
a more selective tool.

Trac: #29

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <20200908111511.9271-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg20899.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit 5fd66510dfdef628fa95f156c5f9d80af9ae1531)

diff --git a/doc/openvpn.8 b/doc/openvpn.8
index 8038e1f46da8a4bcb1fd2a125f05011d92166f1e..455a3247cc08cf6fa9b3914f267f75e5550ddf9d 100644 (file)
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -3014,6 +3014,19 @@ as with a
 configuration file.  This option will ignore
 .B \-\-push
 options at the global config file level.
+
+NOTE:
+.B \-\-push\-reset
+is very thorough: it will remove almost all options from the list of
+to-be-pushed options.  In many cases, some of these options will need
+to be re-configured afterwards - specifically,
+.B \-\-topology subnet
+and
+.B \-\-route-gateway
+will get lost and this will break client configs in many cases.  Thus,
+for most purposes,
+.B \-\-push-remove
+is better suited to selectively remove push options for individual clients.
 .\"*********************************************************
 .TP
 .B \-\-push\-remove opt