@@ -97,25 +97,25 @@ with a relatively lightweight footprint.

 .SH OPTIONS

 OpenVPN allows any option to be placed either on the command line

 or in a configuration file.  Though all command line options are preceded

-by a double-leading-dash ("--"), this prefix can be removed when

+by a double-leading-dash ("\-\-"), this prefix can be removed when

 an option is placed in a configuration file.

 .\"*********************************************************

 .TP

-.B --help

+.B \-\-help

 Show options.

 .\"*********************************************************

 .TP

-.B --config file

+.B \-\-config file

 Load additional config options from

 .B file

 where each line corresponds to one command line option,

-but with the leading '--' removed.

+but with the leading '\-\-' removed.

 If

-.B --config file

+.B \-\-config file

 is the only option to the openvpn command,

 the

-.B --config

+.B \-\-config

 can be removed, and the command can be given as

 .B openvpn file

@@ -187,25 +187,25 @@ secret static.key

 .\"*********************************************************

 .SS Tunnel Options:

 .TP

-.B --mode m

+.B \-\-mode m

 Set OpenVPN major mode.  By default, OpenVPN runs in

 point-to-point mode ("p2p").  OpenVPN 2.0 introduces

 a new mode ("server") which implements a multi-client

 server capability.

 .\"*********************************************************

 .TP

-.B --local host

+.B \-\-local host

 Local host name or IP address for bind.

 If specified, OpenVPN will bind to this address only.

 If unspecified, OpenVPN will bind to all interfaces.

 .\"*********************************************************

 .TP

-.B --remote host [port] [proto]

+.B \-\-remote host [port] [proto]

 Remote host name or IP address.  On the client, multiple

-.B --remote

+.B \-\-remote

 options may be specified for redundancy, each referring

 to a different OpenVPN server.  Specifying multiple

-.B --remote

+.B \-\-remote

 options for this purpose is a special case of the more

 general connection-profile feature.  See the

 .B <connection>

@@ -214,7 +214,7 @@ documentation below.

 The OpenVPN client will try to connect to a server at

 .B host:port

 in the order specified by the list of

-.B --remote

+.B \-\-remote

 options.

 .B proto

@@ -229,18 +229,18 @@ one server.

 Note that since UDP is connectionless, connection failure

 is defined by the

-.B --ping

+.B \-\-ping

 and

-.B --ping-restart

+.B \-\-ping-restart

 options.

 Note the following corner case:  If you use multiple

-.B --remote

+.B \-\-remote

 options, AND you are dropping root privileges on

 the client with

-.B --user

+.B \-\-user

 and/or

-.B --group,

+.B \-\-group,

 AND the client is running a non-Windows OS, if the client needs

 to switch to a different server, and that server pushes

 back different TUN/TAP or route settings, the client may lack

@@ -248,7 +248,7 @@ the necessary privileges to close and reopen the TUN/TAP interface.

 This could cause the client to exit with a fatal error.

 If

-.B --remote

+.B \-\-remote

 is unspecified, OpenVPN will listen

 for packets from any IP address, but will not act on those packets unless

 they pass all authentication tests.  This requirement for authentication

@@ -257,7 +257,7 @@ trusted IP addresses (it is very easy to forge a source IP address on

 a UDP packet).

 When used in TCP mode, 

-.B --remote

+.B \-\-remote

 will act as a filter, rejecting connections from any host which does

 not match

 .B host.

@@ -283,7 +283,7 @@ and

 An OpenVPN client will try each connection profile sequentially

 until it achieves a successful connection.  

-.B --remote-random

+.B \-\-remote-random

 can be used to initially "scramble" the connection

 list.

@@ -387,15 +387,15 @@ only consider profiles using protocol

 ('tcp'|'udp'). 

 .\"*********************************************************

 .TP

-.B --remote-random

+.B \-\-remote-random

 When multiple

-.B --remote

+.B \-\-remote

 address/ports are specified, or if connection profiles are being

 used, initially randomize the order of the list

 as a kind of basic load-balancing measure.

 .\"*********************************************************

 .TP

-.B --proto p

+.B \-\-proto p

 Use protocol

 .B p

 for communicating with remote host.

@@ -409,17 +409,17 @@ or

 The default protocol is

 .B udp

 when

-.B --proto

+.B \-\-proto

 is not specified.

 For UDP operation,

-.B --proto udp

+.B \-\-proto udp

 should be specified on both peers.

 For TCP operation, one peer must use

-.B --proto tcp-server

+.B \-\-proto tcp-server

 and the other must use

-.B --proto tcp-client.

+.B \-\-proto tcp-client.

 A peer started with

 .B tcp-server

 will wait indefinitely for an incoming connection.  A peer

@@ -427,9 +427,9 @@ started with

 .B tcp-client

 will attempt to connect, and if that fails, will sleep for 5

 seconds (adjustable via the

-.B --connect-retry

+.B \-\-connect-retry

 option) and try again infinite or up to N retries (adjustable via the

-.B --connect-retry-max

+.B \-\-connect-retry-max

 option).  Both TCP client and server will simulate

 a SIGUSR1 restart signal if either side resets the connection.

@@ -449,9 +449,9 @@ application-level UDP protocols, or tunneling protocols which don't

 possess a built-in reliability layer.

 .\"*********************************************************

 .TP

-.B --connect-retry n

+.B \-\-connect-retry n

 For

-.B --proto tcp-client,

+.B \-\-proto tcp-client,

 take

 .B n

 as the

@@ -459,16 +459,16 @@ number of seconds to wait

 between connection retries (default=5).

 .\"*********************************************************

 .TP

-.B --connect-retry-max n

+.B \-\-connect-retry-max n

 For

-.B --proto tcp-client,

+.B \-\-proto tcp-client,

 take

 .B n

 as the

 number of retries of connection attempt (default=infinite).

 .\"*********************************************************

 .TP

-.B --auto-proxy

+.B \-\-auto-proxy

 Try to sense HTTP or SOCKS proxy settings automatically.

 If no settings are present, a direct connection will be attempted.

 If both HTTP and SOCKS settings are present, HTTP will be preferred.

@@ -480,7 +480,7 @@ InternetQueryOption API.

 This option exists in OpenVPN 2.1 or higher.

 .\"*********************************************************

 .TP

-.B --http-proxy server port [authfile|'auto'|'auto-nct'] [auth-method]

+.B \-\-http-proxy server port [authfile|'auto'|'auto-nct'] [auth-method]

 Connect to remote host through an HTTP proxy at address

 .B server

 and port

@@ -515,32 +515,32 @@ determine the authentication method, but to reject weak

 authentication protocols such as HTTP Basic Authentication.

 .\"*********************************************************

 .TP

-.B --http-proxy-retry

+.B \-\-http-proxy-retry

 Retry indefinitely on HTTP proxy errors.  If an HTTP proxy error

 occurs, simulate a SIGUSR1 reset.

 .\"*********************************************************

 .TP

-.B --http-proxy-timeout n

+.B \-\-http-proxy-timeout n

 Set proxy timeout to

 .B n

 seconds, default=5.

 .\"*********************************************************

 .TP

-.B --http-proxy-option type [parm]

+.B \-\-http-proxy-option type [parm]

 Set extended HTTP proxy options.

 Repeat to set multiple options.

-.B VERSION version --

+.B VERSION version \-\-

 Set HTTP version number to

 .B version

 (default=1.0).

-.B AGENT user-agent --

+.B AGENT user-agent \-\-

 Set HTTP "User-Agent" string to

 .B user-agent.

 .\"*********************************************************

 .TP

-.B --socks-proxy server [port]

+.B \-\-socks-proxy server [port]

 Connect to remote host through a Socks5 proxy at address

 .B server

 and port

@@ -548,14 +548,14 @@ and port

 (default=1080).

 .\"*********************************************************

 .TP

-.B --socks-proxy-retry

+.B \-\-socks-proxy-retry

 Retry indefinitely on Socks proxy errors.  If a Socks proxy error

 occurs, simulate a SIGUSR1 reset.

 .\"*********************************************************

 .TP

-.B --resolv-retry n

+.B \-\-resolv-retry n

 If hostname resolve fails for

-.B --remote,

+.B \-\-remote,

 retry resolve for

 .B n

 seconds before failing.

@@ -565,18 +565,18 @@ Set

 to "infinite" to retry indefinitely.

 By default,

-.B --resolv-retry infinite

+.B \-\-resolv-retry infinite

 is enabled.  You can disable by setting n=0.

 .\"*********************************************************

 .TP

-.B --float

+.B \-\-float

 Allow remote peer to change its IP address and/or port number, such as due to

 DHCP (this is the default if

-.B --remote

+.B \-\-remote

 is not used).

-.B --float

+.B \-\-float

 when specified with

-.B --remote

+.B \-\-remote

 allows an OpenVPN session to initially connect to a peer

 at a known address, however if packets arrive from a new

 address and pass all authentication tests, the new address

@@ -585,14 +585,14 @@ you are connecting to a peer which holds a dynamic address

 such as a dial-in user or DHCP client.

 Essentially,

-.B --float

+.B \-\-float

 tells OpenVPN to accept authenticated packets

 from any address, not only the address which was specified in the

-.B --remote

+.B \-\-remote

 option.

 .\"*********************************************************

 .TP

-.B --ipchange cmd

+.B \-\-ipchange cmd

 Execute shell command

 .B cmd

 when our remote ip-address is initially authenticated or

@@ -603,11 +603,11 @@ Execute as:

 .B cmd ip_address port_number

 Don't use

-.B --ipchange

+.B \-\-ipchange

 in

-.B --mode server

+.B \-\-mode server

 mode.  Use a

-.B --client-connect

+.B \-\-client-connect

 script instead.

 See the "Environmental Variables" section below for

@@ -642,41 +642,41 @@ reestablish a connection with its most recently authenticated

 peer on its new IP address.

 .\"*********************************************************

 .TP

-.B --port port

+.B \-\-port port

 TCP/UDP port number for both local and remote.  The current

 default of 1194 represents the official IANA port number

 assignment for OpenVPN and has been used since version 2.0-beta17.

 Previous versions used port 5000 as the default.

 .\"*********************************************************

 .TP

-.B --lport port

+.B \-\-lport port

 TCP/UDP port number for bind.

 .\"*********************************************************

 .TP

-.B --rport port

+.B \-\-rport port

 TCP/UDP port number for remote.

 .\"*********************************************************

 .TP

-.B --bind

+.B \-\-bind

 Bind to local address and port. This is the default unless any of 

-.B --proto tcp-client

+.B \-\-proto tcp-client

 ,

-.B --http-proxy

+.B \-\-http-proxy

 or

-.B --socks-proxy

+.B \-\-socks-proxy

 are used.

 .\"*********************************************************

 .TP

-.B --nobind

+.B \-\-nobind

 Do not bind to local address and port.  The IP stack will allocate

 a dynamic port for returning packets.  Since the value of the dynamic port

 could not be known in advance by a peer, this option is only suitable for

 peers which will be initiating connections by using the

-.B --remote

+.B \-\-remote

 option.

 .\"*********************************************************

 .TP

-.B --dev tunX | tapX | null

+.B \-\-dev tunX | tapX | null

 TUN/TAP virtual network device (

 .B X

 can be omitted for a dynamic device.)

@@ -694,7 +694,7 @@ devices encapsulate IPv4 or IPv6 (OSI Layer 3) while

 devices encapsulate Ethernet 802.3 (OSI Layer 2).

 .\"*********************************************************

 .TP

-.B --dev-type device-type

+.B \-\-dev-type device-type

 Which device type are we using?

 .B device-type

 should be

@@ -704,60 +704,60 @@ or

 .B tap

 (OSI Layer 2).

 Use this option only if the TUN/TAP device used with

-.B --dev

+.B \-\-dev

 does not begin with

 .B tun

 or

 .B tap.

 .\"*********************************************************

 .TP

-.B --topology mode

+.B \-\-topology mode

 Configure virtual addressing topology when running in

-.B --dev tun

+.B \-\-dev tun

 mode.  This directive has no meaning in

-.B --dev tap

+.B \-\-dev tap

 mode, which always uses a

 .B subnet

 topology.

 If you set this directive on the server, the

-.B --server

+.B \-\-server

 and

-.B --server-bridge

+.B \-\-server-bridge

 directives will automatically push your chosen topology setting to clients

 as well.  This directive can also be manually pushed to clients.  Like the

-.B --dev

+.B \-\-dev

 directive, this directive must always be compatible between client and server.

 .B mode

 can be one of:

-.B net30 --

+.B net30 \-\-

 Use a point-to-point topology, by allocating one /30 subnet per client.

 This is designed to allow point-to-point semantics when some

 or all of the connecting clients might be Windows systems.  This is the

 default on OpenVPN 2.0.

-.B p2p --

+.B p2p \-\-

 Use a point-to-point topology where the remote endpoint of the client's

 tun interface always points to the local endpoint of the server's tun interface.

 This mode allocates a single IP address per connecting client.

 Only use

 when none of the connecting clients are Windows systems.  This mode

 is functionally equivalent to the

-.B --ifconfig-pool-linear

+.B \-\-ifconfig-pool-linear

 directive which is available in OpenVPN 2.0 and is now deprecated.

-.B subnet --

+.B subnet \-\-

 Use a subnet rather than a point-to-point topology by

 configuring the tun interface with a local IP address and subnet mask,

 similar to the topology used in

-.B --dev tap

+.B \-\-dev tap

 and ethernet bridging mode.

 This mode allocates a single IP address per connecting client and works on

 Windows as well.  Only available when server and clients are OpenVPN 2.1 or

 higher, or OpenVPN 2.0.x which has been manually patched with the

-.B --topology

+.B \-\-topology

 directive code.  When used on Windows, requires version 8.2 or higher

 of the TAP-Win32 driver.  When used on *nix, requires that the tun

 driver supports an

@@ -767,26 +767,26 @@ command which sets a subnet instead of a remote endpoint IP address.

 This option exists in OpenVPN 2.1 or higher.

 .\"*********************************************************

 .TP

-.B --tun-ipv6

+.B \-\-tun-ipv6

 Build a tun link capable of forwarding IPv6 traffic.

 Should be used in conjunction with

-.B --dev tun

+.B \-\-dev tun

 or

-.B --dev tunX.

+.B \-\-dev tunX.

 A warning will be displayed

 if no specific IPv6 TUN support for your OS has been compiled into OpenVPN.

 .\"*********************************************************

 .TP

-.B --dev-node node

+.B \-\-dev-node node

 Explicitly set the device node rather than using

 /dev/net/tun, /dev/tun, /dev/tap, etc.  If OpenVPN

 cannot figure out whether

 .B node

 is a TUN or TAP device based on the name, you should

 also specify

-.B --dev-type tun

+.B \-\-dev-type tun

 or

-.B --dev-type tap.

+.B \-\-dev-type tap.

 On Windows systems, select the TAP-Win32 adapter which

 is named

@@ -794,24 +794,24 @@ is named

 in the Network Connections Control Panel or the

 raw GUID of the adapter enclosed by braces.

 The

-.B --show-adapters

+.B \-\-show-adapters

 option under Windows can also be used

 to enumerate all available TAP-Win32

 adapters and will show both the network

 connections control panel name and the GUID for

 each TAP-Win32 adapter.

 .TP

-.B --lladdr address

+.B \-\-lladdr address

 Specify the link layer address, more commonly known as the MAC address.

 Only applied to TAP devices.

 .\"*********************************************************

 .TP

-.B --iproute cmd

+.B \-\-iproute cmd

 Set alternate command to execute instead of default iproute2 command.

 May be used in order to execute OpenVPN in unprivileged environment.

 .\"*********************************************************

 .TP

-.B --ifconfig l rn

+.B \-\-ifconfig l rn

 Set TUN/TAP adapter parameters. 

 .B l

 is the IP address of the local VPN endpoint.

@@ -826,7 +826,7 @@ which is being created or connected to.

 For TUN devices, which facilitate virtual

 point-to-point IP connections,

 the proper usage of

-.B --ifconfig

+.B \-\-ifconfig

 is to use two private IP addresses

 which are not a member of any

 existing subnet which is in use.

@@ -840,7 +840,7 @@ you will be pinging across the VPN.

 For TAP devices, which provide

 the ability to create virtual

 ethernet segments,

-.B --ifconfig

+.B \-\-ifconfig

 is used to set an IP address and

 subnet mask just as a physical

 ethernet adapter would be

@@ -861,42 +861,42 @@ standard interface to the different

 ifconfig implementations on different

 platforms.

-.B --ifconfig

+.B \-\-ifconfig

 parameters which are IP addresses can

 also be specified as a DNS or /etc/hosts

 file resolvable name.

 For TAP devices,

-.B --ifconfig

+.B \-\-ifconfig

 should not be used if the TAP interface will be

 getting an IP address lease from a DHCP

 server.

 .\"*********************************************************

 .TP

-.B --ifconfig-noexec

+.B \-\-ifconfig-noexec

 Don't actually execute ifconfig/netsh commands, instead

 pass

-.B --ifconfig

+.B \-\-ifconfig

 parameters to scripts using environmental variables.

 .\"*********************************************************

 .TP

-.B --ifconfig-nowarn

+.B \-\-ifconfig-nowarn

 Don't output an options consistency check warning

 if the

-.B --ifconfig

+.B \-\-ifconfig

 option on this side of the

 connection doesn't match the remote side.  This is useful

 when you want to retain the overall benefits of the

 options consistency check (also see

-.B --disable-occ

+.B \-\-disable-occ

 option) while only disabling the ifconfig component of

 the check.

 For example,

 if you have a configuration where the local host uses

-.B --ifconfig

+.B \-\-ifconfig

 but the remote host does not, use

-.B --ifconfig-nowarn

+.B \-\-ifconfig-nowarn

 on the local host.

 This option will also silence warnings about potential

@@ -904,7 +904,7 @@ address conflicts which occasionally annoy more experienced

 users by triggering "false positive" warnings.

 .\"*********************************************************

 .TP

-.B --route network/IP [netmask] [gateway] [metric]

+.B \-\-route network/IP [netmask] [gateway] [metric]

 Add route to routing table after connection is established.

 Multiple routes can be specified.  Routes will be

 automatically torn down in reverse order prior to

@@ -918,20 +918,20 @@ while at the same time providing portable semantics

 across OpenVPN's platform space.

 .B netmask

-default -- 255.255.255.255

+default \-\- 255.255.255.255

 .B gateway

-default -- taken from

-.B --route-gateway

+default \-\- taken from

+.B \-\-route-gateway

 or the second parameter to

-.B --ifconfig

+.B \-\-ifconfig

 when

-.B --dev tun

+.B \-\-dev tun

 is specified.

 .B metric

-default -- taken from

-.B --route-metric

+default \-\- taken from

+.B \-\-route-metric

 otherwise 0.

 The default can be specified by leaving an option blank or setting

@@ -946,37 +946,37 @@ also be specified as a DNS or /etc/hosts

 file resolvable name, or as one of three special keywords:

 .B vpn_gateway

+\-\- The remote VPN endpoint address

 (derived either from

-.B --route-gateway

+.B \-\-route-gateway

 or the second parameter to

-.B --ifconfig

+.B \-\-ifconfig

 when

-.B --dev tun

+.B \-\-dev tun

 is specified).

 .B net_gateway

+\-\- The pre-existing IP default gateway, read from the routing

 table (not supported on all OSes).

 .B remote_host

-.B --remote

+\-\- The

+.B \-\-remote

 address if OpenVPN is being run in client mode, and is undefined in server mode.

 .\"*********************************************************

 .TP

-.B --max-routes n

+.B \-\-max-routes n

 Allow a maximum number of n

-.B --route

+.B \-\-route

 options to be specified, either in the local configuration file,

 or pulled from an OpenVPN server.  By default, n=100.

 .\"*********************************************************

 .TP

-.B --route-gateway gw|'dhcp'

+.B \-\-route-gateway gw|'dhcp'

 Specify a default gateway

 .B gw

 for use with

-.B --route.

+.B \-\-route.

 If

 .B dhcp

@@ -985,14 +985,14 @@ the gateway address will be extracted from a DHCP

 negotiation with the OpenVPN server-side LAN.

 .\"*********************************************************

 .TP

-.B --route-metric m

+.B \-\-route-metric m

 Specify a default metric

 .B m

 for use with

-.B --route.

+.B \-\-route.

 .\"*********************************************************

 .TP

-.B --route-delay [n] [w]

+.B \-\-route-delay [n] [w]

 Delay

 .B n

 seconds (default=0) after connection

@@ -1000,16 +1000,16 @@ establishment, before adding routes. If

 .B n

 is 0, routes will be added immediately upon connection

 establishment.  If

-.B --route-delay

+.B \-\-route-delay

 is omitted, routes will be added immediately after TUN/TAP device

 open and

-.B --up

+.B \-\-up

 script execution, before any

-.B --user

+.B \-\-user

 or 

-.B --group

+.B \-\-group

 privilege downgrade (or

-.B --chroot

+.B \-\-chroot

 execution.)

 This option is designed to be useful in scenarios where DHCP is

@@ -1018,18 +1018,18 @@ tap adapter addresses.  The delay will give the DHCP handshake

 time to complete before routes are added.

 On Windows,

-.B --route-delay

+.B \-\-route-delay

 tries to be more intelligent by waiting

 .B w

 seconds (w=30 by default)

 for the TAP-Win32 adapter to come up before adding routes.

 .\"*********************************************************

 .TP

-.B --route-up cmd

+.B \-\-route-up cmd

 Execute shell command

 .B cmd

 after routes are added, subject to

-.B --route-delay.

+.B \-\-route-delay.

 See the "Environmental Variables" section below for

 additional parameters passed as environmental variables.

@@ -1039,17 +1039,17 @@ Note that

 can be a shell command with multiple arguments.

 .\"*********************************************************

 .TP

-.B --route-noexec

+.B \-\-route-noexec

 Don't add or remove routes automatically.  Instead pass routes to

-.B --route-up

+.B \-\-route-up

 script using environmental variables.

 .\"*********************************************************

 .TP

-.B --route-nopull

+.B \-\-route-nopull

 When used with

-.B --client

+.B \-\-client

 or

-.B --pull,

+.B \-\-pull,

 accept options pushed by server EXCEPT for routes.

 When used on the client, this option effectively bars the

@@ -1058,16 +1058,16 @@ however note that this option still allows the server

 to set the TCP/IP properties of the client's TUN/TAP interface.

 .\"*********************************************************

 .TP

-.B --allow-pull-fqdn

+.B \-\-allow-pull-fqdn

 Allow client to pull DNS names from server (rather than being limited

 to IP address) for

-.B --ifconfig,

-.B --route,

+.B \-\-ifconfig,

+.B \-\-route,

 and

-.B --route-gateway.

+.B \-\-route-gateway.

 .\"*********************************************************

 .TP

-.B --redirect-gateway flags...

+.B \-\-redirect-gateway flags...

 (Experimental) Automatically execute routing commands to cause all outgoing IP traffic

 to be redirected over the VPN.

@@ -1075,7 +1075,7 @@ This option performs three steps:

 .B (1)

 Create a static route for the

-.B --remote

+.B \-\-remote

 address which forwards to the pre-existing default gateway.

 This is done so that

 .B (3)

@@ -1086,11 +1086,11 @@ Delete the default gateway route.

 .B (3)

 Set the new default gateway to be the VPN endpoint address (derived either from

-.B --route-gateway

+.B \-\-route-gateway

 or the second parameter to

-.B --ifconfig

+.B \-\-ifconfig

 when

-.B --dev tun

+.B \-\-dev tun

 is specified).

 When the tunnel is torn down, all of the above steps are reversed so

@@ -1098,7 +1098,7 @@ that the original default route is restored.

 Option flags:

-.B local --

+.B local \-\-

 Add the

 .B local

 flag if both OpenVPN servers are directly connected via a common subnet,

@@ -1108,19 +1108,19 @@ flag will cause step

 .B 1

 above to be omitted.

-.B def1 --

+.B def1 \-\-

 Use this flag to override

 the default gateway by using 0.0.0.0/1 and 128.0.0.0/1

 rather than 0.0.0.0/0.  This has the benefit of overriding

 but not wiping out the original default gateway. 

-.B bypass-dhcp --

+.B bypass-dhcp \-\-

 Add a direct route to the DHCP server (if it is non-local) which

 bypasses the tunnel

 (Available on Windows clients, may not be available

 on non-Windows clients).

-.B bypass-dns --

+.B bypass-dns \-\-

 Add a direct route to the DNS server(s) (if they are non-local) which

 bypasses the tunnel

 (Available on Windows clients, may not be available

@@ -1129,13 +1129,13 @@ on non-Windows clients).

 Using the def1 flag is highly recommended.

 .\"*********************************************************

 .TP

-.B --link-mtu n

+.B \-\-link-mtu n

 Sets an upper bound on the size of UDP packets which are sent

 between OpenVPN peers.  It's best not to set this parameter unless

 you know what you're doing.

 .\"*********************************************************

 .TP

-.B --tun-mtu n

+.B \-\-tun-mtu n

 Take the TUN device MTU to be

 .B n

 and derive the link MTU

@@ -1151,17 +1151,17 @@ MTU problems often manifest themselves as connections which

 hang during periods of active usage.

 It's best to use the

-.B --fragment

+.B \-\-fragment

 and/or

-.B --mssfix

+.B \-\-mssfix

 options to deal with MTU sizing issues.

 .\"*********************************************************

 .TP

-.B --tun-mtu-extra n

+.B \-\-tun-mtu-extra n

 Assume that the TUN/TAP device might return as many as

 .B n

 bytes more than the

-.B --tun-mtu

+.B \-\-tun-mtu

 size on read.  This parameter defaults to 0, which is sufficient for

 most TUN devices.  TAP devices may introduce additional overhead in excess

 of the MTU size, and a setting of 32 is the default when TAP devices are used.

@@ -1169,34 +1169,34 @@ This parameter only controls internal OpenVPN buffer sizing,

 so there is no transmission overhead associated with using a larger value.

 .\"*********************************************************

 .TP

-.B --mtu-disc type

+.B \-\-mtu-disc type

 Should we do Path MTU discovery on TCP/UDP channel?  Only supported on OSes such

 as Linux that supports the necessary system call to set.

 .B 'no'

+\-\- Never send DF (Don't Fragment) frames

 .br

 .B 'maybe'

+\-\- Use per-route hints

 .br

 .B 'yes'

+\-\- Always DF (Don't Fragment)