Add tls-auth, use opendns for resolvers, dont install/configure iptables, use udp, persist ip assignments, and disallow multiple connections per cert