Fix push routes ops file

- update stemcell
- update openvpn release version
- fix docs: default protocol is tcp, not udp

deployment/init-aws.yml

@@ -8,8 +8,8 @@
 - type: replace
   path: /resource_pools/name=default/stemcell?
   value:
-    url: https://bosh.io/d/stemcells/bosh-aws-xen-hvm-ubuntu-trusty-go_agent?v=3421.9
-    sha1: 316a699d44f49d69493b1545d4addd17b78b5840
+    url: https://bosh.io/d/stemcells/bosh-aws-xen-hvm-ubuntu-trusty-go_agent?v=3421.11
+    sha1: 98f9b71398f0f771e8a4bbaf5531440b99bae540
 - type: replace
   path: /resource_pools/name=default/cloud_properties?
   value:

deployment/openvpn.yml

@@ -2,9 +2,8 @@
 name: openvpn
 releases:
 - name: openvpn
-  url: https://s3-external-1.amazonaws.com/dpb587-bosh-release-openvpn-us-east-1/compiled_releases/openvpn/openvpn-3.2.2-on-ubuntu-trusty-stemcell-3421.9-compiled-1.20170624025614.0.tgz
-  version: 3.2.2
-  sha1: 334b6d0b86ab80d4d03d93a672b7353412e764ea
+  url: https://s3-external-1.amazonaws.com/dpb587-bosh-release-openvpn-us-east-1/compiled_releases/openvpn/openvpn-4.0.0-on-ubuntu-trusty-stemcell-3421.11-compiled-1.20170630134749.0.tgz
+  sha1: 19e79e45b690bc933b0ff5d9e54574f25d0899b9
 - name: os-conf
   version: 11
   url: https://bosh.io/d/github.com/cloudfoundry/os-conf-release?v=11
@@ -36,7 +35,7 @@ instance_groups:
     release: openvpn
     properties:
       server: ((vpn_network)) ((vpn_network_mask))
-      tls_key_pair: ((server_key_pair))
+      tls_server: ((server_key_pair))
       dh_pem: |
         -----BEGIN DH PARAMETERS-----
         MIIBCAKCAQEA/oih/YXvkf13npOIF5LW170/V5j4R20NjL/IzgdZUYMlsQtm5zMZ

deployment/with-pushed-routes.yml

@@ -1,3 +1,3 @@
-- path: /instance_groups/name=openvpn/jobs/name=openvpn/properties/push_routes
+- path: /instance_groups/name=openvpn/jobs/name=openvpn/properties/push_routes?
   type: replace
   value: ((push_routes))

docs/ops/deployment/standalone-server.md

@@ -74,7 +74,7 @@ Identify which IaaS you will be deploying to (e.g. Amazon Web Services, Google,
 The following ingress ports are used...
 
  * `22/tcp` - SSH access (only required to enable SSH access, or for some IaaSes during provisioning)
- * `1194/udp` - OpenVPN
+ * `1194/tcp` - OpenVPN
  * `6868/tcp` - BOSH management service (only required during provisioning)
 
 You may want to restrict egress traffic, depending on your requirements.