chore: multiple openvpn tunnels (#268)

Added section on managing multiple OpenVPN tunnels for site-to-site connections, emphasizing the importance of separate configurations.

Author: cotosso

openvpn_tunnels.rst

@@ -70,6 +70,16 @@ The web interface allows the configuration of advanced features like:
 
 * ``Enforce a minimum TLS version``: Allows you to choose a minimum version of TLS, in which case connections will only be allowed from devices that use a version greater than or equal to the one selected
 
+Multiple OpenVPN tunnels
+------------------------
+If a NethSecurity must act as the VPN server for multiple remote firewalls, create a dedicated OpenVPN tunnel for each remote peer.
+The UI-supported and recommended model is one server/client pair per site-to-site connection, for example, a central firewall connected to three remote firewalls should have three separate OpenVPN server tunnels, each with its own client configuration imported on the corresponding remote firewall.
+
+This approach allows each tunnel to be managed independently, with separate configuration, certificates, routes, status, monitoring, and troubleshooting. 
+It also prevents issues on one remote connection from affecting the operational management of the others.
+
+Do not use a single OpenVPN server tunnel shared by multiple remote clients for site-to-site configurations managed from the UI.
+
 MTU Issue and Packet Fragmentation
 ----------------------------------
 
@@ -179,4 +189,4 @@ In this scenario, you've to proceed with the generation of a completely new PKI.
 These commands will generate a new CA certificate, as well as new server and client certificates signed by the new CA.
 In this scenario, it is **mandatory** to download and import the new client configuration on the client side to restore the connection, so make sure to do it as soon as possible to minimize downtime.
 
-All considerations remain the same as for Road Warrior connections. If the expired certificate is the CA certificate, you have to generate a completely new PKI, while if the expired certificate is the server or client one, you can regenerate it using the dedicated action.
+All considerations remain the same as for Road Warrior connections. If the expired certificate is the CA certificate, you have to generate a completely new PKI, while if the expired certificate is the server or client one, you can regenerate it using the dedicated action.