OpenVPN

This article describes a basic installation and configuration of OpenVPN , suitable for private and small business use. For more detailed information, please see openvpn(8) and the OpenVPN documentation [dead link 2025-11-17—HTTP 404]. OpenVPN is a robust and highly flexible VPN daemon. It supports SSL/TLS security, Ethernet bridging "wikipedia:Bridging (networking)") , TCP or UDP tunnel transport through proxies or NAT . Additionally it has support for dynamic IP addresses and DHCP , scalability to hundreds or thousands of users, and portability to most major OS platforms. OpenVPN is tightly bound to the OpenSSL library, and derives much of its crypto capabilities from it. It supports conventional encryption using a pre-shared secret key (Static Key mode) or public key security (SSL/TLS mode) using client & server certificates. Additionally it supports unencrypted TCP/UDP tunnels. OpenVPN is designed to work with the TUN/TAP virtual networking interface that exists on most platforms. Overall, it aims to offer many of the key features of IPSec but with a relatively lightweight footprint. OpenVPN was written by James Yonan and is published under the GNU General Public License (GPL) . QOpenVPN — Simple OpenVPN GUI written in PyQt for systemd based distributions. eOVPN — Application to connect, manage and update OpenVPN configurations. Written in GTK. Supports both OpenVPN 2 and OpenVPN 3 with Data Channel Offload OpenVPN requires TUN/TAP support, which is already configured in the default kernel. Users of custom kernel should make sure to enable the tun module ( CONFIG TUN ) in Device Drivers Network device support Network core driver support Universal TUN/TAP device driver support . To connect to a VPN service provided by a third party, most of the following can most likely be ignored, especially regarding server setup. Begin with The client configuration profile and skip ahead to Starting OpenVPN after that. One should use the provider certificates and instructions, see Category:VPN providers for examples that can be adapted to other providers. OpenVPN client in Linux Containers also has general applicable instructions, while it goes a step further by isolating an OpenVPN client process into a container. Note Most free VPN providers will (often only) offer PPTP , which is drastically easier to setup and configure, but not secure . When setting up an OpenVPN server, users need to create a Public Key Infrastructure (PKI) which is detailed in the Easy-RSA article. Once the needed certificates, private keys, and associated files are created via following the steps in the separate article, one should have 5 files in /etc/openvpn/server at this point: Alternatively, as of OpenVPN 2.4, one can use Easy-RSA to generate certificates and keys using elliptic curves. See the OpenVPN documentation for details. Note Unless otherwise explicitly stated, the rest of this article assumes a basic Layer-3 IP routing configuration. OpenVPN is an extremely versatile piece of software and many configurations are possible, in fact machines can be both servers and clients. With the release of v2.4, server configurations are stored in /etc/openvpn/server and client configurations are stored in /etc/openvpn/client and each mode has its own respective systemd unit, namely, [email protected] and [email protected] . The OpenVPN package comes with a collection of example configuration files for different purposes. The sample server and client configuration files make an ideal starting point for a basic OpenVPN setup with the following features: Uses Public Key Infrastructure (PKI) for authentication. Creates a VPN using a virtual TUN network interface (OSI Layer-3 IP routing). Listens for client connections on UDP port 1194 (OpenVPN's official IANA port number[[1]]( ). Distributes virtual addresses to connecting clients from the 10.8.0.0/24 subnet. For more advanced configurations, please see the openvpn(8) man page and the OpenVP