OpenVPN is a free and open source software VPN solution. It allows secure point-to-point or site-to-site connections with routed or bridged configurations and remote access facilities.

learn more… | top users | synonyms

52
votes
7answers
81k views

Should I use tap or tun for openvpn?

What are the differences between using dev tap and dev tun for openvpn? I know the different modes cannot inter-operate. What is the technical differences, other then just layer 2 vs 3 operation. ...
44
votes
7answers
66k views

OpenVPN vs. IPSec - Pros and Cons, what to use?

Interestingly I have not found any good search results when searching for "OpenVPN vs IPSec". So here my question: I need to setup a private LAN over an untrusted network. And as far as I know, both ...
21
votes
3answers
13k views

OpenVPN performance: how many concurrent clients are possible?

I am evaluating a system for a client where many OpenVPN clients connect to a OpenVPN server. "Many" means 50000 - 1000000. Why do I do that? The clients are distributed embedded systems, each ...
19
votes
4answers
27k views

Is there a real way to connect to WatchGuard's VPN from Linux?

WatchGuard officially has clients only for Windows and Mac. But I see that it uses openvpn internally. I couldn't connect to WG from Linux. Is there someone who actually get this working? How?
19
votes
6answers
25k views

How do you avoid network conflict with VPN internal networks?

While there's a wide variety of private non-routable networks across 192.168/16 or even 10/8, sometimes in being thoughtful of potential conflict, it still occurs. For example, I set up an ...
18
votes
5answers
21k views

Connect an iPhone to OpenVPN

Is there any way to connect an iPhone to our company OpenVPN server?
17
votes
5answers
31k views

How to check that an OpenVPN server is listening on a remote port without using OpenVPN client?

I need to check that an OpenVPN (UDP) server is up and accessible on a given host:port. I only have a plain Windows XP computer with no OpenVPN client (and no chance to install it) and no keys needed ...
14
votes
6answers
42k views

how to auto start openvpn (client) on ubuntu 12.04 cli?

I have an *.ovpn file that works if I type in sudo openvpn client.ovpn Now I would like to start up openvpn when I boot the computer. It's a headless version of ubuntu - if that matters - 12.04 ...
14
votes
2answers
4k views

SSH tunneling is faster than OpenVPN, could it be?

Logically, VPN should be faster than SSH for tunneling, because: It's running on UDP and not TCP (so no TCP over TCP) It has compression However, today I tested Redis replication over both ...
12
votes
1answer
24k views

Can someone please explain easyrsa vars options for PKI generation

I am using OpenVPN and whilst I can generate certificates using easyrsa just fine I don't really understand the settings in the easyrsa vars file: export KEY_COUNTRY="" export KEY_PROVINCE="" export ...
11
votes
4answers
2k views

Can a shell script wait for a file to change and take action?

I wonder if I can write a script that will monitor for a change in a file and execute some action when the change is detected. Detailed explanation: OpenVPN writes its status to a file every 1 ...
11
votes
5answers
14k views

OpenVPN make redirect-gateway optional

I'm currently running an OpenVPN server for multiple clients. All traffic is directed through the VPN (it's set up as gateway; push "redirect-gateway def1"). So far, all is working fine. However, ...
11
votes
3answers
22k views

OpenVPN and DNS. How to?

I'm using OpenVPN to set up a VPN to connect my laptop at home to my workplace LAN. I want to be able to refer my workplace computers by their name and not by their IP but I can't. This is my ...
11
votes
2answers
31k views

Generate an OpenVPN profile for client user to import

Is there any documentation or resource describing how to generate and host a profile for an OpenVPN client to import? Ideally would like my users to not have to separately fetch a .zip file of the ...
10
votes
3answers
16k views

telnet counterpart for UDP

Is there anything that enables a "telnet-like" functionality for UDP? I know the difference between TCP and UDP, and why telnet itself won't work - but I'm wondering if there is something similar to ...
10
votes
4answers
30k views

How do I improve OpenVPN reliability over a high latency link?

We are running a OpenVPN VPN over a BGAN satellite link where ping times are about 3 seconds. We use it in a tun configuration, and we're running on Linux (CentOS). It is primarily email that will be ...
10
votes
2answers
303 views

Traffic routing with unreliable connections

I have a group of offices that are all connected to the main office via DSL links on the far end to save costs. (We're a non-profit, don't ask) We've historically had noticeable problems with the ...
9
votes
1answer
23k views

How to view connected users to open vpn server?

I'm developing a web site for managing open vpn users with django framework. But I need to now is there any way to extract active users from open vpn? My server is running Ubuntu 12.04.
9
votes
1answer
16k views

How to ensure OpenVPN connection uses specific DNS?

I'm using OpenVPN through Tunnelblick on MacOS X Lion. I need to set specific DNS (with local IP, which works only when VPN is up) for the duration of this VPN session only. I do not have access to ...
9
votes
2answers
3k views

Comments in OpenVPN client config files?

Is it possible to put comments in the client config files (those in the path specified by "client-config-dir") for OpenVPN, i.e. something beginning with "#" or "//" or the like? If so, what is the ...
9
votes
2answers
1k views

Large VPN network (~600 servers) with OpenVPN

I'm doing a preliminary study for a contract to build a VPN network between ~600 remote servers running Linux CentOS 6 (+ their 600 private LANs). The network is supposed to be star-based, so that ...
8
votes
2answers
10k views

Can generated OpenVPN keys be used on multiple clients?

We are experimenting with running an OpenVPN server for our business. One question I can't seem to find the answer to is this: When we generate keys for one of our users for them to use at home, can ...
8
votes
2answers
7k views

OpenVPN DNS Fails to Resolve

I am connected to an OpenVPN server that is configured with the options to redirect the VPN as the default gateway and to push my internal DNS servers: push "dhcp-option DNS 192.168.1.2" push ...
8
votes
3answers
9k views

OpenVPN easy-rsa build-key automation?

I have a lot of keys to generate for my clients VPN server. Whenever I use easy-rsa to generate the keys like this: ./build-key client1 There is some output with a series of questions. The ...
8
votes
2answers
13k views

Why is `--duplicate-cn` not recommended in OpenVPN?

Is this for security reason, or performance reason?
8
votes
2answers
3k views

Redundant OpenVPN connections with advanced Linux routing over an unreliable network

I am currently living in a country that blocks many websites and has unreliable network connections to the outside world. I have two OpenVPN endpoints (say: vpn1 and vpn2) on Linux servers that I use ...
8
votes
2answers
413 views

User's private key is used for auth only?

I have a simple question regarding OpenVPN protocol. Let's suppose we have two different users, with different keys for the same server, and both keys 1024bits. If this two users make the exactly same ...
8
votes
2answers
38k views

How to push my own DNS server to OpenVPN?

I have defined an ubnound DNS server on my VPS and it appears to work. I need to use the DNS server instead of Public DNS IPs because some ISPs have blocked public DNS IPs. My openvpn.conf file is: ...
8
votes
1answer
1k views

Is there any solution to make OpenVPN authentication with Google ID?

Or, maybe any oauth? All I could find - is 2factor authentication with google. But I'd like to use Google Apps base for OpenVPN auth. I believe that it is possible to make something like gitlab. ...
8
votes
2answers
2k views

ARP reply vanishes from br0 to tap0 using OpenVPN in bridging mode

I have setup a linux box (on an esxi5) which acts as an OpenVPN server. the server is configured to use bridging for the clients, which essentially works, with one exception. If the client pings some ...
7
votes
3answers
7k views

No tun device in lxc guest for openvpn

I am trying to set up an openvpn server inside a lxc guest. However, it seams there is no tun device available in the container. Starting openvpn inside the container gives me this error: Tue Sep 18 ...
7
votes
1answer
317 views

OpenVPN Client timing out

I recently installed OpenVPN on my Ubuntu VPS. Whenenver I try to connect to it, I can establish a connection just fine. However, everything I try to connect to times out. If I try to ping ...
7
votes
2answers
16k views

How can I setup OpenVPN with IPv4 and IPv6 using a tap device?

I've managed to setup OpenVPN for full IPv4 connectivity using tap0. Now I want to do the same for IPv6. Addresses and network setup (note that my real prefix is replaced by 2001:db8): ...
7
votes
5answers
9k views

How can I disconnect from openvpn in windows via command line?

I know how to connect to an openvpn via a command line in Windows XP. What I can't figure out is how to end the connection. Any thoughts?
7
votes
2answers
5k views

Openvpn for client/server in same subnet

I'm trying to openvpn into an office network (192.168.1.0/24) from a client sitting on a network with the same subnet (also 192.168.1.0/24). It is a linux (ubuntu 9.10) server and windows client. I ...
7
votes
3answers
2k views

OpenVPN client without redirect-gateway doing triangular routing and IP spoofing not working on Ubuntu

I have an OpenVPN client running on a server of mine obtaining a public IP on a remote network in a different country. The client configuration is as follows: dev tap remote a.b.30.7 float a.b.30.7 ...
7
votes
1answer
102 views
+100

OpenVPN low performance. Do I have MTU problems? Dumps inside

I have problems with an OpenVPN tunnel which does not reach line speed. The gateway is a Debian Jessy virtual server hosted at OVH. The client is either my freebsd 10.2 homeserver (Intel I3 Ivy ...
6
votes
3answers
20k views

How to connect multiple VPNs using OpenVPN on Windows 7 on the same time?

I work most of the time remotly from home. To gain access to the different servers (via SSH) I have to use OpenVPN. I would like to connect to all of them (three, sometimes four) at once, so I dont ...
6
votes
3answers
5k views

How to prevent users from sharing certificates in OpenVPN?

I have an OpenVPN server which uses certificates and LDAP authentication. The problem is that, one user could share his certificate and other valid LDAP users could use this certificate. Question ...
6
votes
2answers
963 views

How to fix the Logjam vulnerability in OpenVPN server config?

As of this writing (Day-2), there are quite few accurate guidelines as to how to mitigate Logjam for Apache and other web servers, such as this page: https://weakdh.org/sysadmin.html What are the ...
6
votes
2answers
21k views

How to set up OpenVPN to let the VPN clients to access all the servers inside the server LAN?

My server LAN IP is 192.168.1.1 and there is an intranet web server on 192.168.1.2 The OpenVPN daemon is configured to give clients 192.168.2.* addresses. There is push "route 192.168.1.0 ...
6
votes
8answers
1k views

opvnvpn: addressing nodes in LAN-behinds

I've setup an openvpn server which i can access remotely, once it is connected, it creates a tun0 device on both server and client with virtual ip 10.15.119.x. the openvpn server is itself ...
6
votes
2answers
1k views

Very low TCP OpenVPN throughput (100Mbit port, low CPU utilization)

I am experiencing extremely slow OpenVPN transfer rates between two servers. For this question, I'll call the servers Server A and Server B. Both Server A and Server B are running CentOS 6.6. Both ...
6
votes
1answer
5k views

Can OpenSWAN replace OpenVPN?

Background I have a working OpenVPN setup right now, where users can connect the the private network at home with their computers. However most phones only support IPSec, so I would like to offer ...
6
votes
2answers
6k views

Bridging VirtualBox over OpenVPN TAP adapter on Windows

I'm trying to configure a virtual machine (VirtualBox guest running Backtrack 4) with a bridged adapter over a VPN connection. The VPN is is hosted by the cybersecurity club at my university, and ...
6
votes
2answers
2k views

OpenVpn bridge interface does not respond to incoming packets from outer network !

We are trying to set up a roadwarrior vpn setup with openvpn. We want the people to be able to connect to our network via openvpn. And we want them to be able to see and connect to the machines in our ...
6
votes
5answers
4k views

OpenVPN over TCP, terrible latency but only on Win7 x64

I know TCP encapsulated over TCP is a terrible idea in general, but I can deal with the occasional decreased performance and MTU issues, and the snowball effect TCP within TCP provides where error ...
6
votes
2answers
8k views

How do I prevent TCP connection freezes over an OpenVPN network?

New details added at the end of this question; it's possible that I'm zeroing in on the cause. I have a UDP OpenVPN-based VPN set up in tap mode (I need tap because I need the VPN to pass multicast ...
6
votes
2answers
118 views

Unable to login via PAM and ldap: failed to get password

I'm trying to have OpenVPN authenticate users via PAM over LDAP to an Active Directory server. Here are the relevant parts of my configuration files: /etc/openvpn/server.conf: # ... plugin ...
6
votes
1answer
179 views

OpenVPN allow two clients to connect to each other without using client-to-client globally

I'm running OpenVPN 2.3.7 on CentOS 6. I'm using routing (tun) and have two instance of OpenVPN. On the second instance there are two clients that I'd like to be make visible to each other i.e ping, ...