OpenVPN is a free and open source software VPN solution. It allows secure point-to-point or site-to-site connections with routed or bridged configurations and remote access facilities.

learn more… | top users | synonyms

39
votes
6answers
54k views

Should I use tap or tun for openvpn?

What are the differences between using dev tap and dev tun for openvpn? I know the different modes cannot inter-operate. What is the technical differences, other then just layer 2 vs 3 operation. ...
27
votes
8answers
48k views

OpenVPN vs. IPSec - Pros and Cons, what to use?

Interestingly I have not found any good search results when searching for "OpenVPN vs IPSec". So here my question: I need to setup a private LAN over an untrusted network. And as far as I know, both ...
17
votes
6answers
21k views

Connect an iPhone to OpenVPN

Is there any way to connect an iPhone to our company OpenVPN server?
17
votes
4answers
22k views

Is there a real way to connect to WatchGuard's VPN from Linux?

WatchGuard officially has clients only for Windows and Mac. But I see that it uses openvpn internally. I couldn't connect to WG from Linux. Is there someone who actually get this working? How?
16
votes
3answers
7k views

OpenVPN performance: how many concurrent clients are possible?

I am evaluating a system for a client where many OpenVPN clients connect to a OpenVPN server. "Many" means 50000 - 1000000. Why do I do that? The clients are distributed embedded systems, each ...
14
votes
6answers
15k views

How do you avoid network conflict with VPN internal networks?

While there's a wide variety of private non-routable networks across 192.168/16 or even 10/8, sometimes in being thoughtful of potential conflict, it still occurs. For example, I set up an ...
11
votes
4answers
2k views

Can a shell script wait for a file to change and take action?

I wonder if I can write a script that will monitor for a change in a file and execute some action when the change is detected. Detailed explanation: OpenVPN writes its status to a file every 1 ...
11
votes
1answer
14k views

Can someone please explain easyrsa vars options for PKI generation

I am using OpenVPN and whilst I can generate certificates using easyrsa just fine I don't really understand the settings in the easyrsa vars file: export KEY_COUNTRY="" export KEY_PROVINCE="" export ...
10
votes
6answers
16k views

How to check that an OpenVPN server is listening on a remote port without using OpenVPN client?

I need to check that an OpenVPN (UDP) server is up and accessible on a given host:port. I only have a plain Windows XP computer with no OpenVPN client (and no chance to install it) and no keys needed ...
10
votes
5answers
10k views

OpenVPN make redirect-gateway optional

I'm currently running an OpenVPN server for multiple clients. All traffic is directed through the VPN (it's set up as gateway; push "redirect-gateway def1"). So far, all is working fine. However, ...
10
votes
3answers
15k views

OpenVPN and DNS. How to?

I'm using OpenVPN to set up a VPN to connect my laptop at home to my workplace LAN. I want to be able to refer my workplace computers by their name and not by their IP but I can't. This is my ...
10
votes
2answers
267 views

Traffic routing with unreliable connections

I have a group of offices that are all connected to the main office via DSL links on the far end to save costs. (We're a non-profit, don't ask) We've historically had noticeable problems with the ...
9
votes
4answers
25k views

How do I improve OpenVPN reliability over a high latency link?

We are running a OpenVPN VPN over a BGAN satellite link where ping times are about 3 seconds. We use it in a tun configuration, and we're running on Linux (CentOS). It is primarily email that will be ...
9
votes
1answer
163 views

SSH tunneling is faster than OpenVPN, could it be?

Logically, VPN should be faster than SSH for tunneling, because: It's running on UDP and not TCP (so no TCP over TCP) It has compression However, today I tested Redis replication over both ...
8
votes
2answers
2k views

Redundant OpenVPN connections with advanced Linux routing over an unreliable network

I am currently living in a country that blocks many websites and has unreliable network connections to the outside world. I have two OpenVPN endpoints (say: vpn1 and vpn2) on Linux servers that I use ...
8
votes
2answers
12k views

Generate an OpenVPN profile for client user to import

Is there any documentation or resource describing how to generate and host a profile for an OpenVPN client to import? Ideally would like my users to not have to separately fetch a .zip file of the ...
8
votes
2answers
288 views

User's private key is used for auth only?

I have a simple question regarding OpenVPN protocol. Let's suppose we have two different users, with different keys for the same server, and both keys 1024bits. If this two users make the exactly same ...
8
votes
2answers
981 views

Large VPN network (~600 servers) with OpenVPN

I'm doing a preliminary study for a contract to build a VPN network between ~600 remote servers running Linux CentOS 6 (+ their 600 private LANs). The network is supposed to be star-based, so that ...
8
votes
2answers
22k views

How to push my own DNS server to OpenVPN?

I have defined an ubnound DNS server on my VPS and it appears to work. I need to use the DNS server instead of Public DNS IPs because some ISPs have blocked public DNS IPs. My openvpn.conf file is: ...
7
votes
3answers
2k views

telnet counterpart for UDP

Is there anything that enables a "telnet-like" functionality for UDP? I know the difference between TCP and UDP, and why telnet itself won't work - but I'm wondering if there is something similar to ...
7
votes
1answer
268 views

OpenVPN Client timing out

I recently installed OpenVPN on my Ubuntu VPS. Whenenver I try to connect to it, I can establish a connection just fine. However, everything I try to connect to times out. If I try to ping ...
7
votes
2answers
3k views

Openvpn for client/server in same subnet

I'm trying to openvpn into an office network (192.168.1.0/24) from a client sitting on a network with the same subnet (also 192.168.1.0/24). It is a linux (ubuntu 9.10) server and windows client. I ...
7
votes
3answers
2k views

OpenVPN client without redirect-gateway doing triangular routing and IP spoofing not working on Ubuntu

I have an OpenVPN client running on a server of mine obtaining a public IP on a remote network in a different country. The client configuration is as follows: dev tap remote a.b.30.7 float a.b.30.7 ...
6
votes
3answers
3k views

How to prevent users from sharing certificates in OpenVPN?

I have an OpenVPN server which uses certificates and LDAP authentication. The problem is that, one user could share his certificate and other valid LDAP users could use this certificate. Question ...
6
votes
8answers
1k views

opvnvpn: addressing nodes in LAN-behinds

I've setup an openvpn server which i can access remotely, once it is connected, it creates a tun0 device on both server and client with virtual ip 10.15.119.x. the openvpn server is itself ...
6
votes
2answers
180 views

Is it possible to allow a machine on openvpn to connect to only one server on the network?

I have an OpenVPN server which is already functioning properly and allowing people to work on our servers. There's a new project which requires me to allow access to the network and into one specific ...
6
votes
6answers
3k views

OpenVPN over TCP, terrible latency but only on Win7 x64

I know TCP encapsulated over TCP is a terrible idea in general, but I can deal with the occasional decreased performance and MTU issues, and the snowball effect TCP within TCP provides where error ...
6
votes
2answers
1k views

OpenVpn bridge interface does not respond to incoming packets from outer network !

We are trying to set up a roadwarrior vpn setup with openvpn. We want the people to be able to connect to our network via openvpn. And we want them to be able to see and connect to the machines in our ...
6
votes
1answer
3k views

How do I prevent TCP connection freezes over an OpenVPN network?

New details added at the end of this question; it's possible that I'm zeroing in on the cause. I have a UDP OpenVPN-based VPN set up in tap mode (I need tap because I need the VPN to pass multicast ...
6
votes
3answers
635 views

Timing issues with OpenVPN and NFS mounts (Debian Squeeze)

I'm trying to mount NFS filesystems over an OpenVPN link on Debian Squeeze. The problem is that the default layout of init scripts and such tries to mount the NFS filesystems before bringing up the ...
5
votes
2answers
6k views

Can generated OpenVPN keys be used on multiple clients?

We are experimenting with running an OpenVPN server for our business. One question I can't seem to find the answer to is this: When we generate keys for one of our users for them to use at home, can ...
5
votes
5answers
6k views

OpenVPN with Active Directory integration

Is anyone successfully running OpenVPN with Active Directory integration? Are you using the openvpn.net or the openvpn.net/opensource version of OpenVPN? Any tips, tricks or gotchas or did it "just ...
5
votes
3answers
798 views

Is it possible to use same SSL certificate for Apache and OpenVPN?

Can I use the same paid SSL certificate for OpenVPN and Apache? UPDATE: The purpose is to get a Estonian National ID card support to both. So that one, using this smart card, may authenticate himself ...
5
votes
2answers
7k views

Pings from VPN network to VPN client work; pings into from VPN client to VPN network fail - why?

We are in the process of setting up an OpenVPN server for some servers running in a cloud. We are stumped with a connectivity problem whereby the hosts on the VPN server's LAN can ping te VPN client, ...
5
votes
2answers
8k views

Why is `--duplicate-cn` not recommended in OpenVPN?

Is this for security reason, or performance reason?
5
votes
1answer
1k views

Direct connection between multiple clients on OpenVPN

I've spent my entire day learning about VPN, and have been working with following setup: 2 VPS Servers at the same data centre in Texas. (Texas1 and Texas2), 1 VPS in England and 1 VPS in Atlanta and ...
5
votes
1answer
2k views

Can OpenSWAN replace OpenVPN?

Background I have a working OpenVPN setup right now, where users can connect the the private network at home with their computers. However most phones only support IPSec, so I would like to offer ...
5
votes
2answers
1k views

dynamic routing between openvpn tunnels

i'm thinking about using dynamic routing [ OSPF or RIP ] via OpenVPN tunnels. right now i have few offices connected in full mesh, but this is not scalable solution as we add more locations. i would ...
5
votes
4answers
1k views

Tunnel with least overhead

I'd like to tunnel a large amount of traffic from my local network to a server located in a datacenter, in a way that I don't have to make many changes to my local applications. The two methods that ...
5
votes
5answers
6k views

How can I disconnect from openvpn in windows via command line?

I know how to connect to an openvpn via a command line in Windows XP. What I can't figure out is how to end the connection. Any thoughts?
5
votes
1answer
6k views

OpenVPN failing on self-signed certificate over udp, works over tcp

I have the following server.conf: # OpenVPN 2.x config proto tcp port 1194 dev tun-vpn dev-type tun server 10.8.0.0 255.255.0.0 push "route 172.16.0.0 255.255.0.0" push "dhcp-option DOMAIN ...
5
votes
1answer
2k views

OpenVPN server cannot ping client IPs

I have flashed a router at two separate sites with DD-WRT firmware and setup OpenVPN on both. once connected the client can ping computers on the servers LAN however the server cannot ping IPs on the ...
5
votes
1answer
307 views

VPN server on Windows Server 2008 for a small office

I'm going to refurbish the IT-infrastructure for a small organization with one single office, and I'm not sure what VPN server to use. In your opinion, would the built-in Windows Server 2008 VPN ...
5
votes
2answers
2k views

OpenVPN - client-to-client traffic working in one direction but not the other

I have the following VPN configuration: +------------+ +------------+ +------------+ | outpost |----------------| kino |----------------| guchuko | ...
5
votes
1answer
271 views

Is there any solution to make OpenVPN authentication with Google ID?

Or, maybe any oauth? All I could find - is 2factor authentication with google. But I'd like to use Google Apps base for OpenVPN auth. I believe that it is possible to make something like gitlab. ...
5
votes
4answers
2k views

Openvpn, forward packets very slowly

I rebooted my server, and an odd issue just came out. I am running on ArchLinux, the clients are Ubuntu, Android and Mac. The problem is that accessing the internet via the clients is slow, about ...
4
votes
2answers
1k views

Is OpenVPN UDP vulnerable to heartbleed?

Is OpenVPN UDP vulnerable to heartbleed? I need to decide if I'm going to rebuild some servers, but they are very carefully firewalled; 1194/TCP is one of the firewalled ports (yay whitelist!). ...
4
votes
4answers
6k views

What is difference between OpenVPN and PPTP?

I know PPTP is based PPP, so what is the openVPN based on ? can the packets of openVPN be routed by ubuntu server ? thanks!
4
votes
3answers
6k views

OpenVPN easy-rsa build-key automation?

I have a lot of keys to generate for my clients VPN server. Whenever I use easy-rsa to generate the keys like this: ./build-key client1 There is some output with a series of questions. The ...
4
votes
2answers
2k views

OpenVPN DNS Fails to Resolve

I am connected to an OpenVPN server that is configured with the options to redirect the VPN as the default gateway and to push my internal DNS servers: push "dhcp-option DNS 192.168.1.2" push ...