I have two OpenVPN client setups, controlled by systemd services openvpn.foo and openvpn.bar. They connect to different VPNs and may or may not be active at any point in time.

I'd like to set up different iptables firewall rules for them. The trouble is that the first OpenVPN process seems to grab the tun0 interface, regardless of whether that turns out to be configuration foo or bar. The problem is I can't attach iptables rules to the interface because I don't know whether it goes with VPN foo or bar at the moment.


  • is there a way to get OpenVPN to always issue the same interface names for a given configuration? I was looking for an option in the config file, but couldn't find one. persist-tun seems insufficient as it does not seem to survive a reboot.
  • is there a way to determine which interface goes with which configuration after the fact?
  • given that the IP addresses I'm obtaining aren't entirely predictable either, I can't attach the rules to those either. Can anybody think of a trick where to attach them instead?


3 Answers 3


You can give the tun device name in the .ovpn configuration file:

Edit the file /etc/openvpn/server-vpngw.conf and add such lines:

dev tun3
client-config-dir /etc/openvpn/ccd

Then create the following file /etc/openvpn/ccd/vpn-name and edit it like so:

push "route"
push "route"
  • Duh. Would be nice if the man page was clear about that. Thanks! Jul 21, 2016 at 15:49
  • what are those ips and where do you get them from?
    – Mehdi
    Jul 2, 2019 at 20:14

Another simpler approach would be edit the client, and not the server:

  1. Edit the client configuration file

    sudo vim /etc/openvpn/client1.conf

And hardcode desired tun interface name:

dev tun69
  1. Repeat step 1 with the second VPN client configuration file

  2. Restart the service to pick up the changes:

sudo service openvpn restart

is there a way to determine which interface goes with which configuration after the fact?

You could even specify general names:

  • dev-type tun to specify that it is to be a "tun" device type,
  • dev myovpn to give it the name "myovpn".
  • Tested on Linux with OpenVPN 2.4.7.
    – famzah
    Mar 22 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .