Operating Systems

Open the Terminal by pressing ctrl + alt + T.

Type the following command into the Terminal: sudo mkdir -p /etc/apt/keyrings && curl -fsSL https://packages.openvpn.net/packages-repo.gpg | sudo tee /etc/apt/keyrings/openvpn.asc. This will install the OpenVPN repository key used by the OpenVPN 3 Linux packages.

Type the following command into the Terminal: DISTRO=$(lsb_release -c | awk '{print $2}'). This will detect the OS distribution and automatically be used in the following command.

Type the following command into the Terminal. echo "deb [signed-by=/etc/apt/keyrings/openvpn.asc] https://packages.openvpn.net/openvpn3/debian $DISTRO main" | sudo tee /etc/apt/sources.list.d/openvpn-packages.list This will install the proper repository.

Type the following command into the Terminal: sudo apt update

Type the following command into the Terminal: sudo apt install openvpn3. This will finally install the OpenVPN 3 package.

Open Terminal by typing Terminal into the search bar.

If you are running Red Hat Enterprise Linux or its clones, you must install the Fedora EPEL repository first. Here is the list of commands for each version: (The original article on Fedora EPEL can be found here.)

RHEL/CentOS 7: sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm

On RHEL 7, it is also recommended to enable the optional, extras, and HA repositories since EPEL packages may depend on packages from these repositories: sudo subscription-manager repos --enable "rhel-*-optional-rpms" --enable "rhel-*-extras-rpms" --enable "rhel-ha-for-rhel-*-server-rpms

RHEL/CentOS 8: sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

On RHEL 8, it is required to also enable the codeready-builder-for-rhel-8-${ARCH}-rpms repository since EPEL packages may depend on packages from it: sudo ARCH=$( /bin/arch ) followed by sudo subscription-manager repos --enable "codeready-builder-for-rhel-8-${ARCH}-rpms

On CentOS 8, it is also recommended to enable the PowerTools repository since EPEL packages may depend on packages from it: sudo dnf config-manager --set-enabled PowerTools

RHEL7:

sudo yum install -y https://packages.openvpn.net/openvpn-openvpn3-rhel7-repo-1-1.noarch.rpm

RHEL 8, RHEL 9, CentOS 7, CentOS Stream 8, CentOS Stream 9:

sudo yum install -y https://packages.openvpn.net/openvpn-openvpn3-epel-repo-1-1.noarch.rpm

Finally, the OpenVPN 3 Linux client can be installed by running the following command: sudo yum install openvpn3-client

$ openvpn3 config-import --config /file/to/profile.ovpn --name CloudConnexa --persistent

This takes a downloaded configuration file and imports it into the Configuration Manager, storing it under the name CloudConnexa. The --persistent flag ensures the configuration file is preserved when the system is rebooted. This command can be run as an ordinary, unprivileged user on the system; the User running this command becomes the owner of the configuration profile.

$ openvpn3 config-acl --show --lock-down true --grant root --config CloudConnexa

This grants the root user access to the imported CloudConnexa configuration profile. The --lock-down true argument is optional, but it restricts the root user from extracting the content of the configuration profile via the openvpn3 commands (or via D-Bus APIs).

By adding --transfer-owner-session true to the command above, the current User running this command (the owner of the Profile) also becomes the “VPN session owner” if the root is the User starting the VPN session (typically via the systemd openvpn3-session@.service).

$ sudo systemctl enable --now openvpn3-session@CloudConnexa.service

This tells systemd to enable an OpenVPN session service (openvpn3-session) to be started when the system is booting, using the configuration profile name CloudConnexa. The --now argument also instructs systemd to start the session instantly.

To start a one-shot configuration Profile, type the following command into the Terminal: openvpn3 session-start --config ${MY_CONFIGURATION_FILE}

To import a configuration file for re-use and start a VPN session, type the following command into the Terminal: openvpn3 config-import --config ${MY_CONFIGURATION_FILE}.

To start a new VPN session from an imported configuration Profile, run the following command: openvpn3 session-start --config ${CONFIGURATION_PROFILE_NAME}

To list all available configuration profiles, run this command: openvpn3 configs-list.

Note that it is possible to use the D-Bus path to the configuration Profile: openvpn3 session-start --config-path /net/openvpn/v3/configuration/..

Once a VPN session has started, it should be seen in the session list: openvpn3 sessions-list.

Using the openvpn3 session-manage , there are a few things that can be done, but most typically, it is the –disconnect or –restart alternatives that are most commonly used. openvpn3 session-manage --config ${CONFIGURATION_PROFILE_NAME} --restart. This disconnects and re-connects to the server again, re-establishing the connection. The ${CONFIGURATION_PROFILE_NAME} is the configuration name displayed in the openvpn3 sessions-list.

It is also possible to use the D-Bus path to the session: openvpn3 session-manage --session-path /net/openvpn/v3/sessions/..... --disconnect. This command above will disconnect a running session. Once this operation has been completed, it will be removed from the openvpn3 sessions-list overview.

It is also possible to retrieve real-time tunnel statistics from running sessions: openvpn3 session-stats --config ${CONFIGURATION_PROFILE_NAME} or openvpn3 session-stats --session-path /net/openvpn/v3/sessions/...

To retrieve real-time log events as they occur, run the following command: openvpn3 log --config ${CONFIGURATION_PROFILE_NAME}. This might be quite silent, as it does not provide any log events from the past. Issue an openvpn3 session-manage –restart from a different terminal, and log events will occur. You may want to boost the log-level with –log-level 6. Valid log levels are from 0 to 6, where 6 is the most verbose.

Run the command: sudo openvpn3 sessions-list. It will show information about your active session. Check the value of the Path parameter.

Run the command: sudo openvpn3 session-manage --session-path YOUR_PATH --disconnect, where YOUR_PATH is the value of the Path parameter from list item 1.

Run the command: sudo openvpn3 sessions-list. You shouldn’t see any active sessions.

Run the command: sudo openvpn3 configs-list. It will show information about your active configurations. Check the name assigned to your active config.

Run the command: sudo openvpn3 config-remove --config "YOUR_CONFIG_NAME", where YOUR_CONFIG_NAME is the name of the configuration file from list item 4. You will be asked to confirm the removal of the configuration. Type YES (in uppercase) to confirm.

Run the command: sudo openvpn3 configs-list. You shouldn’t see any active configurations.

Run the command: sudo nano /etc/openvpn3/autoload/Connector.conf. This is the Profile that will be replaced.

Press Ctrl + End, then hold ctrl + shift + ↑ until the whole file is highlighted, and finally, press ctrl + K.

Open the Profile you wish to use instead of the existing one. Press Ctrl + A and then ctrl + C.

Then go back to the Terminal, press the right mouse button, and choose Paste. Notice the difference between the old and the new Profile.

Once you’ve replaced the Profile, press ctrl + X and confirm changes by typing y and pressing Enter.

You can run cat /etc/openvpn3/autoload/Connector.conf to check the changes are saved.

Run the command: sudo openvpn3 config-import --config /etc/openvpn3/autoload/Connector.conf --name "YOUR_CONFIG_NAME"

Run the command: sudo openvpn3 session-start --config "YOUR_CONFIG_NAME."

Run the command: sudo openvpn3 sessions-list. It will show that a new session is active and connected.

Restart the computer and check if the autostart Profile has indeed been changed. Just run the sudo openvpn3 sessions-list command once again. Certainly, the autoload is now set for the new Profile!