OpenVPN 3 Linux Client
The OpenVPN 3 Linux client is the official next-generation command-line client for Linux systems. It supports modern features for both open-source community users and commercial OpenVPN product users (Access Server and CloudConnexa).
What is OpenVPN 3 Linux?
OpenVPN 3 Linux is a user-space implementation built on the same core library used by OpenVPN Connect. Unlike the older OpenVPN 2.x clients, this version offers:
Unprivileged user support.
Automatic DNS configuration.
Access control for configuration and session management.
D-Bus integration and Python 3 support for scripting and automation.
Installation
We provide packages for Ubuntu, Debian, RHEL, and Fedora. Refer to these for reference:
Using OpenVPN 3 Linux with Access Server
You can connect to Access Server using the openvpn3-as tool included in the client package. Follow the detailed steps in this tutorial:
Advanced features
Configuration and session access control (ACL)
To associate a connection profile (.ovpn file) with a configuration file:
openvpn3 config-import --config client.ovpn --name <MY_CONFIG_NAME> --persistentTo list all available configuration profiles, run this command:
openvpn3 configs-listTo start a VPN session:
openvpn3 session-start --config <MY_CONFIG_NAME>Once a VPN session has started, you can list the active VPN session by running this command:
openvpn3 sessions-listTo disconnect a VPN session:
openvpn3 session-manage --config <MY_CONFIG_NAME> --disconnectTo start a VPN session using the openvpn2 script:
openvpn2 --config Brandon.ovpn --verb 6
Python 3 integration
The client ships with a Python 3 module and example scripts:
openvpn2openvpn3-autoloadopenvpn3-as
More examples are available in the source tree.
AWS VPC integration
For AWS routing integration, install the AWS add-on:
# Ubuntu/Debian apt install openvpn3-addon-aws # Fedora/RHEL/CentOS yum install openvpn3-addon-awsThen start the service:
sudo systemctl enable openvpn3-aws.service
The service listens for VPN route changes and updates your AWS VPC route table.
About DCO (data channel offload)
The OpenVPN 3 client can optionally use the ovpn-dco kernel module for improved performance.
To start a VPN session with DCO:
openvpn3 session-start --config <MY_CONFIG_NAME> --dco trueCheck if the module is installed:
modinfo ovpn-dco-v2Check DKMS status:
dkms statusIf this only says the
ovpn-dcomodule is added and not installed, or the installed kernel version doesn't match the running kernel version, there's a mismatch. Use this command to verify your running kernel version:uname -r
For advanced build and troubleshooting, refer to the dkms(8) man page.
Additional documentation and references
Release notes: See the latest changes and version history on the openvpn3-linux releases page (Codeberg).
All tools include man pages (e.g.,
man openvpn3,man openvpn3-linux).Source and example code: Git repository on Codeberg.
D-Bus programming interface: Service overview.
Limitations
Profile autoloading
OpenVPN 3 doesn't support --auth-user-pass with plain-text files like OpenVPN 2.
OpenVPN 2 Linux clients allowed storing user credentials in a text-based file for starting a VPN connection. For specific use cases with OpenVPN 3 where this is still needed, find a workaround here:
Not using Access Server or CloudConnexa?
This page focuses on using OpenVPN 3 with OpenVPN Inc. products. If you're using OpenVPN 3 Linux with your own server or another VPN provider:
Visit the Community OpenVPN 3 Linux Wiki. Maintained by the open-source community.