FAQs

Issue: If you're looking for comprehensive OpenVPN guides and resources, here are some recommended books that cover various topics, from troubleshooting to advanced configurations.

Solution:

Issue: This issue is typically caused by a firewall blocking the TUN/TAP interface on either the server or the client. Firewalls often block incoming connections to new interfaces by default.

Solution: To resolve this, you need to allow traffic through the TUN/TAP interface explicitly:

Additional Considerations:

Issue: OpenVPN allocates a /30 subnet per client to maintain compatibility with Windows clients. This behavior is due to limitations in the TAP-Win32 driver's TUN emulation mode, which does not support true Point-to-Point (PtP) links.

Solution: In OpenVPN 2.0, a single TUN interface can support multiple clients. Allocating a /30 subnet ensures that each client receives its own virtual IP address within a point-to-point-like structure, even if the operating system (OS) doesn’t support true PtP links over the TUN interface.

Here's how it works:

To reach the rest of the network behind the OpenVPN server, a route is pushed to the client to route traffic through the virtual IP address (192.168.1.5).

Why this happens:

Additional Notes:

Issue: These errors occur when OpenVPN doesn’t have an internal route to the client's network (e.g., 192.168.100.249). As a result, OpenVPN doesn't know how to route the packet to this address, leading to it being dropped.

Solution: To resolve this, use the client-config-dir option and create a ccd (client configuration directory) file for the client. In this file, include the iroute directive to inform OpenVPN that the network (e.g., 192.168.100.0/24) is reachable through this client.

For example, create a ccd file with the following content:

iroute 192.168.100.0 255.255.255.0

This tells OpenVPN that the 192.168.100.0/24 network is behind this client, and it can route packets accordingly.

Issue: This error occurs because the iOS Keychain does not provide the Certificate Authority (CA) list from the PKCS#12 file to OpenVPN. If your profile lacks a ca directive, OpenVPN will not know which CA to use, resulting in the error.

Solution: To fix this, extract the CA list from the PKCS#12 file and add it to your OpenVPN profile using the ca directive. Details are in the OpenVPN Connect documentation, Certificates & Tokens.

Yes, OpenVPN Connect on Android 1.1.14 and newer supports CRLs.

To use a CRL, you must add it to the .ovpn profile, such as:

<crl-verify>
-----BEGIN X509 CRL-----
MIHxMFwwDQYJKoZIhvcNAQEEBQAwFTETMBEGA1UEAxMKT3BlblZQTiBDQRcNMTQw
NDIyMDQzOTI3WhcNMjQwNDE5MDQzOTI3WjAWMBQCAQEYDzIwMTQwNDIyMDQzOTI3
WjANBgkqhkiG9w0BAQQFAAOBgQBQXzbNjXkx8+/TeG8qbFQD5wd6wOTe8HnypQTt
eELsI7eyNtiRRhJD3qKfawPVUabSijnwhAPHfhoIOLKe67RLfzOwAsFKPNJAVdmq
rYw1t2eucHvGjH8PnTh0aJPJaI67jmNbSI4CnHNcRgZ+1ow1GS+RAK7kotS+dZz9
0tc7Qw==
-----END X509 CRL-----
</crl-verify>

You can concatenate multiple CRLs together within the crl-verify block.

If you are importing a .ovpn file that references an external CRL file such as crl-verify crl.pem, ensure you drop the file crl.pem into the same place as the .ovpn file during import so the profile parser can access it.

Issue: Yes, an OpenVPN server can be set up on a machine with a single Network Interface Card (NIC).

Solution: To successfully set up OpenVPN on a machine with a single NIC, ensure the following:

Yes, An OpenVPN server can push HTTP and HTTPS proxy settings to an iOS client to be used by Safari (or other iOS browsers) for the duration of the VPN session. For example, if you want iOS clients to use an HTTP/HTTPS proxy when connected to your OpenVPN server, you can configure the proxy connection.

Suppose you have a proxy at 10.144.4.14 on port 3128. To push the proxy settings to clients, you add the following directives to the OpenVPN server-side configuration:

push "dhcp-option PROXY_HTTP 10.144.5.14 3128"
push "dhcp-option PROXY_HTTPS 10.144.5.14 3128"

If you want several web domains to connect directly and go through the proxy, run a command such as this:

push "dhcp-option PROXY_BYPASS example1.tld example2.tld example3.tld"

If your site uses a Proxy Autoconfiguration URL, specify the URL as follows:

push "dhcp-option PROXY_AUTO_CONFIG_URL http://example.tld/proxy.pac"

If you don't want to (or can't) modify the OpenVPN server configuration, you can add proxy directives directly to the client .ovpn profile. Remove the enclosing push "..." from the directive:

dhcp-option PROXY_HTTP 10.144.5.14 3128
dhcp-option PROXY_HTTPS 10.144.5.14 3128

push "dhcp-option DNS 1.2.3.4" 1

Issue: Yes, you can have multiple profiles in OpenVPN Connect.

Solution: To import multiple profiles, use the Import menu and tap the profile field to select a new one. Remember that OpenVPN will assign a name to each profile based on the server it connects to.

If you import a profile with the same name as an existing one, the new profile will replace the old one. To prevent this, rename the old profile before importing the new one.

Issue: Yes, you can have multiple proxies in OpenVPN Connect.

Solution: To add multiple proxies, use the main menu to add as many proxies as needed. After adding them, a proxy selection field will appear on the main page. You can tap this field to select a proxy, or choose "None" at the end of the list to connect directly.

Yes, you can create OpenVPN profiles using the iPhone Configuration Utility (iPCU) and export them to a .mobileconfig file. Refer to Using Mobileconfig Profiles.

Yes, you can push an IPv6 DNS by using the same format used for IPv4 ones:

push "dhcp-option DNS 2001:abde::1"

Issue: Yes, you can run multiple OpenVPN tunnels on a single machine.

Solution: To run two or more OpenVPN instances on the same machine, you need to ensure the following:

Yes. VPN-On-Demand (VoD) is a new technology introduced by Apple in iOS 6 that allows a VPN profile to specify the conditions under which it automatically connects. In addition, you can connect and disconnect a VoD profile on iOS 7 using the iOS Settings App under the VPN tab (although note that on iOS 8 and higher, ordinary OpenVPN profiles can be connected using the Settings App, as long as they don't require credential entry). OpenVPN on iOS fully supports VoD with the following features:

As noted, you can create OpenVPN VoD profiles using iPCU. Unfortunately, it’s not a simple process because you must manually enter the directives of the OpenVPN profile as key/value pairs into iPCU.

To create a VoD profile with iPCU:

In addition, you can define the key-value pairs in the Custom Data section rather than give these parameters in the OpenVPN client configuration file:

Once you’ve defined the VoD profile, you have two options for exporting it to an iOS device:

When an iOS device receives a VoD profile (via Mail attachment, Safari download, or pushed by iPCU), it raises a dialog box to facilitate the profile import. After import, the profile is visible in the Settings App under General / Profiles. It is also visible as a profile in OpenVPN Connect. Note that the profile must be the currently enabled VPN profile for the VoD functionality to work.

Issue: Yes, OpenVPN can handle situations where both ends of the connection have dynamic IP addresses.

Solution: To achieve this, you must use a dynamic DNS service (such as dyndns.org) to map a domain name to your dynamic IP address. Alternatively, you can manage your own DNS server if it points to a static IP address.

The key to this setup lies in the ping and ping-restart options in the configuration file. If OpenVPN does not receive a ping from its peer within a certain period (e.g., 300 seconds), it will restart, resolve the domain name again (e.g., myremote.mydomain.com), and obtain the new IP address.

Here's how you can configure it:

By using this setup, OpenVPN will "follow" the dynamic DNS address as it changes, ensuring a stable connection even with dynamic IP addresses.

Yes, you can connect from Android Settings with an autologin connection profile.

Issue: I edited my OpenVPN static key by changing some of the hex bytes, but the tunnel still connects using the original key. Is this a bug?

Solution: No, this is not a bug. The OpenVPN 2048-bit static key is designed to be large enough to extract multiple smaller keys from it, specifically for encryption and HMAC authentication. However, the default OpenVPN configuration only uses a small portion of the available key material.

By default, OpenVPN uses:

This means OpenVPN only uses 288 bits out of the 2048-bit static key, leaving the rest unused. Therefore, you can modify many bytes in the key without affecting the operation of the connection as long as the parts used for encryption and HMAC remain intact.

To verify which parts of the key are used, you can run OpenVPN with the following command:

openvpn --dev null --verb 7 --secret key | grep 'crypt:'

This will show you the exact bits OpenVPN uses for the encryption and HMAC keys.

If you want OpenVPN to use more key material, you can configure it to use two separate sets of encryption/HMAC keys (one for each direction of communication) by using the key-direction option.

Example command to use separate keys for each direction:

openvpn --dev null --verb 7 --secret key 0 | grep 'crypt:'  # Peer 1
openvpn --dev null --verb 7 --secret key 1 | grep 'crypt:'  # Peer 2

Why the key is large:The 2048-bit static key is large to accommodate future cryptographic algorithms and key sizes. This design ensures compatibility with future cipher suites, which may require larger keys. The large key size allows OpenVPN to derive two separate sets of keys for encryption and HMAC, each with 512 bits of key material, one for each direction of the tunnel.

Yes, OpenVPN Connect includes support the the tls-crypt option in recent versions.

Issue: If you can’t ping across the tunnel even though everything seems to be configured correctly, it could be due to mismatched options, firewall issues, or network configuration problems.

Solution: