OpenVPN clients connect to OpenVPN servers to establish secure VPN tunnels. This guide covers client configuration from basic setups to advanced scenarios.
The --client directive is a helper that automatically enables --pull and --tls-client for simplified client configuration.
Here’s a production-ready client configuration based on the OpenVPN 2.6 sample:
client.conf
############################################### Sample client-side OpenVPN 2.6 config file ## for connecting to multi-client server. ################################################ Specify that we are a client and that we# will be pulling certain config file directives# from the server.client# Use the same setting as you are using on# the server.dev tun# Are we connecting to a TCP or# UDP server? Use the same setting as# on the server.proto udp# The hostname/IP and port of the server.# You can have multiple remote entries# to load balance between the servers.remote my-server-1 1194# Keep trying indefinitely to resolve the# host name of the OpenVPN server. Very useful# on machines which are not permanently connected# to the internet such as laptops.resolv-retry infinite# Most clients don't need to bind to# a specific local port number.nobind# Try to preserve some state across restarts.persist-tun# SSL/TLS parms.ca ca.crtcert client.crtkey client.key# Verify server certificate by checking that the# certificate has the correct key usage set.remote-cert-tls server# Set log file verbosity.verb 3
# Keep trying to resolve DNS indefinitely (good for laptops)resolv-retry infinite# Wait between connection attempts (seconds)connect-retry 5# Maximum number of connection attempts per serverconnect-retry-max 3# Server connection timeout (seconds)server-poll-timeout 120
# Control behavior on authentication failureauth-retry interact # Prompt again on failureauth-retry nointeract # Retry without prompting (for unattended clients)auth-retry none # Exit on failure (default)
# Verify server certificate usageremote-cert-tls server# Additional HMAC authentication (if server uses it)tls-auth ta.key 1 # Key direction must be 1 for clients
OpenVPN 2.6+ supports the --dns directive pushed from servers:
# Modern DNS configuration (pushed by server)# Client must support the 'dns' option# For older servers, use dhcp-option# dhcp-option DNS 8.8.8.8# dhcp-option DNS 8.8.4.4
Clients typically accept routes pushed by the server, but can filter them:
# Accept all routes from server (default with --client)pull# Filter pushed routespull-filter accept "route 192.168.1."pull-filter ignore "route "# Reject specific pushed optionspull-filter reject "redirect-gateway"
pull-filter should not be relied upon as a security measure. It can be defeated by creative formatting.
# Test basic connectivityping -c 4 server.example.com# Test specific port (UDP)nc -u -v server.example.com 1194# Test specific port (TCP)nc -v server.example.com 443# Run OpenVPN in foreground for testingsudo openvpn --config client.conf