Documentation
VyOS Documentation
VPN on VyOS
OpenVPN

OpenVPN

OpenVPN is an open-source SSL/TLS VPN solution that provides secure point-to-point and remote access connections. OpenVPN uses the OpenSSL library for encryption and can work through NAT and firewalls thanks to using a single TCP or UDP port.

Overview

Key features

OpenVPN advantages:

  • SSL/TLS security with X.509 certificates
  • Works through NAT and firewalls (TCP/UDP on a single port)
  • Cross-platform clients (Windows, macOS, Linux, iOS, Android)
  • Flexible authentication configuration
  • HTTP proxy support
  • Compression (LZO, LZ4)
  • Perfect Forward Secrecy (PFS)

Operating modes:

  • Site-to-Site: Connection between networks
  • Remote Access (Server): Server for remote clients
  • Client: Connection to an OpenVPN server

OpenVPN vs other VPNs

CriterionOpenVPNIPsecWireGuard
PerformanceMedium (500M-1G)High (1-3G)Very high (4-5G)
Ease of setupMediumComplexVery simple
NAT traversalExcellentIssues (NAT-T)Excellent
Cross-platformExcellentGoodGood
Enterprise featuresGoodExcellentBasic

When to use OpenVPN:

  • Remote access VPN for employees
  • When operation through an HTTP proxy is required
  • Complex network environments with NAT/firewalls
  • When client compatibility is required
  • 2FA integration (via plugins)

Architecture and components

SSL/TLS security

OpenVPN uses SSL/TLS for:

  • Data encryption: AES, Blowfish, Camellia
  • Authentication: X.509 certificates or pre-shared keys
  • Integrity: HMAC with SHA-1, SHA-256, SHA-512

Authentication modes

  1. TLS (recommended): X.509 certificates + optional username/password
  2. Static key: Pre-shared key (site-to-site only)
  3. TLS + username/password: Two-factor authentication

Topologies

TUN (routing):

  • Layer 3 (IP) tunnel
  • Routing between networks
  • Less broadcast traffic
  • Recommended for site-to-site

TAP (bridging):

  • Layer 2 (Ethernet) tunnel
  • Bridging between networks
  • Support for non-IP protocols
  • More overhead

Transport protocol

UDP (recommended):

  • Better performance
  • Lower latency
  • May not work through some firewalls

TCP:

  • Guaranteed delivery
  • Works through HTTP proxies
  • Worse performance (TCP over TCP)
  • Use only if UDP does not work

Site-to-Site VPN

Basic configuration

Site A (Initiator)

# Generate static key
generate openvpn key /config/auth/openvpn-siteb.key

# Configure interface
set interfaces openvpn vtun0 mode site-to-site
set interfaces openvpn vtun0 protocol udp
set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194
set interfaces openvpn vtun0 remote-host 203.0.113.2
set interfaces openvpn vtun0 shared-secret-key /config/auth/openvpn-siteb.key

# Tunnel IP addresses
set interfaces openvpn vtun0 local-address 10.255.0.1
set interfaces openvpn vtun0 remote-address 10.255.0.2

# Encryption
set interfaces openvpn vtun0 encryption cipher aes256
set interfaces openvpn vtun0 hash sha256

# Description
set interfaces openvpn vtun0 description 'VPN to Site B'

# Firewall for the OpenVPN port
set firewall ipv4 input filter rule 110 action accept
set firewall ipv4 input filter rule 110 destination port 1194
set firewall ipv4 input filter rule 110 protocol udp
set firewall ipv4 input filter rule 110 description 'Allow OpenVPN'

# Routing
set protocols static route 192.168.2.0/24 interface vtun0

commit
save

Site B (Responder)

# Copy the same static key from Site A
# scp vyos@site-a:/config/auth/openvpn-siteb.key /config/auth/

set interfaces openvpn vtun0 mode site-to-site
set interfaces openvpn vtun0 protocol udp
set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 shared-secret-key /config/auth/openvpn-siteb.key

set interfaces openvpn vtun0 local-address 10.255.0.2
set interfaces openvpn vtun0 remote-address 10.255.0.1

set interfaces openvpn vtun0 encryption cipher aes256
set interfaces openvpn vtun0 hash sha256

set interfaces openvpn vtun0 description 'VPN to Site A'

set firewall ipv4 input filter rule 110 action accept
set firewall ipv4 input filter rule 110 destination port 1194
set firewall ipv4 input filter rule 110 protocol udp

set protocols static route 192.168.1.0/24 interface vtun0

commit
save

Verifying Site-to-Site

# Check the interface
show interfaces openvpn

# Check status
show openvpn status site-to-site

# Check routing
show ip route

# Ping through the tunnel
ping 192.168.2.10 source-address 192.168.1.10

Site-to-Site with TLS (certificates)

A more secure option that uses certificates instead of a static key.

Generating certificates (on Site A)

# CA (Certificate Authority)
generate pki ca install ca-openvpn

# Server certificate for Site A
generate pki certificate sign ca-openvpn install site-a-cert

# Server certificate for Site B
generate pki certificate sign ca-openvpn install site-b-cert

# Diffie-Hellman parameters
generate pki dh install dh-openvpn

# TLS auth key (extra protection against DoS)
generate openvpn tls-auth-key /config/auth/openvpn-tls.key

Site A configuration (TLS)

set interfaces openvpn vtun1 mode site-to-site
set interfaces openvpn vtun1 protocol udp
set interfaces openvpn vtun1 local-port 1195
set interfaces openvpn vtun1 remote-port 1195
set interfaces openvpn vtun1 remote-host 203.0.113.2

# TLS authentication
set interfaces openvpn vtun1 tls ca-certificate ca-openvpn
set interfaces openvpn vtun1 tls certificate site-a-cert
set interfaces openvpn vtun1 tls dh-params dh-openvpn
set interfaces openvpn vtun1 tls auth-key /config/auth/openvpn-tls.key

# IP addresses
set interfaces openvpn vtun1 local-address 10.255.1.1
set interfaces openvpn vtun1 remote-address 10.255.1.2

# Encryption
set interfaces openvpn vtun1 encryption cipher aes256
set interfaces openvpn vtun1 hash sha256

# Compression (optional)
set interfaces openvpn vtun1 compression lz4

commit
save

Site B configuration (TLS)

# Copy from Site A:
# - CA certificate
# - Site B certificate and key
# - DH parameters
# - TLS auth key

set interfaces openvpn vtun1 mode site-to-site
set interfaces openvpn vtun1 protocol udp
set interfaces openvpn vtun1 local-port 1195

set interfaces openvpn vtun1 tls ca-certificate ca-openvpn
set interfaces openvpn vtun1 tls certificate site-b-cert
set interfaces openvpn vtun1 tls dh-params dh-openvpn
set interfaces openvpn vtun1 tls auth-key /config/auth/openvpn-tls.key

set interfaces openvpn vtun1 local-address 10.255.1.2
set interfaces openvpn vtun1 remote-address 10.255.1.1

set interfaces openvpn vtun1 encryption cipher aes256
set interfaces openvpn vtun1 hash sha256
set interfaces openvpn vtun1 compression lz4

commit
save

Remote Access Server

An OpenVPN server for remote clients (road warriors).

Preparing certificates

# CA for OpenVPN
generate pki ca install ca-remote-vpn common-name "Remote VPN CA"

# Server certificate
generate pki certificate sign ca-remote-vpn install vpn-server-cert common-name "vpn.company.com"

# Client certificates
generate pki certificate sign ca-remote-vpn install client1-cert common-name "user1@company.com"
generate pki certificate sign ca-remote-vpn install client2-cert common-name "user2@company.com"

# DH parameters
generate pki dh install dh-remote-vpn

# TLS auth key
generate openvpn tls-auth-key /config/auth/remote-vpn-tls.key

Basic server configuration

# Server interface
set interfaces openvpn vtun10 mode server
set interfaces openvpn vtun10 protocol udp
set interfaces openvpn vtun10 local-port 1194
set interfaces openvpn vtun10 persistent-tunnel

# TLS
set interfaces openvpn vtun10 tls ca-certificate ca-remote-vpn
set interfaces openvpn vtun10 tls certificate vpn-server-cert
set interfaces openvpn vtun10 tls dh-params dh-remote-vpn
set interfaces openvpn vtun10 tls auth-key /config/auth/remote-vpn-tls.key

# Addressing for clients
set interfaces openvpn vtun10 server subnet 10.8.0.0/24
set interfaces openvpn vtun10 server topology subnet

# Push routes to clients
set interfaces openvpn vtun10 server push-route 192.168.1.0/24
set interfaces openvpn vtun10 server push-route 10.0.0.0/8

# DNS servers for clients
set interfaces openvpn vtun10 server name-server 192.168.1.1
set interfaces openvpn vtun10 server domain-name company.local

# Encryption
set interfaces openvpn vtun10 encryption cipher aes256
set interfaces openvpn vtun10 hash sha256

# Keepalive
set interfaces openvpn vtun10 server keepalive interval 10
set interfaces openvpn vtun10 server keepalive timeout 120

# Maximum number of clients
set interfaces openvpn vtun10 server max-connections 50

# Firewall
set firewall ipv4 input filter rule 120 action accept
set firewall ipv4 input filter rule 120 destination port 1194
set firewall ipv4 input filter rule 120 protocol udp
set firewall ipv4 input filter rule 120 description 'OpenVPN Remote Access'

# Allow VPN clients access to the LAN
set firewall ipv4 forward filter rule 200 action accept
set firewall ipv4 forward filter rule 200 source address 10.8.0.0/24
set firewall ipv4 forward filter rule 200 destination address 192.168.1.0/24

commit
save

Static IPs for clients

# Assign a static IP to a client
set interfaces openvpn vtun10 server client client1 ip 10.8.0.10
set interfaces openvpn vtun10 server client client1 subnet 192.168.100.0/24
set interfaces openvpn vtun10 server client client1 disable false

# Another client
set interfaces openvpn vtun10 server client client2 ip 10.8.0.20

commit

Server with username/password

Adding username/password authentication (in addition to certificates).

# Creating users
set interfaces openvpn vtun10 server client user1 disable false
set interfaces openvpn vtun10 server client user1 ip 10.8.0.11

# Authentication plugin
set interfaces openvpn vtun10 authentication mode local
set interfaces openvpn vtun10 authentication local-users username user1 password 'SecurePass123!'
set interfaces openvpn vtun10 authentication local-users username user2 password 'AnotherPass456!'

# Require username/password
set interfaces openvpn vtun10 authentication require 'username'

commit

Server with RADIUS

Integration with RADIUS for centralized authentication.

# RADIUS configuration
set interfaces openvpn vtun10 authentication mode radius
set interfaces openvpn vtun10 authentication radius server 192.168.1.10 key 'RadiusSecret'
set interfaces openvpn vtun10 authentication radius server 192.168.1.11 key 'RadiusSecret'

# Timeout
set interfaces openvpn vtun10 authentication radius timeout 5

commit

Verifying the server

# Server status
show openvpn status server

# Connected clients
show openvpn server-status vtun10

# Logs
show log openvpn

Example output:

OpenVPN server status on vtun10

Client CN                Remote Host           Bytes In  Bytes Out  Connected Since
-----------------------  --------------------  --------  ---------  ---------------
user1@company.com        203.0.113.50:52341    125 MB    89 MB      Jan 10 09:23:15
user2@company.com        198.51.100.25:41829   45 MB     23 MB      Jan 10 11:45:32

Client configurations

Exporting a configuration for a client

VyOS can generate an .ovpn file for a client.

# Generate the client configuration
generate openvpn client-config vtun10 client1

# Print the configuration
show openvpn client-config vtun10 client1

Save the output to a client1.ovpn file.

Example client configuration

client
dev tun
proto udp
remote vpn.company.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
auth SHA256
verb 3

# Embedded certificates
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>
key-direction 1

Windows client

  1. Download OpenVPN GUI: https://openvpn.net/community-downloads/
  2. Install it
  3. Copy client1.ovpn to C:\Program Files\OpenVPN\config\
  4. Launch OpenVPN GUI
  5. Right-click → Connect

macOS client

  1. Download Tunnelblick: https://tunnelblick.net/
  2. Install it
  3. Double-click client1.ovpn
  4. Connect

Linux client

# Installation
sudo apt-get install openvpn

# Connecting
sudo openvpn --config client1.ovpn

# Or via systemd
sudo cp client1.ovpn /etc/openvpn/client/client1.conf
sudo systemctl start openvpn-client@client1
sudo systemctl enable openvpn-client@client1

iOS/Android clients

iOS: OpenVPN Connect (App Store) Android: OpenVPN for Android (Google Play)

  1. Install the app
  2. Import the .ovpn file
  3. Connect

Advanced configurations

OpenVPN over TCP with an HTTP Proxy

For operation through a corporate proxy.

# Server over TCP
set interfaces openvpn vtun11 mode server
set interfaces openvpn vtun11 protocol tcp-passive
set interfaces openvpn vtun11 local-port 443

# The rest of the configuration is the same as UDP

commit

Client:

proto tcp-client
remote vpn.company.com 443
http-proxy proxy.company.com 8080
http-proxy-retry

Split-tunnel (only part of the traffic through the VPN)

By default OpenVPN redirects all traffic. For a split-tunnel:

# Remove the default-route push
set interfaces openvpn vtun10 server redirect-gateway def1 disable

# Push only the required routes
set interfaces openvpn vtun10 server push-route 192.168.1.0/24
set interfaces openvpn vtun10 server push-route 10.0.0.0/8

commit

Full-tunnel (all traffic through the VPN)

# Redirect the default gateway
set interfaces openvpn vtun10 server redirect-gateway def1

# Push DNS
set interfaces openvpn vtun10 server name-server 192.168.1.1

commit

IPv6 over OpenVPN

# Server IPv6 subnet
set interfaces openvpn vtun10 server subnet 10.8.0.0/24
set interfaces openvpn vtun10 server ipv6-subnet fd00:8::/64

# Push IPv6 routes
set interfaces openvpn vtun10 server push-route 2001:db8::/48

commit

Compression

# LZ4 compression (recommended)
set interfaces openvpn vtun10 compression lz4

# LZO compression (legacy)
set interfaces openvpn vtun10 compression lzo

# Disable compression
delete interfaces openvpn vtun10 compression

commit

Warning: Compression may be vulnerable to the VORACLE attack. Use it only on trusted networks, or disable it.

Multi-factor Authentication (2FA)

OpenVPN supports 2FA via plugins.

With TOTP (Time-based One-Time Password)

# Require username + password + OTP
set interfaces openvpn vtun10 authentication require 'username'
set interfaces openvpn vtun10 openvpn-option '--auth-user-pass-verify /config/scripts/2fa-verify.sh via-env'

commit

The /config/scripts/2fa-verify.sh script must validate the OTP code.

Client-to-Client

Allow clients to communicate with each other.

set interfaces openvpn vtun10 server client-to-client

commit

Logging connections

# Log file
set interfaces openvpn vtun10 openvpn-option '--log-append /var/log/openvpn/vtun10.log'

# Verbosity level
set interfaces openvpn vtun10 openvpn-option '--verb 4'

commit

Performance

Performance optimization

# Increase buffers
set interfaces openvpn vtun10 openvpn-option '--sndbuf 524288'
set interfaces openvpn vtun10 openvpn-option '--rcvbuf 524288'

# Disable compression if not needed
delete interfaces openvpn vtun10 compression

# Use UDP instead of TCP
set interfaces openvpn vtun10 protocol udp

# Use AES-GCM (faster)
set interfaces openvpn vtun10 encryption cipher aes256gcm
set interfaces openvpn vtun10 encryption ncp-ciphers aes256gcm

commit

Performance benchmark

# iperf3 through OpenVPN
# On the server:
iperf3 -s

# On the client through the VPN:
iperf3 -c 10.8.0.1

Typical performance:

  • UDP: 500-800 Mbps
  • TCP: 300-500 Mbps
  • With compression: -10-20%

Security

Security recommendations

  1. Use strong encryption:
set interfaces openvpn vtun10 encryption cipher aes256gcm
set interfaces openvpn vtun10 hash sha256
  1. TLS version:
set interfaces openvpn vtun10 tls tls-version-min '1.2'
  1. TLS auth key (protection against DoS):
set interfaces openvpn vtun10 tls auth-key /config/auth/tls.key
  1. Regular certificate rotation:
# Set a validity period at generation time
generate pki certificate sign ca-remote-vpn install client-cert days 365
  1. Revoking compromised certificates:
# CRL (Certificate Revocation List)
set interfaces openvpn vtun10 tls crl /config/auth/crl.pem
  1. Firewall rules:
# Rate limiting for the OpenVPN port
set firewall ipv4 input filter rule 120 recent count 5
set firewall ipv4 input filter rule 120 recent time minute 1
set firewall ipv4 input filter rule 120 action drop
  1. Logging:
set interfaces openvpn vtun10 openvpn-option '--log-append /var/log/openvpn/vtun10.log'

Revoking client certificates

# Create a CRL
generate pki crl ca-remote-vpn

# Add a certificate to the CRL
revoke pki certificate client1-cert

# Apply the CRL
set interfaces openvpn vtun10 tls crl /config/auth/crl.pem

commit

Monitoring and diagnostics

Checking status

# Interfaces
show interfaces openvpn
show interfaces openvpn vtun10

# Detailed status
show interfaces openvpn vtun10 detail

# Statistics
show interfaces openvpn vtun10 statistics

Checking the server

# Server status
show openvpn status server

# A specific server
show openvpn server-status vtun10

# Connected clients
show openvpn server-status vtun10 detail

Logs

# General log
show log openvpn

# Last 50 lines
show log openvpn tail 50

# Search for errors
show log openvpn | match error

# Live log
monitor log openvpn

Connectivity testing

# Ping with source
ping 10.8.0.10 source-address 192.168.1.1

# Traceroute
traceroute 10.8.0.10

# MTU discovery
ping 10.8.0.10 size 1400 do-not-fragment

Troubleshooting

The tunnel does not come up

Problem: The client cannot connect to the server.

Diagnostics:

# Check the firewall
show firewall ipv4 input filter

# Check whether OpenVPN is listening
netstat -ulnp | grep openvpn

# Logs
show log openvpn | match error

Solution:

  1. Check the firewall rules for the OpenVPN port
  2. Make sure remote-host is reachable: ping 203.0.113.2
  3. Check that the port is open: nc -zvu 203.0.113.2 1194
  4. Check the certificates/keys

Authentication fails

Problem: “TLS Error: TLS handshake failed”.

Solution:

# Check the certificates
show pki certificate vpn-server-cert

# Check the CA
show pki ca ca-remote-vpn

# Make sure the TLS auth key is identical
cat /config/auth/remote-vpn-tls.key

The tunnel is up but there is no connectivity

Problem: OpenVPN is connected, but there is no access to the remote network.

Diagnostics:

# Check routing
show ip route
show ip route 192.168.1.0/24

# Check the firewall forward chain
show firewall ipv4 forward filter

# Ping
ping 192.168.1.1 source-address 10.8.0.10

Solution:

  1. Add routes if they are missing
  2. Check the firewall forward rules
  3. Make sure NAT is not applied to VPN traffic

Poor performance

Problem: The speed through the VPN is low.

Solution:

# MTU tuning
set interfaces openvpn vtun10 mtu 1400

# Disable compression
delete interfaces openvpn vtun10 compression

# Use UDP
set interfaces openvpn vtun10 protocol udp

# AES-GCM instead of AES-CBC
set interfaces openvpn vtun10 encryption cipher aes256gcm

commit

Connection drops

Problem: The VPN disconnects periodically.

Solution:

# Increase keepalive
set interfaces openvpn vtun10 server keepalive interval 10
set interfaces openvpn vtun10 server keepalive timeout 120

# Float (allow the client's IP to change)
set interfaces openvpn vtun10 openvpn-option '--float'

# Persist tun
set interfaces openvpn vtun10 persistent-tunnel

commit

DNS does not work for clients

Problem: Clients cannot resolve names.

Solution:

# Push DNS servers
set interfaces openvpn vtun10 server name-server 8.8.8.8
set interfaces openvpn vtun10 server name-server 1.1.1.1

# Push domain
set interfaces openvpn vtun10 server domain-name company.local

commit

Client-to-client does not work

Problem: Clients cannot see each other.

Solution:

# Enable client-to-client
set interfaces openvpn vtun10 server client-to-client

# Check the firewall
show firewall ipv4 forward filter

commit

Integration with other services

OpenVPN + VRRP

Using OpenVPN with high availability.

# Two servers with VRRP
# Master and Backup configure an identical OpenVPN

# VRRP IP
set high-availability vrrp group VPN vrid 30
set high-availability vrrp group VPN interface eth0
set high-availability vrrp group VPN address 203.0.113.100/24

# OpenVPN on the VRRP IP
set interfaces openvpn vtun10 local-host 203.0.113.100

commit

Clients connect to 203.0.113.100 (the VRRP IP).

OpenVPN + RADIUS

Centralized authentication through RADIUS.

set interfaces openvpn vtun10 authentication mode radius
set interfaces openvpn vtun10 authentication radius server 192.168.1.10 key 'Secret123'
set interfaces openvpn vtun10 authentication radius server 192.168.1.11 key 'Secret123'
set interfaces openvpn vtun10 authentication radius timeout 5

commit

OpenVPN + Firewall

Fine-grained control of VPN traffic.

# Allow only specific protocols
set firewall ipv4 forward filter rule 210 action accept
set firewall ipv4 forward filter rule 210 source address 10.8.0.0/24
set firewall ipv4 forward filter rule 210 destination address 192.168.1.0/24
set firewall ipv4 forward filter rule 210 destination port 80,443
set firewall ipv4 forward filter rule 210 protocol tcp

# Block everything else
set firewall ipv4 forward filter rule 299 action drop
set firewall ipv4 forward filter rule 299 source address 10.8.0.0/24

commit

Configuration examples

Example 1: Simple Remote Access

Scenario: Employees connect to the office network.

Requirements:

  • 50 users
  • Full tunnel (all traffic through the VPN)
  • Username/password authentication
  • DNS filtering

Configuration:

# PKI
generate pki ca install ca-staff-vpn
generate pki certificate sign ca-staff-vpn install staff-vpn-server
generate pki dh install dh-staff
generate openvpn tls-auth-key /config/auth/staff-tls.key

# Server
set interfaces openvpn vtun20 mode server
set interfaces openvpn vtun20 protocol udp
set interfaces openvpn vtun20 local-port 1194

set interfaces openvpn vtun20 tls ca-certificate ca-staff-vpn
set interfaces openvpn vtun20 tls certificate staff-vpn-server
set interfaces openvpn vtun20 tls dh-params dh-staff
set interfaces openvpn vtun20 tls auth-key /config/auth/staff-tls.key

set interfaces openvpn vtun20 server subnet 10.9.0.0/24
set interfaces openvpn vtun20 server topology subnet
set interfaces openvpn vtun20 server max-connections 50

# Full tunnel
set interfaces openvpn vtun20 server redirect-gateway def1

# DNS
set interfaces openvpn vtun20 server name-server 1.1.1.3
set interfaces openvpn vtun20 server name-server 1.0.0.3
set interfaces openvpn vtun20 server domain-name company.local

# Push routes
set interfaces openvpn vtun20 server push-route 192.168.0.0/16

# Local auth
set interfaces openvpn vtun20 authentication mode local
set interfaces openvpn vtun20 authentication require 'username'
set interfaces openvpn vtun20 authentication local-users username alice password 'Pass123!'
set interfaces openvpn vtun20 authentication local-users username bob password 'Pass456!'

# Encryption
set interfaces openvpn vtun20 encryption cipher aes256gcm
set interfaces openvpn vtun20 hash sha256

# Keepalive
set interfaces openvpn vtun20 server keepalive interval 10
set interfaces openvpn vtun20 server keepalive timeout 60

# Firewall
set firewall ipv4 input filter rule 130 action accept
set firewall ipv4 input filter rule 130 destination port 1194
set firewall ipv4 input filter rule 130 protocol udp

set firewall ipv4 forward filter rule 220 action accept
set firewall ipv4 forward filter rule 220 source address 10.9.0.0/24

commit
save

Example 2: Site-to-Site Backup for IPsec

Scenario: OpenVPN as a backup for an IPsec tunnel.

Configuration:

# Primary: IPsec on eth0
# Backup: OpenVPN on eth1

# OpenVPN backup
set interfaces openvpn vtun5 mode site-to-site
set interfaces openvpn vtun5 protocol udp
set interfaces openvpn vtun5 local-port 1194
set interfaces openvpn vtun5 remote-port 1194
set interfaces openvpn vtun5 remote-host 198.51.100.2
set interfaces openvpn vtun5 shared-secret-key /config/auth/backup-key

set interfaces openvpn vtun5 local-address 10.255.2.1
set interfaces openvpn vtun5 remote-address 10.255.2.2

# Routing with metrics
set protocols static route 192.168.2.0/24 interface vti0 distance 10
set protocols static route 192.168.2.0/24 interface vtun5 distance 20

commit
save

IPsec primary (metric 10), OpenVPN backup (metric 20).

Example 3: Split-tunnel for contractors

Scenario: Contractors get access to specific resources only.

Configuration:

# Server
set interfaces openvpn vtun30 mode server
set interfaces openvpn vtun30 protocol udp
set interfaces openvpn vtun30 local-port 1195

set interfaces openvpn vtun30 tls ca-certificate ca-contractors
set interfaces openvpn vtun30 tls certificate contractors-server
set interfaces openvpn vtun30 tls dh-params dh-contractors

set interfaces openvpn vtun30 server subnet 10.10.0.0/24

# Split-tunnel: specific routes only
set interfaces openvpn vtun30 server push-route 192.168.10.0/24
set interfaces openvpn vtun30 server push-route 192.168.20.0/24

# Do not redirect the default gateway
# (we do not use redirect-gateway)

# DNS
set interfaces openvpn vtun30 server name-server 192.168.1.1

# Firewall: restrict access
set firewall ipv4 forward filter rule 230 action accept
set firewall ipv4 forward filter rule 230 source address 10.10.0.0/24
set firewall ipv4 forward filter rule 230 destination address 192.168.10.0/24

set firewall ipv4 forward filter rule 231 action accept
set firewall ipv4 forward filter rule 231 source address 10.10.0.0/24
set firewall ipv4 forward filter rule 231 destination address 192.168.20.0/24

set firewall ipv4 forward filter rule 239 action drop
set firewall ipv4 forward filter rule 239 source address 10.10.0.0/24

commit
save

Best practices

  1. Use TLS instead of static keys for production
  2. Configure a TLS auth key for protection against DoS
  3. Use UDP instead of TCP (when possible)
  4. AES-256-GCM for encryption (performance + security)
  5. Rotate certificates regularly (validity period of 1-2 years)
  6. Configure a CRL to enable certificate revocation
  7. Log connections for auditing
  8. Use strong DH params (2048+ bits)
  9. Firewall rules for VPN clients
  10. MTU 1400 to avoid fragmentation
  11. Back up the configuration regularly
  12. Monitor connections and set up alerts
  13. Rate limiting on the OpenVPN port
  14. Split-tunnel when a full-tunnel is not needed (saves bandwidth)
  15. Document client configurations

Migrating from other VPNs

From IPsec to OpenVPN

Reasons to migrate:

  • NAT traversal issues
  • Need to operate through an HTTP proxy
  • Simpler client management

Plan:

  1. Configure OpenVPN in parallel with IPsec
  2. Issue .ovpn configurations to clients
  3. Test period (both VPNs running)
  4. Migrate clients in stages
  5. Disable IPsec after the full migration

From PPTP/L2TP to OpenVPN

Reasons: Security (PPTP is obsolete).

Plan:

  1. Install an OpenVPN server
  2. Create client certificates
  3. Send instructions to users
  4. Grace period (both running)
  5. Disable PPTP/L2TP

Conclusion

OpenVPN is a reliable, flexible, and secure VPN solution, especially suited for:

  • Remote access VPN with cross-platform clients
  • Complex network environments with NAT, firewalls, proxies
  • When compatibility and versatility are required

For maximum performance, consider WireGuard, and for enterprise site-to-site with other vendors, IPsec.

VyOS provides full OpenVPN support with all enterprise features: TLS authentication, RADIUS integration, client-to-client, compression, IPv6, and much more.

Reviewed by OpenNix LLC · Last updated on
IPsec VPNL2TP/IPsec VPN