OpenVPN-Install

OpenVPN Road Warrior Installer

OpenVPN Road Warrior Installer

⚡ A production-ready OpenVPN deployment script featuring automated installation, dual-stack IPv4/IPv6 support, hardened security defaults, and an integrated Unbound recursive DNS resolver.

License: MIT Shell Release Platform Ubuntu Debian Bash Latest Release Maintenance Status License GitHub Issues GitHub Pull Requests Donate with PayPal Donate with Ko-fi Sponsor with GitHub GitHub Forks GitHub Contributors

🚀 OpenVPN Road Warrior Installer enables you to deploy a secure, production-ready OpenVPN server in under a minute—even with no prior VPN administration experience.

Designed to be minimal, non-intrusive, and security-focused, the script automates the entire deployment process, including PKI generation, firewall configuration, routing, DNS integration, and client provisioning, allowing you to bring a fully functional VPN server online with minimal effort.

Table of Contents

Supported Distributions

🐧 Distribution ⚙️ Minimum Version 📦 Repository Channel
Ubuntu 22.04 LTS Official OpenVPN APT
Debian 11 (Bullseye) Official OpenVPN APT
AlmaLinux 8 Copr @OpenVPN/openvpn-release-2.6
Rocky Linux 8 Copr @OpenVPN/openvpn-release-2.6
CentOS / Stream 8 Copr @OpenVPN/openvpn-release-2.6
Oracle Linux 8 Copr @OpenVPN/openvpn-release-2.6
Fedora Latest Stable Distribution Native

[!NOTE] ⚠️ Debian Testing and Debian Unstable (Sid) are currently not supported to maintain installation predictability.

Requirements

Quick Start

Choose one of the installation options below to begin the interactive setup:

🚀 Option 1: Maintained Version (Recommended)

This version is maintained by alsyundawy and includes all the features listed in this repository (e.g., dual-stack IPv4/IPv6, extended DNS options, security hardening, colorized output, and enhanced client management).

Using wget:

wget https://raw.githubusercontent.com/alsyundawy/OpenVPN-Install/refs/heads/master/openvpn-install.sh \
  -O openvpn-install.sh && sudo bash openvpn-install.sh

Using curl:

curl -O https://raw.githubusercontent.com/alsyundawy/OpenVPN-Install/refs/heads/master/openvpn-install.sh \
  && sudo bash openvpn-install.sh

☕ Option 2: Original Creator’s Version (Nyr)

This runs the original script (openvpn-install-nyr.sh) by Nyr.

Using wget:

wget https://raw.githubusercontent.com/alsyundawy/OpenVPN-Install/refs/heads/master/openvpn-install-nyr.sh \
  -O openvpn-install-nyr.sh && sudo bash openvpn-install-nyr.sh

Using curl:

curl -O https://raw.githubusercontent.com/alsyundawy/OpenVPN-Install/refs/heads/master/openvpn-install-nyr.sh \
  && sudo bash openvpn-install-nyr.sh

📋 The script will guide you through:

  1. Selecting the primary network interface (IPv4 / IPv6).
  2. Choosing the transport protocol (UDP is highly recommended, or TCP).
  3. Defining the listening port (default: 1194).
  4. Selecting your preferred DNS resolver.
  5. Providing the initial client name.

💾 Upon completion, the installer saves a client configuration file (.ovpn) directly to the script directory.

📱 OpenVPN Client Applications

Once the installation completes, the installer automatically generates a client configuration profile (.ovpn) in the same directory where the installation script was executed.

The generated .ovpn file contains everything required to establish a secure VPN connection, including the server configuration, certificates, cryptographic parameters, and client settings.

Simply download one of the recommended OpenVPN clients below, import the generated .ovpn profile, and connect securely to your VPN server.

[!TIP]

💡 The generated .ovpn profile is fully compatible with:

🪟 Windows

⭐ Recommended Client

OpenVPN Connect (Official)

Official download

https://openvpn.net/client/

Supported operating systems

✨ Features

🔄 Alternative Client

OpenVPN GUI (Open Source)

GitHub

https://github.com/OpenVPN/openvpn-gui

Recommended for users who prefer a lightweight native Windows client.

Features

📥 Import .ovpn using OpenVPN Connect

  1. 📄 Download the generated .ovpn profile.
  2. 📦 Install OpenVPN Connect.
  3. 🚀 Launch the application.
  4. ➕ Click Add Profile.
  5. 📂 Select Upload File.
  6. 📄 Choose your generated .ovpn.
  7. 🔑 Enter your VPN username and password (if required).
  8. 💾 Save the profile.
  9. ✅ Click Connect.

[!TIP] You can also drag and drop the .ovpn file directly into OpenVPN Connect on Windows.

📥 Import .ovpn using OpenVPN GUI

  1. Install OpenVPN GUI.
  2. Open the application.
  3. Select Import → Import File.
  4. Choose your .ovpn file.
  5. Wait until the profile is successfully imported.
  6. Right-click the OpenVPN tray icon.
  7. Select the imported profile.
  8. Click Connect.

Alternatively, copy the .ovpn file into:

C:\Users\<username>\OpenVPN\config\

or

C:\Program Files\OpenVPN\config\

The profile will automatically appear inside OpenVPN GUI after restarting or rescanning the configuration directory.

🍎 macOS

⭐ Recommended Client

OpenVPN Connect (Official)

Download

https://openvpn.net/client/

Supported versions

🆓 Free & Open Source

Tunnelblick

Website

https://tunnelblick.net/

Tunnelblick is the most popular free OpenVPN client for macOS and is fully compatible with standard .ovpn profiles.

Features

💼 Commercial Alternative

Viscosity

Website

https://www.sparklabs.com/viscosity/

Features

📥 Import .ovpn using OpenVPN Connect

  1. Install OpenVPN Connect.
  2. Open the application.
  3. Click Upload File.
  4. Select your .ovpn.
  5. Enter credentials if requested.
  6. Save.
  7. Connect.

📥 Import .ovpn using Tunnelblick

  1. Install Tunnelblick.
  2. Double-click the generated .ovpn.
  3. Choose Install for Me or Install for All Users.
  4. Approve the installation.
  5. Enter your macOS administrator password if requested.
  6. Click Connect.

📥 Import .ovpn using Viscosity

  1. Open Viscosity.
  2. Navigate to Preferences.
  3. Select Connections.
  4. Click +.
  5. Choose Import Connection → From File....
  6. Select the .ovpn profile.
  7. Save.
  8. Connect.

🐧 Linux

⭐ Official Client

OpenVPN 3 Linux

Download

https://openvpn.net/client/

The following desktop environments support importing .ovpn files using NetworkManager.

🟢 GNOME Desktop

Install

sudo apt update
sudo apt install network-manager-openvpn network-manager-openvpn-gnome

Import: Settings → Network → VPN → + → Import from File → Select your .ovpn profile → Connect

🔵 KDE Plasma

Install

sudo apt update
sudo apt install plasma-nm network-manager-openvpn

Import: System Settings → Network → Connections → Add VPN → Import VPN Connection → Select .ovpn

⚙️ Import Using NetworkManager CLI

nmcli connection import type openvpn file client.ovpn

List imported connections

nmcli connection show

Connect

nmcli connection up client

The imported profile is stored as a NetworkManager connection, allowing you to manage it from your desktop environment.

💻 Command Line (OpenVPN)

Install OpenVPN

Debian / Ubuntu

sudo apt update
sudo apt install openvpn

Fedora

sudo dnf install openvpn

RHEL / AlmaLinux / Rocky Linux

sudo dnf install openvpn

Connect

sudo openvpn --config client.ovpn

Disconnect: press CTRL + C

💼 Commercial Client

Viscosity

https://www.sparklabs.com/viscosity/

Supports Linux and provides an easy graphical interface for importing .ovpn files.

🌐 Connect to OpenVPN Using .ovpn on MikroTik RouterOS

Starting with RouterOS v7.12, MikroTik supports importing an OpenVPN client configuration directly from a standard .ovpn file. This greatly simplifies deployment by automatically importing supported VPN parameters, certificates, and authentication settings. For the best compatibility and latest OpenVPN improvements, use the latest stable RouterOS v7 release.

[!IMPORTANT]

✅ RouterOS v7.12 or later is required for .ovpn import.

⭐ The latest stable RouterOS v7 release is strongly recommended.

📋 Requirements

Before importing your VPN profile, make sure you have:

[!TIP]

TLS certificate validation depends on the router’s system clock. Always enable NTP before connecting to an OpenVPN server.

📂 Method 1 — Import Using WinBox (Recommended)

Step 1 — Upload the Profile

Open Files and drag and drop your generated client.ovpn into the router.

Step 2 — Import the Profile

Open PPP → OVPN → Import, choose client.ovpn, enter Username and Password, then click Import.

RouterOS will automatically import supported configuration from the profile, including certificates, remote server settings, ciphers, authentication parameters, and TLS authentication when present. Supported parameters depend on the RouterOS version.

Step 3 — Verify Import

Navigate to Interfaces → OVPN Client. A new interface (e.g. ovpn-client) should appear. Enable it if necessary.

💻 Method 2 — Import Using CLI

Upload client.ovpn to the router, then import it:

/interface/ovpn-client/import-ovpn-configuration \
file-name=client.ovpn \
ovpn-user=myuser \
ovpn-password=mypassword \
skip-cert-import=no

If the client private key is protected:

/interface/ovpn-client/import-ovpn-configuration \
file-name=client.ovpn \
ovpn-user=myuser \
ovpn-password=mypassword \
key-passphrase=myPrivateKeyPassword

▶ Enable the VPN

List interfaces

/interface/ovpn-client/print

Enable

/interface/ovpn-client/enable 0

Replace 0 with your interface number if different.

🔍 Monitor Connection Status

/interface/ovpn-client/monitor 0

Example output

status: connected
uptime: 00:25:42
local-address: 172.16.200.2
remote-address: 172.16.200.1

Show details

/interface/ovpn-client/print detail

A connected interface displays the R flag.

🌍 Route Internet Traffic Through VPN

Automatically install the default route

/interface/ovpn-client
set 0 add-default-route=yes

Use DNS servers provided by the VPN

/interface/ovpn-client
set 0 use-peer-dns=yes

Verify routing

/ip/route/print

🧪 Verify Connectivity

Ping Cloudflare DNS

/tool/ping 1.1.1.1

Ping Google DNS

/tool/ping 8.8.8.8

Check default routes

/ip/route/print

View DNS configuration

/ip/dns/print

🔐 Security Recommendations

⚠ RouterOS OpenVPN Limitations

RouterOS implements its own OpenVPN client and does not support every OpenVPN directive.

Current notable limitations include:

For the latest supported directives and client capabilities, consult the official MikroTik OpenVPN documentation.

[!NOTE]

This installer generates standard OpenVPN client profiles designed to work with current RouterOS v7 .ovpn import functionality. If your VPN profile uses unsupported directives, RouterOS may ignore them or require manual adjustment according to the official MikroTik documentation.

✅ Verify VPN Connection

After successfully connecting to your VPN, verify that your traffic is actually routed through the encrypted tunnel.

🌍 Check Your Public IP Address

Linux / macOS

curl ifconfig.me

or

curl https://icanhazip.com

Windows (PowerShell)

curl ifconfig.me

or

Invoke-RestMethod https://icanhazip.com

Verify

The returned public IP address should be your VPN server’s public IP address, not your local ISP’s address.

🌐 Check Your Location

Visit one of the following websites:

Verify:

🛡️ Test for DNS Leaks

Visit https://dnsleaktest.com or https://browserleaks.com/dns

Expected result

🌍 Test IPv6

If your VPN server supports IPv6, verify that IPv6 traffic is also routed through the VPN.

Visit https://test-ipv6.com

Expected

🔐 Verify the VPN Tunnel

Check your routing table.

Linux

ip route

IPv6

ip -6 route

macOS

netstat -rn

Windows

route print

The default route should point to the VPN tunnel when full-tunnel mode is enabled.

📊 Verify DNS Resolution

Linux / macOS

dig openvpn.net

or

nslookup openvpn.net

Windows

nslookup openvpn.net

DNS queries should succeed using the DNS server provided by your VPN configuration.

🔍 Verify VPN Interface

Linux

ip addr

Look for tun0 or tun1

macOS

ifconfig

Look for utun

Windows

ipconfig

Look for an OpenVPN TAP Adapter or OpenVPN Data Channel Offload Adapter depending on the installed client.

🚨 Troubleshooting

Authentication Failed

Possible causes

Solution

TLS Handshake Failed

Possible causes

Recommended checks

DNS Leak

Possible causes

Solution

Unable to Import .ovpn

Possible causes

Solution

Connection Drops Frequently

Possible causes

Recommended actions

🔐 Security Best Practices

📚 Additional Resources

📖 Official OpenVPN Documentation

https://openvpn.net/community-resources/

📘 OpenVPN Connect User Guide

https://openvpn.net/connect-docs/

💬 OpenVPN Community

https://forums.openvpn.net/

🐞 Report Issues

If you encounter a bug or have a feature request, please open an issue on GitHub.

https://github.com/alsyundawy/OpenVPN-Install/issues

⭐ Support the Project

If this project has helped you, please consider:

Your support helps improve this project for the entire OpenVPN community.

[!TIP]

Always download VPN client software from the official vendor, keep your .ovpn profile private, and periodically verify your public IP address, DNS servers, and routing after connecting to ensure all traffic is passing through the VPN tunnel as expected.

Key Features

Extended DNS Options

🔍 The script offers 36 pre-configured resolvers alongside system defaults and custom inputs:

  1. 🏠 Local Resolver:
    • Local Unbound (Local caching resolver with DNSSEC)
  2. 🌍 Global Anycast Resolvers:
    • Google Public DNS (Standard & IPv6)
    • Cloudflare DNS (Standard, Security-filtered, or Family-filtered)
    • Quad9 DNS (Secure, Unsecured, or ECS-supported)
    • OpenDNS (Home or FamilyShield)
  3. 🗺️ Region-Specific & Alternative Resolvers:
    • AliDNS, DNSPod, 114DNS, Baidu DNS, OneDNS, DNSPai
    • CleanBrowsing (Security, Adult, or Family filters)
    • Verisign, DNS.WATCH, Yandex (Basic, Safe, or Family)
    • Level3/Lumen, Neustar (Default, Threat, or Family)
    • Oracle Dyn, Alternate DNS, Comodo Secure DNS, Freenom World
  4. ⚙️ Custom Input:
    • Accepts multiple comma/space-separated IPv4 and IPv6 addresses.

⚡ The script presents 37 DNS choices during setup:

# Provider Primary Notes
1 Local Unbound 172.16.200.1 DNSSEC + DNS rebind protection
2 Current system resolvers — Parsed from /etc/resolv.conf
3 Google 8.8.8.8 IPv4 + IPv6
4 Cloudflare Standard 1.1.1.1 IPv4 + IPv6
5 Cloudflare Security 1.1.1.2 Malware filtering
6 Cloudflare Family 1.1.1.3 Adult content filtering
7 Quad9 Secure 9.9.9.9 Threat blocking
8 Quad9 Unsecured 9.9.9.10 No filtering
9 Quad9 ECS 9.9.9.11 ECS-enabled
10 OpenDNS Home 208.67.222.222 IPv4 + IPv6
11 OpenDNS FamilyShield 208.67.222.123 Family filter
12 AdGuard Default 94.140.14.14 Ad blocking + IPv6
13 AdGuard Family 94.140.14.15 Family filter
14 AdGuard Non-Filtering 94.140.14.140 No filtering
15 AliDNS 223.5.5.5 IPv4 + IPv6
16 DNSPod 119.29.29.29 —
17 114DNS 114.114.114.114 —
18 Baidu DNS 180.76.76.76 —
19 OneDNS 117.50.10.10 —
20 DNSPai 101.226.4.6 —
21 CleanBrowsing Security 185.228.168.9 IPv4 + IPv6
22 CleanBrowsing Adult 185.228.168.10 IPv4 + IPv6
23 CleanBrowsing Family 185.228.168.168 IPv4 + IPv6
24 Verisign 64.6.64.6 —
25 DNS.WATCH 84.200.69.80 IPv4 + IPv6
26 Yandex Basic 77.88.8.8 IPv4 + IPv6
27 Yandex Safe 77.88.8.88 Malware filtering
28 Yandex Family 77.88.8.7 Family filter
29 Level3 / Lumen 209.244.0.3 —
30 Neustar Default 156.154.70.1 IPv4 + IPv6
31 Neustar Threat Protection 156.154.70.5 IPv4 + IPv6
32 Neustar Family Secure 156.154.70.3 —
33 Oracle Dyn 216.146.35.35 —
34 Alternate DNS 198.101.242.72 —
35 Comodo Secure DNS 8.26.56.26 —
36 Freenom World DNS 80.80.80.80 —
37 Custom resolvers User-defined IPv4 and/or IPv6

[!TIP] Option 1 (Local Unbound) is recommended for maximum privacy — it resolves DNS recursively on the server itself with DNSSEC validation and 0x20 encoding anti-spoofing.

Post-Installation Management

🔧 Run the script again at any time to access the administrative menu:

sudo bash openvpn-install.sh

OpenVPN is already installed.

Select an option:
   1) Add a new client
   2) Renew client configuration
   3) Revoke an existing client
   4) List client certificates
   5) List connected clients
   6) Remove OpenVPN
   7) Exit
📋 Menu Option 🛠️ Action Description
Add a new client Validates name uniqueness, signs a new key pair, and generates the .ovpn profile atomically.
Renew client configuration Regenerates the .ovpn file for an existing client without changing the certificate or key.
Revoke an existing client Revokes the certificate with [y/N] confirmation, performs atomic CRL replacement, and removes the .ovpn file.
List client certificates Displays all active (non-revoked) client certificate names from the PKI index.
List connected clients Reads the OpenVPN status log or falls back to ss to show active VPN sessions.
Remove OpenVPN Gracefully removes firewall rules (IPv4+IPv6 SNAT), SELinux labels, Unbound config, systemd services, PKI, and calls daemon-reload.

Security Hardening Defaults

Changelog

🆕 [v2.0.3] - 2026-08-03

🚀 [v2.0.2] - 2026-07-25

🛠️ [v2.0.1] - 2026-07-19

🎉 [v2.0.0] - 2026-07-19

📌 [v1.x] - Legacy

Support and Donation

☕ If this project helps secure your network, please support the continued maintenance of the installer:

Nyr (Original Creator)

alsyundawy (Version Maintainer)

🇮🇩 Scan QRIS (GoPay, OVO, Dana, LinkAja, Mobile Banking)

QRIS Donation

License

📄 This project is licensed under the terms of the MIT License.

Alt

This site is open source. Improve this page.