How to Configure OpenVPN on Ubuntu

OpenVPN has been around for a long time, and that age shows in a good way: nearly every VPN provider and every self-hosted setup can give you an OpenVPN profile, and Ubuntu can use it with a single package. The price of that flexibility is a configuration file with many options, a log full of unfamiliar phrases, and a couple of Ubuntu-specific details about DNS that trip up newcomers.

This guide takes one thing, a ready-made .ovpn profile, and shows how to make it work properly on Ubuntu. It covers a first test run, safe handling of credentials, running OpenVPN as a service, DNS, the desktop option, and a table that translates common log lines into actions. It does not explain how OpenVPN works internally; our article on OpenVPN explained does that. It also does not compare it with newer protocols; see WireGuard vs OpenVPN. If you are an XPASS customer, the supported route is the free VPNclient app with the login on your My Pass page, described in the Linux help guide; the steps here are for people holding an OpenVPN profile of their own.

Command line or desktop: choose your route

Ubuntu gives you two main ways to run OpenVPN. Pick one and stay with it, because mixing them is a common source of confusion.

Route	Best for	Strengths	Weak spots
openvpn command in a terminal	Testing, servers, troubleshooting	Shows the full log, no extra packages	You manage DNS and startup yourself
systemd service (openvpn-client@name)	Headless machines, always-on tunnels	Starts at boot, restarts on failure	Starts before Wi-Fi on some laptops
NetworkManager plug-in	Ubuntu desktop and laptops	Tray icon, handles roaming, stores credentials in the keyring	Less detailed logs, needs an extra package

A sensible workflow for most people: test with the plain command first, because the log tells you what is wrong. Once it works, move to the systemd service or to NetworkManager, depending on whether the machine is a server or a laptop.

Install OpenVPN and read your profile

Install the client from the standard repositories.

sudo apt update
sudo apt install openvpn
openvpn --version

Next, look at your .ovpn file before you run it. It is plain text, so open it in an editor. You will usually find lines like these.

• client tells OpenVPN to act as a client rather than a server.
• dev tun requests a routed tunnel interface.
• proto udp or proto tcp chooses the transport; our article on UDP versus TCP in OpenVPN explains the trade-off.
• remote host port names the server and the port.
• auth-user-pass means it will ask for a username and password.
• remote-cert-tls server makes the client check that the server's certificate is meant for a server.
• ca, cert, key or tls-auth blocks hold certificates and keys. They may be separate files or sit inline between tags.
• verb 3 sets log detail.

Do not edit what you do not understand. A single changed cipher or certificate line is enough to stop the handshake. If you need a copy to experiment with, make one first with cp profile.ovpn profile-test.ovpn.

The first run, in the foreground

Run the profile directly so that you can see everything it prints.

sudo openvpn --config ~/Downloads/profile.ovpn

If the profile uses auth-user-pass, OpenVPN asks for a username and then a password. Type them carefully; the password is not echoed. Watch the output for these milestones.

1. Resolving or connecting to the server. If it cannot resolve the host name, your base internet or DNS is the problem.
2. TLS handshake. Lines about verifying the certificate should end without an error.
3. A line mentioning Initialization Sequence Completed. That is OpenVPN's way of saying the tunnel is up.
4. A new interface called tun0. Check with ip addr show tun0.

While it is running, open a second terminal and test traffic. Try ping -c 3 to a well-known address, then load a website. Read how to check if your VPN is working for a full test routine. Stop the tunnel by pressing Ctrl+C in the first terminal.

Keeping credentials out of the way, safely

Typing a password each time is safe but tedious, and it prevents unattended starts. The usual alternative is a small credentials file.

sudo nano /etc/openvpn/client/credentials.txt

Put the username on line one and the password on line two, then lock the file down.

sudo chown root:root /etc/openvpn/client/credentials.txt
sudo chmod 600 /etc/openvpn/client/credentials.txt

Then change the line in your profile to auth-user-pass /etc/openvpn/client/credentials.txt.

Be honest about the trade-off. The file protects against casual reading but not against someone with root access or a stolen disk. If the machine is shared, or if your disk is not encrypted, prefer typing the password, or use the desktop route where the password is held by the system keyring. Never store the password in the profile itself, and never commit either file to a repository. If you ever suspect it leaked, change the VPN password at once on the account page.

Run OpenVPN as a service

For a tunnel that starts by itself, Ubuntu ships a systemd template unit. It expects the profile in a particular folder with a .conf extension.

sudo cp ~/Downloads/profile.ovpn /etc/openvpn/client/work.conf
sudo systemctl start openvpn-client@work
sudo systemctl status openvpn-client@work

The word after the @ is the file name without .conf. To start at boot, add:

sudo systemctl enable openvpn-client@work

To read the log of the running service:

sudo journalctl -u openvpn-client@work -f

Two warnings. A service that starts before the network is ready may fail on a laptop, so test a reboot with and without Wi-Fi. And if the profile references certificate files by relative path, copy those files into the same folder or switch them to absolute paths, because the service does not run from your home directory.

DNS: the Ubuntu detail that surprises people

Many providers push DNS servers to the client. The OpenVPN client only receives that information; it does not apply it by itself. On Ubuntu, which uses systemd-resolved in most editions, you need a helper script.

sudo apt install openvpn-systemd-resolved

Then add these lines to your profile:

script-security 2
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
down-pre
dhcp-option DOMAIN-ROUTE .

The script-security 2 line allows OpenVPN to run external scripts. Only enable it for profiles you trust, because it lets the profile execute programs on your machine. After connecting, verify with:

resolvectl status

You should see the tunnel interface listed with the DNS servers from the profile. If your normal Wi-Fi DNS is still first for all names, lookups may leave the tunnel. The article on DNS leaks shows how to test. For background on what DNS does, Cloudflare publishes a plain explanation of DNS.

The NetworkManager route on a desktop

For laptops, the desktop plug-in is friendlier.

sudo apt install network-manager-openvpn-gnome
sudo nmcli connection import type openvpn file ~/Downloads/profile.ovpn
nmcli connection up profile

After the import, the tunnel appears in the network menu, and NetworkManager asks for the username and password and can save them in the keyring. It also handles DNS for you, which removes the whole script step. If a profile contains options the plug-in does not understand, the import may fail or drop them; in that case, fall back to the command line.

Reading the log: common errors and what to do

Log phrase	Likely meaning	What to try
AUTH_FAILED	Wrong username or password, or an expired account	Retype carefully, check the account, use VPN credentials
TLS handshake failed or TLS key negotiation failed	Packets are not reaching the server or are not answered	Check network, try another network, try the other protocol if the profile offers it
Cannot resolve host address	No DNS before the tunnel	Test plain browsing, check the host name in the profile
VERIFY ERROR or certificate verify failed	Certificate does not match, or the clock is off	Check timedatectl, re-download the profile
Cannot open TUN/TAP dev	Not run with enough rights	Use sudo
Options error	A line in the file is malformed	Read the line number in the message
Connected, but pages do not load	DNS or routing	See the DNS section, test by raw address
Keeps restarting	Network drops or keepalive timeout	Try a more stable network, check the log timestamps

Note the time in the log. Time-sensitive certificates and handshakes break if the system clock is far off. If you lose speed after it works, the guide on OpenVPN performance tuning explains what is worth changing and what is not.

Habits, limits and safe defaults

• Trust the profile source. A profile can run scripts and set routes. Use files only from providers or administrators you trust, and do not download them from random forums.
• Keep the default cipher and protocol settings unless support tells you to change them.
• Do not run two VPNs at once. Two tunnels fight over routes and DNS.
• Know your threat. OpenVPN encrypts the path to the VPN server. It does not stop phishing, malware or account theft, as described in what a VPN cannot protect you from.
• Restart after big updates. Kernel and library updates sometimes need a reboot before the tunnel behaves.
• Remove old profiles from /etc/openvpn/client/ when you stop using a provider, along with credential files.

Two short examples show how this plays out. A student with an Ubuntu laptop imports the profile into NetworkManager, types the password once and lets the keyring remember it; when the dorm Wi-Fi drops and returns, the tunnel reconnects without a terminal. A hobbyist with a small home server runs the profile as openvpn-client@home, reads the journal after each reboot for a week, and only then trusts it to start unattended. Both did the same first step: they ran the profile once by hand and read what it said.

Summary

To use OpenVPN on Ubuntu, install the package, inspect your .ovpn profile and run it once in the foreground so you can read the log. Store credentials only in a root-owned file with tight permissions, or type them. Use openvpn-client@name for a background service or the NetworkManager plug-in on a laptop, and add the systemd-resolved helper script when DNS needs handling. When something fails, the log phrase tells you which layer to inspect.

If a ready-to-use app suits you better than editing profiles, the pricing page shows prepaid passes that work with the free VPNclient app.