An OpenVPN server for remote devices#

You will end up with an OpenVPN server on the router, a client certificate per device, and a configuration file each device imports. Choose OpenVPN over WireGuard when the devices already have an OpenVPN client, or a policy asks for certificates a single authority issues and can revoke.

Before you start#

The operator role and a licence. Downloading a client's file needs an administrator.
An address the devices can reach the router at from outside: the router's public address, or a host name that follows it — see dynamic DNS.

Step 1 — Add the server#

Protect → OpenVPN → Add instance, and Server.

Name: vtun0 is filled in.
Transport UDP and Listen port 1194, unless something in the way only lets TCP through.
Allow the listen port through the firewall: leave it on.
Client network: 10.8.0.0/24 — clients are given addresses from it. Pick a network used nowhere else on yours.
Routes for clients: the networks clients reach through the tunnel, such as your LAN.
DNS servers for clients: the router's LAN address, if it answers DNS there.
Certificates: Generate, with a name for the certificate authority and one for the server's certificate. The agent makes both; the authority's key stays on the router, where it signs each client later.
TLS key: Encrypt (tls-crypt) and Generate, the defaults.

Continue shows what will be made — the authority, the certificate and the TLS key, with their fingerprints — and Before you apply, anything the server still needs. Add instance, then Apply changes.

Step 2 — Add a client#

Select vtun0. Under Clients:

Address clients connect to: the router's public address or host name. It is remembered for the next client.
New client: laptop, and Add client. The agent signs a certificate for it with the server's authority; the certificate's private key goes into the pending changes without passing through the browser.
Apply changes.

Step 3 — Give the device its file#

As an administrator, select vtun0 again and Download beside laptop. The file, laptop.ovpn, has everything the device needs: the address and port, the ciphers, the authority's certificate, the client's certificate and private key, and the TLS key. Import it into the device's OpenVPN client and connect.

The download is recorded in the audit trail. The file holds the client's private key: send it the way you would send a password, and delete it once the device has it.

Step 4 — Let the tunnel reach the LAN#

Traffic from clients arrives on vtun0 and passes the forward firewall on its way to the LAN. On the Firewall page, accept traffic arriving on vtun0 for the networks clients should reach.

Check it worked#

Select vtun0: Connected clients lists the laptop, the address it connected from, its address in the tunnel, and its traffic. The row in the instance table counts it.

What you see	Almost always
The client times out	The address it connects to, the port, or the input firewall — the server's settings say when the firewall drops the port.
The client reports a TLS error	A file from another server, or a TLS key changed since the file was made. Download it again.
Connected, the LAN does not answer	The forward firewall, or the routes for clients.

A lost device#

Select vtun0, Revoke beside the device, confirm, and apply. The server refuses that certificate from then on — and so the file on the lost device — while every other client keeps working.

Deleting the certificate on the Certificates page is not the same: the server trusts any certificate its authority signed, so a deleted certificate that was never revoked still connects.