Skip to content

Customization

Client Configuration Template

The client .ovpn files are generated from a template at:

/etc/openvpn/server/client-template.txt

You can modify this template to add custom directives that will be included in all new client configurations.

Example: adding a custom route to push:

echo 'route 192.168.10.0 255.255.255.0' >> /etc/openvpn/server/client-template.txt

Note

Changes to the template only affect newly generated clients. Existing .ovpn files are not updated.

Server Configuration

The main server configuration file is at:

/etc/openvpn/server/server.conf

After modifying server.conf, restart the service:

systemctl restart openvpn-server@server

Common Customizations

Client-to-Client Communication

New installs: pass --client-to-client to install, which also configures the matching firewall rules. See Network & DNS — Access Policy.

To enable it on an already-installed server without reinstalling, add the directive manually and restart:

client-to-client

Note

Adding the directive manually does not update the firewall rules that --client-to-client would have configured (see Firewall). Whether client-to-client traffic is actually forwarded then depends on your existing firewall setup.

Push LAN Routes

New installs: pass one or more --local-network <CIDR> options to install, which pushes the route and configures destination-scoped NAT and firewall rules automatically. See Network & DNS — Server-Side Network Access.

To give VPN clients access to a network on an already-installed server without reinstalling, push the route manually and restart:

push "route 192.168.1.0 255.255.255.0"

Note

A manually added route does not configure the destination-scoped NAT and firewall rules that --local-network would add — see Firewall. Without matching firewall rules, the LAN host may not accept or return traffic from the VPN subnet.

Split Tunnel

New installs: pass --no-route-internet to install. This skips the default route, IPv6 leak-blocking directives, and DNS push entirely, and combines with --local-network to route only specific server-side networks through the VPN. See Network & DNS — Internet Routing.

To convert an already-installed full-tunnel server manually:

  1. Remove push "redirect-gateway" (and, for IPv6, push "redirect-gateway ipv6" / push "route-ipv6 2000::/3") from server.conf
  2. Add specific routes:
push "route 10.0.0.0 255.0.0.0"
push "route 172.16.0.0 255.240.0.0"

Custom Push Options

push "dhcp-option DOMAIN example.com"
push "dhcp-option SEARCH example.com"

Batch Client Creation

Create multiple clients using a loop:

for client in alice bob charlie; do
  sudo ./openvpn-install.sh client add "$client"
done

With password protection:

for client in alice bob charlie; do
  sudo ./openvpn-install.sh client add "$client" --password "$(openssl rand -base64 16)"
done

Port 443 Multiplexing

If you need to run OpenVPN on TCP/443 alongside a web server, use a reverse proxy like HAProxy or SSLH to multiplex the port:

SSLH Example

apt install sslh

Configure SSLH to listen on port 443 and forward:

  • OpenVPN traffic to localhost:1194
  • HTTPS traffic to localhost:8443

HAProxy Example

frontend https
    bind *:443
    mode tcp
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }

    use_backend openvpn if !{ req.ssl_hello_type 1 }
    default_backend webserver

backend openvpn
    mode tcp
    server openvpn 127.0.0.1:1194

backend webserver
    mode tcp
    server web 127.0.0.1:8443

Logging

Custom Log Location

sudo ./openvpn-install.sh install --log /var/log/custom-openvpn.log

Disable File Logging

Use systemd journal only:

sudo ./openvpn-install.sh install --no-log

View Logs

# File log
tail -f /var/log/openvpn/server.log

# Systemd journal
journalctl -u openvpn-server@server -f