Updated: 22 October 2026 · Applies to: OpenBSD, OpenVPN client
OpenVPN creates a secure VPN connection. Here is how to install and configure it as a client on OpenBSD.
Install OpenVPN
Confirm your package mirror is set correctly:
cat /etc/installurl
It should show a URL such as https://cloudflare.cdn.openbsd.org/pub/OpenBSD. Then install OpenVPN:
pkg_add -v openvpn
Add your client configuration
You need a .ovpn client configuration file from your VPN provider. Copy it to OpenBSD, for example over scp:
scp user@your-vpn-server:openbsd.ovpn /etc/openvpn/
Create the directory first if it does not exist:
mkdir /etc/openvpn/
A typical client config file looks like this:
client dev tun proto tcp sndbuf 0 rcvbuf 0 remote 203.0.113.10 443 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server cipher AES-128-CBC comp-lzo setenv opt block-outside-dns key-direction 1 verb 3 <ca> -----BEGIN CERTIFICATE----- ... certificate data ... -----END CERTIFICATE----- </ca> <cert> ... client certificate data ... </cert> <tls-auth> -----BEGIN OpenVPN Static key V1----- ... key data ... -----END OpenVPN Static key V1----- </tls-auth>
Replace 203.0.113.10 with your VPN server's real address, and the certificate/key sections with the actual contents your provider gave you.
Start the tunnel automatically
Create /etc/hostname.tun0:
vi /etc/hostname.tun0
Add this content and save it:
up !/usr/local/sbin/openvpn --daemon --config /etc/openvpn/openbsd.ovpn
OpenBSD re-creates the tun interface at boot and starts OpenVPN from this file automatically; no reboot is needed for a one-off test, since you can also bring it up directly:
/usr/local/sbin/openvpn --daemon --config /etc/openvpn/openbsd.ovpn
Verify the connection
ifconfig tun0 netstat -nr netstat -nr -f inet | more
Check that you can reach the VPN gateway and the wider internet through the tunnel:
ping 10.8.0.1 ping google.com host example.com 10.8.0.1
Finally, confirm your public IP address has changed to the VPN server's address:
dig +short myip.opendns.com @resolver1.opendns.com
or:
host myip.opendns.com resolver1.opendns.com
Either command should return your VPN server's public IP, not your OpenBSD machine's own IP, confirming the tunnel is carrying your traffic.
