Customization¶

Client Configuration Template¶

The client .ovpn files are generated from a template at:

/etc/openvpn/server/client-template.txt

You can modify this template to add custom directives that will be included in all new client configurations.

Example: adding a custom route to push:

echo 'route 192.168.10.0 255.255.255.0' >> /etc/openvpn/server/client-template.txt

Server Configuration¶

The main server configuration file is at:

/etc/openvpn/server/server.conf

After modifying server.conf, restart the service:

systemctl restart openvpn-server@server

Common Customizations¶

Client-to-Client Communication¶

Allow VPN clients to communicate with each other directly:

client-to-client

Push LAN Routes¶

Give VPN clients access to the server's local network:

push "route 192.168.1.0 255.255.255.0"

Split Tunnel¶

By default, all traffic is routed through the VPN. To route only specific subnets:

1. Remove push "redirect-gateway" from server.conf
2. Add specific routes:

push "route 10.0.0.0 255.0.0.0"
push "route 172.16.0.0 255.240.0.0"

Custom Push Options¶

push "dhcp-option DOMAIN example.com"
push "dhcp-option SEARCH example.com"

Batch Client Creation¶

Create multiple clients using a loop:

for client in alice bob charlie; do
  sudo ./openvpn-install.sh client add "$client"
done

With password protection:

for client in alice bob charlie; do
  sudo ./openvpn-install.sh client add "$client" --password "$(openssl rand -base64 16)"
done

Port 443 Multiplexing¶

If you need to run OpenVPN on TCP/443 alongside a web server, use a reverse proxy like HAProxy or SSLH to multiplex the port:

SSLH Example¶

apt install sslh

Configure SSLH to listen on port 443 and forward:

• OpenVPN traffic to localhost:1194
• HTTPS traffic to localhost:8443

HAProxy Example¶

frontend https
    bind *:443
    mode tcp
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }

    use_backend openvpn if !{ req.ssl_hello_type 1 }
    default_backend webserver

backend openvpn
    mode tcp
    server openvpn 127.0.0.1:1194

backend webserver
    mode tcp
    server web 127.0.0.1:8443

Logging¶

Custom Log Location¶

sudo ./openvpn-install.sh install --log /var/log/custom-openvpn.log

Disable File Logging¶

Use systemd journal only:

sudo ./openvpn-install.sh install --no-log

View Logs¶

# File log
tail -f /var/log/openvpn/server.log

# Systemd journal
journalctl -u openvpn-server@server -f