February 1, 2016

OpenVPN Client/Server config for iOS devices

OpenVPN Client/Server config for iOS devices

This should get you started configuring a Linux OpenVPN server, creating your own certificate authority and generating certificates and profiles for use with Apple iOS devices like the iPad and iPhone.

The following script will generate a .ovpn profile that can be imported straight into the OpenVPN iOS app.

You will need to perform the steps as the root user or execute the commands using sudo.

Create certificate authority and client certs

For this we'll use easy_rsa that should be installed as part of your distributions OpenVPN install.

These instructions were written with the server being an Ubuntu installation, paths may need to be adjusted to suit your distribution.

mkdir /etc/openvpn/easy-rsa/


export KEY_CITY="Winston-Salem"
export KEY_ORG="Example Company"
export KEY_EMAIL="[email protected]"
export KEY_CN=MyVPN
export KEY_OU=MyVPN


cd /etc/openvpn/easy-rsa/
source vars
Server Certificates


./build-key-server myservername

As in the previous step, most parameters can be defaulted. Two other queries require positive responses, "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]".

Diffie Hellman parameters must be generated for the OpenVPN server:


All certificates and keys have been generated in the subdirectory keys/. Common practice is to copy them to /etc/openvpn/:

cd keys/
cp myservername.crt myservername.key ca.crt dh2048.pem /etc/openvpn/
Client Certificates

The VPN client will also need a certificate to authenticate itself to the server. Usually you create a different certificate for each client. To create the certificate, enter the following in a terminal while being user root:

cd /etc/openvpn/easy-rsa/
source vars
./build-key client1

Now that you have generated server and client certificates its time to configure the server


port 1194
proto udp
dev tun
# Server CA and certificate
ca ca.crt
cert myservername.crt
dh dh2048.pem
# Hand out IPs
# make sure clients know to use this route
push "route"
ifconfig-pool-persist pp.txt
# Allow clients to see each other
keepalive 30 120
user nobody
group nogroup
status openvpn-status.log
verb 3

You should now be able to start the OpenVPN server.

Before you can connect your iOS device you need to generate a .ovpn file that contains the certificates for your client and some additional configuration options.

Create the following script and then use it to generate a .ovpn file.


CA=$(< ${KEYSTORE}/ca.crt)
CERT=$(< ${KEYSTORE}/${NAME}.crt)
KEY=$(< ${KEYSTORE}/${NAME}.key)

cat > ${OUTPUT} << __EOF__
dev tun
proto udp
remote vpn.host.com 1194
# other options (mostly defaults)
user nobody
group nogroup
resolv-retry infinite

Usage ./create-ovpn-profile client1

The generated .ovpn file can then be copied to the device and imported into the OpenVPN app.

For more information see the OpenVPN iOS FAQ