41

I'm trying to get OpenVPN to start automatically at boot. Today I have to manually type in 

sudo openvpn --client --config $HOME/openvpn/anonine.ovpn --ca $HOME/openvpn/anonine.ca.crt

followed by username and password. Is there a good way to make this automatic at boot?

famousgarkin
  • 103
user280409
  • 411

6 Answers6

50

Edit /etc/default/openvpn. Just press Ctrl+Alt+T on your keyboard to open Terminal. When it opens, run the command(s) below:

sudo gedit /etc/default/openvpn

Uncomment the AUTOSTART="all" line. Save and close. Reboot your system.

image

techraf
  • 3,316
Mitch
  • 107,631
  • 2
    (i) How can one start a specific VPN that way? (ii) Who supplies authentication for a connection initiated in this way (can it initiate connections without the username-password combination being stored in plain text)? (iii) If possible, cli methods are preferable (allows implementation on a headless server). I can substitute nano for gedit, but I can't use nm-applet to store credentials in the keyring. – Jonathan Y. Dec 10 '14 at 21:40
  • @JonathanY. Take a look at these available resources, Here, and Here. You may also want to consider asking a new question. – Mitch Dec 11 '14 at 06:16
  • 7
    Much obliged. As far as I can tell the answer to (i) (which is well within the scope of this question) is that AUTOSTART="all" attempts to start every .conf file in /etc/openvpn (I'd love to have confirmation, though). An answer to (ii) is also reasonably scoped withing this question--you can't automatically initiate a VPN connection unless the secrets are available without user input (keychain being preferable to plain-text for obvious reasons). I admit that (iii) is extracurricular and might well merit a new question. None of them are answered in these links, that I can see, though. – Jonathan Y. Dec 11 '14 at 12:46
  • As the comment in the picture states, the default for AUTOSTART is actually "all". This edit is consequently not needed, in my opinion. – BxlSofty Jan 23 '17 at 17:18
  • 1
    @YvesB Default is "all" only when AUTOSTART is uncommented and empty – GuSuku Feb 24 '17 at 04:23
  • 1
    systemctl daemon-reload instead of reboot – yosefrow Jul 30 '18 at 07:14
15

If you're on systemd (16.04) , configured AUTOSTART="all" and it's still not starting pay attention to this:

> # If you're running systemd, changing this variable will
> # require running "systemctl daemon-reload" followed by
> # a restart of the openvpn service (if you removed entries
> # you may have to stop those manually)

Just do a 

systemctl daemon-reload

and then restart the service

 sudo service openvpn restart
Erb
  • 281
  • 2
  • 6
11

You can put auth-user-pass filename in your anonine.ovpn where filename is the file with username/password on 2 lines.

Make sure that filename is properly secured, because it will contain plain username/password.

This is from openvpn --help:

Client options (when connecting to a multi-client server):

--auth-user-pass [up] : Authenticate with server using username/password.
                  up is a file containing username/password on 2 lines,
                  or omit to prompt from console.

You also can add your certificate to your anonine.ovpn adding it this way:

<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
techraf
  • 3,316
jstsmn
  • 111
6

If a username / password is not required in order to connect, then rename the .ovpn files to have an extension of .conf.

OpenVPN should connect on boot, even without autostart=all.

If a username/password is required,

edit the .conf file

edit auth-user-pass user-password-filename

Create a file containing:

username
password

If you want to connect with Network Manager, make sure you first do:

sudo apt-get install network-manager-openvpn

Make sure your Ubuntu is at least 14.04. This doesn't work on 12.04.

If you don't have your ca.crt, client.crt, etc, extract them from .conf.

With Network Manager, create a new VPN connection or import your conf.

Add the certificates and ta.key.

Routes, use connection only for resources on its network.

Edit your Internet connection with network manager. Choose connect with VPN, then choose your VPN connection.

Zanna
  • 70,465
Yandi Ongkojoyo
  • 61
1

While it might not be of interest to the OP, I was frustrated by this service not starting until login--either graphical, or one of the Ctrl+Alt+F# TTYs. I eventually realized that my machine would only connect to wifi when I logged in. Combining the other answers here with the standard advice to run sudo update-rc.d openvpn defaults, and with the first answer at this other question worked for me. Perhaps this might help another Googler.

tsbertalan
  • 507
  • eventually realized that my machine would only connect to wifi when I logged in. Same issue here! – Shayan Dec 02 '20 at 21:11
0

For me the

auth-user-pass filename

did not work

use

askpass /etc/openvpn/filename

And only have the password on the top line

It worked and now openvpn starts at boot

commands to check if openvpn is working:

systemctl status openvpn@"your vpn user name"

wget -qO- http://ipecho.net/plain ; echo

to check your ip (it must be different than the external ip of your router)

sudo service openvpn stop

sudo service openvpn start

to check your config without rebooting all the time.

underxristof
  • 1