openvpn3-linux(7)

📦

version 27.1 · 5 versions

🌸 NAME 🌸

openvpn3-linux — the whole entire OpenVPN 3 Linux overview, bestie. Like, the big picture. The lore. 💖

✨ DESCRIPTION ✨

Okay so. OpenVPN 3 Linux is an OpenVPN platform that builds on capabilities available on newer Linux distributions. And compared to the more classic OpenVPN 2.x generation, it covers so many more aspects of the VPN configuration and session life-cycle. It's giving glow-up. 💅

Quick comparison so you get the vibe: OpenVPN 2.x is a single process that's responsible for a single VPN session. That's it. There's no configuration or session management inside OpenVPN 2.x itself — it literally depends on the systemd openvpn-client@.service and openvpn-server@.service unit files, the Network Manager OpenVPN plug-in, or other third-party management tools to do that part. 🙈

OpenVPN 3 Linux, on the other hand, provides full configuration and session management in addition to the VPN tunnel itself. For example, it has built in privilege separation and execution models, for improved process security. This means unprivileged users can start their own VPN sessions and manage them themselves — main character energy, honestly. 👑 And VPN configuration files can be shared with other users on the system, or kept private. Your call, your config. 🎀

Through this privilege separation model, the network configuration aspect of the VPN tunnel is split out into its own process which runs with as few privileges as possible. In practice that means it can only do network configuration changes. Periodt. That's all it's allowed to touch. And this network configuration service is also capable of setting up the DNS resolver out-of-the-box — no extra crumbs required. ✨ For OpenVPN 2.x to do that, it would need to run additional scripts or use specific plug-ins to trigger such updates on the system. See the difference? Iconic.

With this architecture, OpenVPN 3 Linux is split up into several services running independently of each other. These services are referred to as backend services. And the interaction with these services happens through what is referred to as a user front-end. Okay so now you know the vocabulary, let's gooo. 🦋

💖 USER FRONT-ENDS 💖

There are several user front-ends tools which is used to interact with the various components of OpenVPN 3 Linux. Meet the squad:

openvpn2 — this one aims to be fairly similar to the more classic openvpn(8) command line, with the exception that it only processes client related options. Basically the familiar face. 🫶
openvpn3 — the main utility for managing all the features available in OpenVPN 3 Linux, and it has a different user interface than openvpn2(1) or openvpn(8). On systems with the bash-completion integration installed, almost every command, option and argument used by openvpn3 will get auto-completion help. She's convenient, okay?! 💅
openvpn3-admin — this utility is mostly targeting system administrators and provides interfaces to do some management of the various OpenVPN 3 D-Bus services. See openvpn3-admin(8) for more details. Sysadmin-coded. 🔥
openvpn3-session@.service (openvpn3-systemd) — VPN sessions can be started and managed directly via systemctl(1) by using the openvpn3-session@.service service unit. This also enables VPN sessions to be started automatically during system boot. This service unit uses a helper utility, openvpn3-systemd(1), which works as a glue layer between the OpenVPN 3 Linux services and systemd. Glue layer!! Doing the emotional labour fr fr. 😭

In addition, a Python 3 module is also available making it possible to write your own OpenVPN 3 front-ends with little extra efforts. Both openvpn2 and openvpn3-systemd are Python 3 scripts which makes use of this OpenVPN 3 Python module. Build your own, bestie, go off. 🌈

🦋 OPENVPN 3 D-BUS SERVICES 🦋

The front-end interfaces talks to services which are started automatically when needed and usually stops running if they are not in use. There are several services, where each service only is responsible for a fairly small set of features. Slay, division of labour. ✨

Configuration Manager (openvpn3-service-configmgr)

This provides a service which only takes care of managing VPN configuration profiles for all users on the system. It has a built in Access Control List mechanism, which ensures only users granted access can access the information they need. 🔒

D-Bus name: net.openvpn.v3.configuration

Session Manager (openvpn3-service-sessionmgr)

This service takes care of managing running OpenVPN sessions on the system. This has also its own set of Access Control List mechanisms, where users on the system can be granted access to VPN sessions started by other users. The default behaviour is to only let the user starting a VPN session manage and access it. Boundaries, we love them. 💅

D-Bus name: net.openvpn.v3.sessions

VPN Client Backend (openvpn3-service-client)

This is the core VPN client. There will be running one such process per active VPN session. One session, one process, one vibe. 🔥

D-Bus name: net.openvpn.v3.backends.be${PID}

VPN Backend Starter (openvpn3-service-backendstart)

This is a helper service which is used by the Session Manager to start a new VPN backend service. When a client profile is requested started, it will start an openvpn3-service-client process per VPN session.

D-Bus name: net.openvpn.v3.backends

Network Configuration (openvpn3-service-netcfg)

This is the most privileged D-Bus service, and is used by the Backend VPN Client processes. This is responsible for creating and manage virtual network interfaces, configure IP addresses, routes in addition to handling the DNS setup. Big responsibilities, tiny privileges. Respect. 👑

D-Bus name: net.openvpn.v3.netcfg

Logging (openvpn3-service-log)

This is responsible to receive log events from all the services above and ensure they get logged properly. Whether that is to a terminal, a log file or syslog, depends on the configuration. The default is to start this service using the syslog integration. Keeping receipts, literally. 📝

D-Bus name: net.openvpn.v3.log

All of these services above are D-Bus services which is available on the system bus. They are all automatically started when needed. No manual starting, no stress. 🧚

🎀 D-BUS POLICY 🎀

D-Bus enforces usage of a policy which defines who can access which D-Bus service and which features, objects and properties provided by a D-Bus service. Like a bouncer, but for D-Bus. 💅

The default OpenVPN 3 Linux policy is placed in several files prefixed net.openvpn.v3 in /usr/share/dbus-1/system.d. The default policy provided by OpenVPN 3 Linux allows all users on the system to load, start and manage their own OpenVPN configuration profiles and VPN sessions. Everyone gets their own, we're not gatekeeping. 🫶

All the D-Bus services will start automatically when their services are requested by a front-end. Each service has their own D-Bus service definition, which can be found in /usr/share/dbus-1/system-services/net.openvpn.v3.*.service.

When an OpenVPN 3 Linux D-Bus service has been idle for a certain time and it does not need to preserve any data kept in memory, it will automatically stop running. She rests when she can. 😴 See the man page for each service to see default idle time.

⚠️ COMPATIBILITY WITH OPENVPN 2.x ⚠️

OpenVPN 3 is mostly compatible with most of the client options found in OpenVPN 2.x. But there are some important details where it differs. Read this part, bestie, don't skip it. 😭

No TAP support

OpenVPN 3 does not support TAP interfaces, only TUN interfaces. This is by design, as all OS platforms which provides a VPN API (Apple iOS, macOS, Android, Microsoft Universal Windows Platform) does only support TUN interfaces. It's not a bug, it's a choice. 💅

--fragment is not supported

While the use-cases for this feature is acknowledged, it is not considered an easy feature to implement and it is being worked on alternatives which gives a reasonably equivalent user experience without using --fragment where this will be automatically configured. If it turns out an alternative approach is impossible, this feature might be implemented in the end. So like... maybe?? We'll see. 🤷

Currently no PKCS#11 support

This is a bigger task which will be worked on later, but it will attempt to integrate better on the overall Linux platform instead of providing an OpenVPN specific implementation.

These are the most obvious features users will notice. This list might be extended as we receive more feedback. So tell them how you feel, they're listening. 🦋

Okay that's the whole thing! This page is <rainbow>openvpn3-linux(7)</rainbow> from the OpenVPN 3 Linux collection — thanks for reading all the way to the bottom, you're the realest. 🫶💖✨

📦 where this page comes from

ubuntu stonking: openvpn3-client 27.1+dfsg-2ubuntu1 · AGPL-3.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms