How to Install and Configure OpenVPN Server on Windows

OpenVPN is a set of open-source tools that is one of the most popular and lightweight solutions for building a secure corporate VPN network. OpenVPN can connect servers and clients into a single network, including clients behind NAT or firewalls, and can also connect remote office networks. The OpenVPN server can be deployed on any operating system, including Linux, *BSD, and even a standard workstation running a desktop edition of Windows 10 or 11, as well as Windows Server.

This guide provides a detailed walkthrough of how to deploy and configure an OpenVPN server on a Windows computer. We cover all the key aspects, including certificate management, server and client configuration, firewall rules, and configurations involving NAT, routing, and access to private LAN networks. We also explain how to configure an OpenVPN server to route all client internet traffic through the VPN.

We are going to deploy the OpenVPN server in the following environment:

• Corporate (private) LAN: 192.168.123.0/24
• This is the IP address of the Windows computer on which we are deploying the OpenVPN server in a LAN: 192.168.123.10
• IP subnet for VPN clients: 10.1.10.0/24
• OPenVPN port and protocol: UDP 1194
• This is the external (public) IP address or DNS name that OpenVPN clients will connect to: gw.woshub.com (12.13.14.15)

We assume that the Windows computer running the OpenVPN server does not have a public IP address. You need to configure a NAT rule on the external (WAN) interface of the router to forward traffic from port 12.13.14.15:1194/UDP to the OpenVPN server’s IP address on the LAN 192.168.123.10:1194/UDP.

The basic network diagram and IP addressing for a typical OpenVPN solution implementation are presented below:

Before you start, make sure that you can configure a NAT/port forwarding rule on your external router, and that you understand how it works. The configuration is even simpler if your Windows host has a public IP address assigned directly to its network interface, since clients can then connect to the host directly.

How to Install OpenVPN Server on Windows

To deploy an OpenVPN server, you need a computer running Windows 11/10 Pro or Enterprise (installation on the Home edition is also possible, but with some limitations) or a Windows Server 2019/2022/2025 if you are planning to implement a complex VPN configuration involving multiple routing and NAT rules.

Download the OpenVPN Community Edition MSI installer for your version of Windows from the official website. For this guide, I am using OpenVPN-2.7.6-amd64.msi (5.6 MB). The installer includes both the server and client components.

Run the installation. Install the following OpenVPN features:

• OpenVPN Service with documentation and config samples
• Data Channel Offload Driver (this is the optimal driver for Windows in OpenVPN version 2.7 or later)
• OpenSSL Utilities (including EasyRSA 3 script)

Uncheck the OpenVPN GUI installation option (this is a VPN client that is not required on the server). Discard the installation of the TAP-Windows6 driver.

Complete the installation.

Once installation is complete, a new OpenVPN Data Channel Offload network adapter will appear in the network connection control panel (ncpa.cpl). This adapter is disabled if the OpenVPN service is not running.

Generate OpenVPN Encryption Keys and Certificates

OpenVPN uses the OpenSSL open-source library to provide cryptographic functions and perform key exchange. This means that cryptographic keys and certificates must be generated using RSA3 to establish secure communication between the VPN client and server. The Easy-RSA scripts are used to create your local Public Key Infrastructure (PKI), including the Certificate Authority (CA), server and client certificates, and their corresponding private keys.

Open the command prompt and navigate to the easy-rsa directory:

cd "C:\Program Files\OpenVPN\easy-rsa"

You can set the EasyRSA PKI environment variables (this is optional, so you can skip this step). To do this, create a copy of the file:

copy vars.example vars

You can then edit the vars file using any text editor to change the PKI environment settings. For example, I will uncomment and complete the basic DN information fields for the certificates (optional).

set_var EASYRSA_REQ_COUNTRY "DE"
set_var EASYRSA_REQ_PROVINCE "BY"
set_var EASYRSA_REQ_CITY "MUN"
set_var EASYRSA_REQ_ORG "WOSHUB-Com"
set_var EASYRSA_REQ_EMAIL "admin@woshub.com"
set_var EASYRSA_REQ_OU "IT dept"

Or you can set certificate expiration dates:

set_var EASYRSA_CA_EXPIRE 3650
set_var EASYRSA_CERT_EXPIRE 825

Save the file and run the command:

EasyRSA-Start.bat

All of the following commands must be run in the EasyRSA shell:
Initialize PKI:

./easyrsa init-pki

You should see this message:

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: C:/Program Files/OpenVPN/easy-rsa/pki

Then generate the root Certificate Authority (CA):

./easyrsa build-ca

Set a CA password (type twice):

CA creation is complete and you may now import and sign cert requests.

The above command has generated:

• A root certificate of the Certification Authority: C:\Program Files\OpenVPN\easy-rsa\pki\ca.crt
• A Certification Authority private key: C:\Program Files\OpenVPN\easy-rsa\pki\private\ca.key

Then generate a certificate request and a key for your OpenVPN server:

./easyrsa gen-req server nopass

The tool will generate two files:

req: C:/Program Files/OpenVPN/easy-rsa/pki/reqs/server.req
key: C:/Program Files/OpenVPN/easy-rsa/pki/private/server.key

Sign the request file to issue a server certificate using your CA:

./easyrsa sign-req server server

Confirm the data by typing yes.

Then enter the CA password for your root CA.

The server.crt file will appear in the issued folder (C:\Program Files\OpenVPN\easy-rsa\pki\issued\server.crt).

Then you can generate Diffie-Hellman keys (takes a long time):

./easyrsa gen-dh

Enabling the tls-crypt option in OpenVPN 2.6/2.7 provides additional protection for the TLS control channel (the tls-auth option was previously used). To generate an additional pre-shared static secret key for OpenVPN, run the following command from a regular Command Prompt

cd "C:\Program Files\OpenVPN\bin"

./openvpn --genkey secret tc.key

A key file should appear C:\Program Files\OpenVPN\bin\tc.key

Now you can generate the keys for OpenVPN clients. Each client that connects to your server should have its own unique key pair (private key and certificate).

There are several ways to generate OpenVPN keys and distribute them to clients. In the following example, we will generate and sign a client certificate for a client named testuser1 and protect its private key with a password (PEM passphrase):

./easyrsa build-client-full testuser1

Copy the key file (C:\Program Files\OpenVPN\easy-rsa\pki\private\testuser1.key) to the client computer and tell the user the password (voice, email, SMS). The client can disable the password protection for the key:

openssl rsa -in "C:\Program Files\OpenVPN\easy-rsa\pki\private\testuser1.key"-out "C:\Program Files\OpenVPN\easy-rsa\pki\private\testuser1_use.key"

If you want to generate a key that is not password protected, add the nopass option:

./easyrsa build-client-full testuser1 nopass

You may create any number of keys and certificates for users on your VPN server. Generate private keys and certificates for other clients in the same way.
Therefore, we have generated a set of keys and certificates for the OpenVPN server and one client. Now you can configure and run the OpenVPN service on a server machine.

OpenVPN Server Configuration File for Windows

By default, OpenVPN server settings are stored in the C:\Program Files\OpenVPN\config-auto\server.ovpn configuration file. Either create a new plain text file with this name, or copy the OpenVPN server configuration file template.

copy "C:\Program Files\OpenVPN\sample-config\server.ovpn" "C:\Program Files\OpenVPN\config-auto\server.ovpn"

Copy the following key and certificate files to the C:\Program Files\OpenVPN\config-auto directory on the server:

• ca.crt from C:\Program Files\OpenVPN\easy-rsa\pki
• dh.pem from C:\Program Files\OpenVPN\easy-rsa\pki
• server.crt from C:\Program Files\OpenVPN\easy-rsa\pki\issued
• server.key from C:\Program Files\OpenVPN\easy-rsa\pki\private
• tc.key from C:\Program Files\OpenVPN\bin\

Open the server.ovpn file in any text editor and configure your OpenVPN server settings. Here is an example of a basic OpenVPN server config file:

# Specify a port, a protocol and a device type
port 1194
proto udp
dev tun
# Server certificates and private keys
ca ca.crt
cert server.crt
key server.key
dh dh.pem
# Pre-shared static key to encrypt and authenticate the TLS control channel
tls-crypt tc.key
# Specify the IP network settings (i.e. the IP address pool) from which VPN clients will receive addresses. You can add DHCP address reservations for clients to the specified text file
server 10.1.10.0 255.255.255.0
ifconfig-pool-persist dhcp_reservations.txt
# If you want to allow your clients to connect using the same key, enable the duplicate-cn option (not recommended)
# duplicate-cn
# Cryptography settings (modern ciphers only):
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
data-ciphers-fallback AES-256-GCM
# Disconnect inactive clients
keepalive 20 60
persist-key
persist-tun
# logs
log-append server.log
status openvpn-status.log
verb 3
mute 20

Save the file.

Open the specified OpenVPN port on the server’s firewall. You can open the port in Windows Firewall using PowerShell:
New-NetFirewallRule -DisplayName "AllowOpenVPN-In" -Direction Inbound -Protocol UDP –LocalPort 1194 -Action Allow

Also, enable OpenVPN clients to check the Windows host’s availability via ICMP

Set-NetFirewallRule -Name CoreNet-Diag-ICMP4-EchoRequest-In -enabled True -RemoteAddress 10.1.10.0/24

Then run the OpenVPN service and change its startup type to automatic. Use PowerShell to enable the service:

Set-Service OpenVPNService –startuptype automatic –passthru
Get-Service OpenVPNService| Start-Service

Open the Network Connections panel and make sure that the OpenVPN Data Channel Offload virtual network adapter is enabled. If not, check the log file C:\Program Files\OpenVPN\log\server.log.

Options error: In C:\Program Files\OpenVPN\config-auto\server.ovpn:1: Maximum option line length (256) exceeded, line starts with…

Enable IP Routing and NAT for VPN Traffic in OpenVPN

The configuration described above allows remote clients to access only the OpenVPN server itself and the services running on it. VPN clients cannot access other computers and services on the server’s local area network (LAN).

To allow OpenVPN clients to access the entire private network where the server is located, as well as other networks that can be reached via the server, you need to add routes for the IP networks that should be accessible to VPN clients to the OpenVPN server configuration file (server.ovpn). These routes will be added to the client’s routing table when the VPN connection is established.

push "route 10.1.10.0 255.255.255.0"
push "route 192.168.123.0 255.255.255.0"

You can assign specific DNS server addresses to clients for name resolution within the OpenVPN network.

push "dhcp-option DNS 192.168.13.11"
push "dhcp-option DNS 192.168.13.12"

To route all client requests (including Internet traffic) to your OpenVPN server, add the following option:

push "redirect-gateway def1"

In this configuration, when the client accesses the Internet, all its traffic will be forwarded through the VPN server.

Enable the IPEnableRouter option in the registry (enables IP routing in Windows, including routing between Hyper-V networks, and allows you to use port-forwarding):

reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v IPEnableRouter /t REG_DWORD /d 1 /f

Enable IP packet forwarding. This allows Windows to forward packets between network interfaces rather than dropping non-local packets:

Set-NetIPInterface -Forwarding Enabled

This will turn your Windows device into a basic network router.

Next, enable NAT masquerading on the Windows host running the OpenVPN server. This enables Windows to translate VPN clients’ IP addresses (10.1.10.x) into the host’s own IP address on the local network interface. To create a masquerading rule for your VPN network, run the following PowerShell command:

New-NetNat -Name "NAT-OpenVPNClients" -InternalIPInterfaceAddressPrefix "10.1.10.0/24"

If you are running an OpenVPN server on a Windows Server host, you can use the Routing and Remote Access (RRAS) role to configure more complex traffic routing and NAT rules. Add this  Windows Server role using PowerShell:

Install-WindowsFeature -Name Routing -IncludeManagementTools

Open the RRAS Management snap-in (rrasmgmt.msc) and create a new custom configuration with the NAT and LAN routing options enabled.

Start the service, then navigate to IPv4 –> NAT and add a new rule to the configuration. Add your LAN interface, then enable the Public interface connected to the Internet and Enable NAT on this interface options in its properties.

Configuring OpenVPN Client on Windows

Now let’s look at how to configure the OpenVPN client on a Windows computer. The first step is to install the OpenVPN client. This is installed using the same distribution that was used for the server deployment.

When deploying the client using the OpenVPN-2.7.6-I001-amd64.msi MSI file, only select the OpenVPN GUI and the network driver for installation. Disable installation of the OpenVPN service and the OpenSSL tools, as these are not required by the client.

Or, you can install the OpenVPN client on Windows using the built-in WinGet package manager. Run the command:

winget install OpenVPNTechnologies.OpenVPN

The OpenVPN client configuration file can be stored in the current user’s profile (C:\Users\username\OpenVPN\config) or in C:\Program Files\OpenVPN\config\ (a configured VPN connection in this directory will be available to all Windows users).

Copy the following keys and certificates from the OpenVPN server to the client and place them in one of the client configuration directories listed above:

• ca.crt (server root certificate) from C:\Program Files\OpenVPN\easy-rsa\pki
• testuser1.crt (client certificate) from C:\Program Files\OpenVPN\easy-rsa\pki\issued
• testuser1.key (client private key) from C:\Program Files\OpenVPN\easy-rsa\pki\private
• tc.key (TLS encryption secret key) from C:\Program Files\OpenVPN\bin\

Create a configuration file for the OpenVPN client in the same folder with the following settings (the file name is testuser1.ovpn):

client
dev tun
proto udp
remote gw.woshub.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert testuser1.crt
key testuser1.key
remote-cert-tls server
tls-crypt tc.key
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305 
data-ciphers-fallback AES-256-GCM
connect-retry-max 25
verb 3

You can embed the keys and certificates directly into the OVPN configuration file, thereby eliminating the need to distribute them as separate files. To do this, open each cert file in a text editor and copy its contents directly into the testuser1.ovpn file, placing them inside the appropriate tags:

# ca ca.crt
# cert testuser1.crt
# key testuser1.key
# tls-crypt tc.key
<ca>
-----BEGIN CERTIFICATE-----
ca.crt...
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
testuser1.crt
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
testuser1.key
-----END PRIVATE KEY-----
</key>
<tls-crypt>
-----BEGIN OpenVPN Static key V1-----
tc.key...
-----END OpenVPN Static key V1-----
</tls-crypt>

Save the file. You can now connect to the OpenVPN server. Right-click the OpenVPN GUI icon in the notification area and select Connect.

If everything has been configured correctly, a message will appear to indicate that the connection has been successful and an IP address from the VPN range has been assigned to the client.

Open the Network Connections dialog (ncpa.cpl) and check that the OpenVPN Data Channel Offload network adapter is active.

If something doesn’t work or errors occur, you can find the OpenVPN client logs in the file %userprofile%\OpenVPN\log\client.log .

How to Revoke OpenVPN Client Certificate in Windows

OpenVPN allows you to revoke client certificates that have been issued using a Certificate Revocation List (CRL). This may be necessary if the certificate holder leaves the company, or if the certificate is compromised.

By default, the file that stores the certificate revocation list has a limited validity period of 180 days. To prevent the OpenVPN server from disconnecting clients with a ‘CRL has expired’ error after this period, you must first increase the CRL’s expiration date.

cd "C:\Program Files\OpenVPN\easy-rsa"

EasyRSA-Start.bat

export EASYRSA_CRL_DAYS=3650 (or make changes to the vars file)

./easyrsa gen-crl

Revoke the client certificate by specifying its name:

./easyrsa revoke myclient01

Update the certificate revocation list:

./easyrsa gen-crl

Copy the file C:\Program Files\OpenVPN\easy-rsa\pki\crl.pem to the directory containing the OpenVPN server configuration.

Add the following directive to the end of the server.ovpn config file:

crl-verify crl.pem

Restart the OpenVPN Service. Users with revoked certificates will no longer be able to connect to the OpenVPN server.