While I can start OpenVPN manually with sudo systemctl start openvpn@server.service ("server" being the name of my config file), trying to get OpenVPN to open automatically after a reboot after having set up the required symlink with the command sudo systemctl enable openvpn@server.service failed.


I solved it. It turned out what was blocking OpenVPN from starting at boot was the local IP. The steps I took to make this work were:

  1. Commenting out the local IP address in /etc/openvpn/server.conf
  2. Switching to root with sudo -s
  3. Adding @reboot systemctl start openvpn@server.service to root's crontab
  • 1
    Hi. I don't understand how the repeated call of systemctl start upon boot should improve the behaviour over one systemctl enable? – Ghanima Nov 24 '15 at 23:03
  • You may be right. After commenting out the local IP address in the config file, there may be several ways to start OpenVPN automatically after a reboot. Before I discovered that the local IP prevented OpenVPN from starting, all my previous attempts, including systemctl enable failed. The problem was OpenVPN trying to bind to it before the network connection was established (see bbs.archlinux.org/viewtopic.php?id=183818). – haadaa Nov 24 '15 at 23:13
  • @reboot is the time when the cron daemon starts. Could it be that this might be before some other services are started via systemd such as network? In this case the solution would not be robust. (Just guessing here.) – Ghanima Nov 24 '15 at 23:20
  • I don't really know. However, sudo systemctl enable openvpn@server.service (which I tried first) didn't work either. The local IP certainly got in the way also there. – haadaa Nov 24 '15 at 23:45
  • Using a cron job may get it to start, but it is the wrong way to do it. I'd like to see this get a correct answer. I'll keep searching. – Bruno Bronosky May 31 '17 at 0:59

I manage my Pi 3 jessie with Webmin ( don't ask! ) and I found the removing the "local" line was sufficient to enable the VPN server to start.



In /etc/openvpn/ your configs must end in .conf and not .ovpn!


I'm about to make some bold claims that are specific to...

pi@raspberrypi:~ $ uname -a && lsb_release -a
Linux raspberrypi 4.4.50-v7+ #970 SMP Mon Feb 20 19:18:29 GMT 2017 armv7l GNU/Linux
No LSB modules are available.
Distributor ID: Raspbian
Description:    Raspbian GNU/Linux 8.0 (jessie)
Release:    8.0
Codename:   jessie

(imaged from 2017-04-10-raspbian-jessie-lite)


1. For me it was enough to simply install OpenVPN via:

sudo apt install openvpn

2. Then copied my offsite-client.ovpn to /etc/openvpn

3. Then I enabled the service via:

sudo systemctl enable openvpn

4. This is the initial state of /etc/default/openvpn:

# This is the configuration file for /etc/init.d/openvpn

# Start only these VPNs automatically via init script.
# Allowed values are "all", "none" or space separated list of
# names of the VPNs. If empty, "all" is assumed.
# The VPN name refers to the VPN configutation file name.
# i.e. "home" would be /etc/openvpn/home.conf
# If you're running systemd, changing this variable will
# require running "systemctl daemon-reload" followed by
# a restart of the openvpn service (if you removed entries
# you may have to stop those manually)
#AUTOSTART="home office"
# WARNING: If you're running systemd the rest of the
# options in this file are ignored.
# Refresh interval (in seconds) of default status files
# located in /var/run/openvpn.$NAME.status
# Defaults to 10, 0 disables status file generation
# Optional arguments to openvpn's command line
# If you need openvpn running after sendsigs, i.e.
# to let umountnfs work over the vpn, set OMIT_SENDSIGS
# to 1 and include umountnfs as Required-Stop: in openvpn's
# init.d script (remember to run insserv after that)

I did not need to change anything. (Though I did uncomment AUTOSTART="all" when I was losing my mind, I changed it back and reboot to confirm the statement If empty, "all" is assumed.)

4. I lost my mind reading 2 dozen articles explaining everything about installing EasyRSA and everything else the was redundant to step #1.

5. I realized that I left the wrong extension on my config and did:

sudo mv /etc/openvpn/offsite-client.ovpn /etc/openvpn/offsite-client.conf
sudo reboot now

And all was well.

  • This is fine, but it's a client setup, whereas the OP seems to have been asking about the server. – AtomHeartFather Jan 13 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.