Configure an OpenVPN client without using an .ovpn file

Required configuration items

Additional configuration items

See Configure SureLink active recovery for OpenVPN for information about OpenVPN active recovery.

 

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click VPN > OpenVPN > Clients.
  4. For Add, type a name for the OpenVPN client and click .

    The new OpenVPN client configuration is displayed.

  5. The OpenVPN client is enabled by default. To disable, toggle off Enable.
  6. The default behavior is to use an OVPN file for client configuration. To disable this behavior and configure the client manually, click Use .ovpn file to disable.
  7. For Device type, select the mode used by the OpenVPN server, either TUN or TAP.
  8. For Zone, select the firewall zone for the OpenVPN client.
  9. (Optional) Select the Metric for the OpenVPN client. If multiple active routes match a destination, the route with the lowest metric will be used.
  10. (Optional) For Username and Password, type the login credentials as configured on the OpenVPN server.
  11. For VPN server IP, type the IP address of the OpenVPN server.
  12. (Optional) Set the VPN port used by the OpenVPN server. The default is 1194.
  13. Paste the contents of the CA certificate (usually in a ca.crt file), the Public key (for example, client.crt), and the Private key (for example, client.key) into their respective fields. The contents will be hidden when the configuration is saved.
    1. Click Enable to enable the use of additional OpenVPN parameters.
    2. Click Override if the additional OpenVPN parameters should override default options.
    3. For OpenVPN parameters, type the additional OpenVPN parameters. For example, to override the configuration by using a configuration file, enter --config filename, for example, --config /etc/config/openvpn_config.
  15. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the EX15 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. At the config prompt, type:
    (config)> add vpn openvpn client name
(config vpn openvpn client name)>

    where name is the name of the OpenVPN server.

    The OpenVPN client is enabled by default. To disable the client, type:

    (config vpn openvpn client name)> enable false
(config vpn openvpn client name)>

  4. The default behavior is to use an OVPN file for client configuration. To disable this behavior and configure the client manually:
    (config vpn openvpn client name)> use_file false
(config vpn openvpn client name)>
  5. Set the mode used by the OpenVPN server:
    (config vpn openvpn client name)> device_type value
(config vpn openvpn client name)>

    where value is either tun or tap. The default is tun.

  6. Set the firewall zone for the OpenVPN client: 
    (config vpn openvpn client name)> zone value
(config vpn openvpn client name)>
    (config vpn openvpn client name)> zone ?

Zone: The zone for the openvpn client interface.
Format:
  any
  dynamic_routes
  edge
  external
  hotspot
  internal
  ipsec
  loopback
  setup
Current value:

(config vpn openvpn client name)>
  7. (Optional) Set the route metric for the OpenVPN server. If multiple active routes match a destination, the route with the lowest metric will be used.
    (config vpn openvpn client name)> metric value
(config vpn openvpn client name)>

    where value is an interger between 0 and 65535. The default is 0.

  8. (Optional) Set the login credentials as configured on the OpenVPN server:
    (config vpn openvpn client name)> username value
(config vpn openvpn client name)> password value
(config vpn openvpn client name)>
  9. Set the IP address of the OpenVPN server:
    (config vpn openvpn client name)> server ip_address
(config vpn openvpn client name)>
  10. (Optional) Set the port used by the OpenVPN server:
    (config vpn openvpn client name)> port port
(config vpn openvpn client name)>

    The default is 1194.

  11. Paste the contents of the CA certificate (usually in a ca.crt file) into the value of the cacert parameter:
    (config vpn openvpn client name)> cacert value
(config vpn openvpn client name)>
  12. Paste the contents of the public key (for example, client.crt) into the value of the public_cert parameter:
    (config vpn openvpn client name)> public_cert value
(config vpn openvpn client name)>
  13. Paste the contents of the private key (for example, client.key) into the value of the private_key parameter:
    (config vpn openvpn client name)> private_key value
(config vpn openvpn client name)>
    1. Enable the use of additional OpenVPN parameters:
      (config vpn openvpn client name)> advanced_options enable true
(config vpn openvpn client name)>
    2. Configure whether the additional OpenVPN parameters should override default options:
      (config vpn openvpn client name)> advanced_options override true
(config vpn openvpn client name)>
    3. Set the additional OpenVPN parameters:
      (config vpn openvpn client name)> advanced_options extra parameters
(config vpn openvpn client name)>
  15. Save the configuration and apply the change.
    (config)> save
Configuration saved.
>
  16. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.