set up OpenVPN connection in Linux Mint

Most VPN providers make apps for the most popular platforms right out of the box. The overwhelming majority of commercial VPN providers supply native Windows, macOS, Android, and iOS client apps to their users. But Linux… not so much. Some do, most do not.

But that doesn’t necessarily mean that you can’t set up a client connection to your VPN provider over Linux. It may just mean that you’ll have to do a bit of extra work to get there. In this article, we’re going to show you how to set up an OpenVPN client connection in Linux Mint, using the Network Manager.

Linux Mint is based on the Ubuntu operating system, which is in turn based on Debian. If you’re using another Debian-based Linux distro with Network Manager, the steps in this guide should be similar.

OpenVPN configuration files

In order to do this, you’re going to need to download your VPN provider’s OpenVPN configuration files (.ovpn).

Typically, a provider that supports Linux but that doesn’t supply a native Linux client will make its OpenVPN configuration files available. The same goes for VPN providers that support routers.

Some VPN providers, while having native client apps for a particular platform, still make their OpenVPN configuration files available to enable users of said platform to connect using third-party clients.

So, in a nutshell, if your VPN provider supports Linux (without a native client), supports routers, or allows its users to connect using third-party clients, odds are it will make its OpenVPN configuration files available for download. And these can be used to create a VPN connection over Linux, using the Network Manager – which is considered a third-party client.

Supported VPN providers

As found in our guide to setting up an OpenVPN connection in pfSense, here’s a list of VPN providers that make their OpenVPN configuration files available. NordVPN is Comparitech’s top-rated VPN and tops the list of best VPNs for Linux.

The first thing you need to do is download your VPN provider’s OpenVPN configuration files. Once you’ve got them, you should have everything you need. You’ll also need your login credentials, which are usually—but not always—the same as the email and password you used to sign up for the VPN.

If you’ve got all of the above, you’re now ready to set up an OpenVPN client connection in Linux Mint.

Configuring an OpenVPN connection from the Network Manager

There are two ways to configure an OpenVPN connection in Linux Mint: automatically or manually. We’re going to go through both.

Configuring an OpenVPN connection automatically

  1. From the Desktop, click the Network Manager icon, at the bottom right of the screen. The Network Connections window appears.Mint - Click Network Manager
  2. Click the + at the bottom left of the window. The Connection Type window is displayed.Mint - Click Plus
  3. From the drop-down list, select Import a saved VPN configuration… The file browser appears.Mint - Import VPN Configuration
  4. Navigate to the location where you saved your provider’s OpenVPN configuration files and select the .ovpn file of the server to which you want to connect.Mint - File Browser
  5. You’re taken back to the Connection Type window. Click Create.Mint - Click Create
  6. The Settings window for your new VPN connection is displayed. Enter your username and password and click Save. If your provider only requires a username, a client identifier, or an account number, and doesn’t require a password, just type anything in the password field. Don’t leave it blank.Mint - Enter Credentials
  7. By clicking the icon to the right of the password field, you can select The password is not required. However, in my experience, you’ll still be prompted for a password regardless of whether or not this option is selected.Mint - Password
  8. Click Save. Your OpenVPN connection is now configured. Close the Connection Type window.Mint - Click Save
  9. To enable your VPN new connection, from the Desktop, click the Network Manager icon, at the bottom right of the screen and simply toggle your VPN connection on.Mint - Enable VPN
  10. Upon successful connection, you’ll see a notification appear stating that you’re now connected to the VPN.Mint - Connection Notification
  11. You can verify that your IP address has been changed by using the Comparitech IP Address Check Tool.Mint - Comparitech Check IP

We can see that I now have an Australian IP address.

That was the automatic way. But you can also create your connection manually. Knowing how to configure your OpenVPN connection manually can help you if something goes wrong and you need to troubleshoot.

Configuring an OpenVPN connection manually 

As was the case with the automatic configuration, you’re going to need your VPN provider’s OpenVPN configuration files to set up the connection manually.

Once you have the .ovpn files, you’re going to need to create individual files for your CA certificate and your TLS key (if required).

  • The CA certificate: The VPN provider has a Certificate Authority that validates connections to its VPN servers. To configure a VPN client in Linux Mint, you’re going to need your provider’s CA certificate. It looks like this:Mint - Example CA
  • The TLS key: Some VPN providers also require a TLS key to initiate a client connection to their servers. It is often referred to as a static key. If your VPN provider requires a static key to establish an OpenVPN connection, you’re going to need that as well. It looks like this:Mint - Static Key

All of these elements are found in the .ovpn configuration files. Refer to the images above if you’re not sure what each of them looks like. You’re going to copy each of them to a text file and then save the text files with a particular extension.

  • CA certificate – .crt extension
  • TLS key – .key extension

Here’s how my files look:

Mint - Manual Files

To configure our VPN connection manually, we’re going to need more than just the CA certificate and the TLS key. But the OpenVPN configuration files contain every other piece of information we need as well.

We’re ready to start.

  1. From the Desktop, click the Network Manager icon, at the bottom right of the screen. The Network Connections window appears.Mint - Click Network Manager
  2. Click the + at the bottom left of the window. The Connection Type window is displayed.Mint - Click Plus
  3. From the drop-down list, select OpenVPN.Mint - Manual - Select OpenVPN
  4. You’re taken back to the Connection Type window. Click Create.Mint - Manual - Click Create
  5. The Settings window for your new VPN connection is displayed. Give the connection a name and enter the VPN server hostname or IP address in the Gateway field, followed by  a colon and the port number. vpnserver.com:2049, for example.Mint - Manual - Edit Connection
  6. Under Authentication, set the Type field to Password. Enter your username and password and click Save. If your provider only requires a username, a client identifier, or an account number, and doesn’t require a password, just type anything in the password field. Don’t leave it blank.Mint - Manual - Filled In - No Cert
  7. As above, by clicking the icon to the right of the password field, you can select The password is not required but in my experience, it still prompts you for a password regardless of whether or not this option is selected.Mint - Manual - Password Not Required
  8. Click the CA certificate field. The file browser appears. Navigate to the CA.crt file you created earlier and select it.Mint - Manual - Add CRT
  9. Click the Advanced button. The advanced options are displayed.Mint - Manual - Advanced - General
  10. If your VPN provider uses data compression, tick Data compression and select the type of compression from the drop-down menu.
  11. Tick Set virtual device type, leave it set to TUN, and set the name to tun.
  12. Go to the Security tab.Mint - Manual - Advanced - Security
  13. If your VPN provider supports different encryption ciphers, you can manually select your cipher here. If not, leave it set to Default.
  14. Go to the TLS Authentication tab. Setting the TLS Authentication options is not required if your VPN provider doesn’t use TLS authentication and does not provide a TLS key.Mint - Manual - Advanced - TLS
  15. Select your provider’s Server Certificate Check method and enter the Subject Match. This is found in the .ovpn configuration file.
  16. Tick Verify peer (server) certificate usage signature and leave the setting to Server.
  17. Under Additional TLS authentication or encryption, select either TLS-Auth or TLS-Crypt, based on the options supported by your VPN provider.
  18. Click the Key File field. The file browser appears. Navigate to the TLS.key file you created earlier and select it.
  19. Click the Key Direction field and select 1 from the drop-down menu.
  20. Click OK. You’re taken back to the main Settings window for your VPN connection.
  21. Click Save. Your OpenVPN connection is now configured. Close the Connection Type window.Mint - Manual - Click Save
  22. To enable your VPN new connection, from the Desktop, click the Network Manager icon, at the bottom right of the screen and simply toggle your VPN connection on.Mint - Enable VPN
  23. Upon successful connection, you’ll see a notification appear stating that you’re now connected to the VPN.Mint - Connection Notification
  24. You can verify that your IP address has been changed by using the Comparitech IP Address Check Tool.Mint - Check IP

So you can now connect to your VPN provider over Linux, using the Network Manager. And you can add as many connections as you want. When you want to connect, simply choose the server you want to connect to and toggle it on from the Network Manager.

However, there’s still one more step to complete in order to secure your traffic. You want to make sure that your traffic doesn’t leak out unencrypted if your VPN connection should ever drop. So we’re going to create a VPN kill switch for our connection, using iptables. Iptables is a firewall for Linux distributions.

To do this, we’re going to be using the terminal window and running some commands in the terminal. If you’re new to Linux, the Terminal might seem scary at first but learning to use it will greatly help you in mastering your Linux Fu.

Here’s a good article to read if you’d like to learn more about iptables and how to use it.

Configuring a VPN kill switch with iptables

Most native VPN client apps from VPN providers include a kill switch. A kill switch will block all traffic from exiting your device if the VPN connection should ever drop. It’s a great feature for security and privacy.

In this section, we’re going to show you how to configure your own VPN kill switch, using iptables, a well-known Linux firewall.

Installing iptables-persistent

  1. Disconnect the VPN.
  2. Launch the Terminal. We’re going to start by installing iptables-persistent.
  3. In the Terminal window type: sudo apt update. Enter your password and press Enter. This will update your package repositories.
  4. Type: sudo apt install iptables-persistent. Enter your password if prompted. You will be prompted to type Y or N to install the package or to abort the installation. Type Y. The package is installed.

The iptables rules are saved in two files, one for IPv4 rules and one for IPv6 rules. The files are:

  • /etc/iptables/rules.v4
  • /etc/iptables/rules.v6

We’re going to start with our IPv4 rules.

Configuring an IPv4 VPN kill switch

  1. Type: sudo nano /etc/iptables/vpn-rules.v4 to create a new IPv4 rules file for our VPN.
  2. Enter your password if prompted. An empty file is displayed.
  3. Copy the following to your file, but insert the IPv4 address of your VPN server instead of <VPN server IPv4 address> and the VPN server’s port instead of <VPN server port>:

*filter

-A OUTPUT -o tun0 -j ACCEPT

-A OUTPUT -d <VPN server IPv4 address> --dport <VPN server port> -j ACCEPT

-A OUTPUT -j DROP

COMMIT

  1. Press Ctrl+X to save and exit. Type Y when asked to save the file.

What these rules do is allow traffic out from the VPN interface, allow a connection to the VPN server via the default route, and then block everything else.

Configuring an IPv6 VPN kill switch

If your VPN provider supports IPv6 (most don’t), you can do the same thing for IPv6 traffic.

  1. In the Terminal window, type: sudo nano /etc/iptables/vpn-rules.v6 to create a new IPv6 rules file for our VPN.
  2. Enter your password if prompted. An empty file is displayed.
  3. Copy the following to your file, but insert the IPv6 address of your VPN server instead of <VPN server IPv6 address> and the VPN server’s port instead of <VPN server port>:

*filter

-A OUTPUT -o tun0 -j ACCEPT

-A OUTPUT -d <VPN server IPv6 address> --dport <VPN server port> -j ACCEPT

-A OUTPUT -j DROP

COMMIT

  1. Press Ctrl+X to save and exit. Type Y when asked to save the file.

Dropping IPv6 traffic

If your VPN provider doesn’t support IPv6, I recommend creating rules to drop that traffic altogether.

  1. In the Terminal window, type:sudo nano /etc/iptables/vpn-rules.v6 to create a new IPv6 rules file for our VPN. Enter your password if prompted. An empty file is displayed.
  2. Copy the following to your file:

*filter

:INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0]

COMMIT

Now, all we need to do is to load our new rules files so the iptables will apply them.

Loading IPv4 firewall rules

In the Terminal window, type:

sudo iptables-restore > /etc/iptables/vpn-rules.v4

Loading IPv6 firewall rules

In the Terminal window, type:

sudo ip6tables-restore > /etc/iptables/vpn-rules.v6

And there you go. You now have a working OpenVPN connection in Linux Mint. You can easily enable and disable your connection using the Network Manager. And you’ve also configured a VPN kill switch, using iptables. If your VPN connection should drop, traffic from your device won’t go out, unencrypted, to the internet. All traffic from your device will be blocked.

If you’re looking for a high-quality VPN that supports Linux, check out our dedicated article on the best VPNs for Linux.