set up OpenVPN connection in Kali Linux

Almost every VPN provider out there will support the largest platforms. Every serious VPN provider you look at will supply native Windows, macOS, Android, and iOS client apps to their users. But with Linux, it’s not as simple as that. Some providers do, but most do not.

That doesn’t necessarily mean that you can’t set up a client connection to your VPN provider using Linux. It just means that you may have to do a bit of extra work to get there. In this article, we’re going to show you how to set up an OpenVPN client connection in Kali Linux using the Network Manager.

OpenVPN configuration files

To get this working, you’re going to need to download your VPN provider’s OpenVPN configuration files (.ovpn).

In general, a provider that supports Linux without supplying a native Linux client makes its OpenVPN configuration files available on its website. This goes for VPN providers that support routers as well.

Some VPN providers, even though they do provide native client apps for a particular platform, still provide access to their OpenVPN configuration files to enable users of that platform to connect using a third-party client.

So, if your VPN provider supports Linux (without a native client), supports routers, or allows its users to connect with third-party clients, there’s a good chance it will make its OpenVPN configuration files available for download. And the information contained in these files can be used to create a VPN connection over Linux using the Network Manager, a third-party client.

Supported VPN providers

Below is a list of VPN providers that make their OpenVPN configuration files available. NordVPN is Comparitech’s top-rated VPN and tops the list of best VPNs for Linux.

To start, you need to download your VPN provider’s OpenVPN configuration files. There’s usually at least one config file per server location. Once you’ve got the files and your credentials, you should have everything you need.

You’re now ready to set up an OpenVPN client connection in Kali Linux.

Configuring an OpenVPN connection from the Network Manager

There are two ways to configure an OpenVPN connection in Kali Linux: automatically or manually. We’re going to go through both.

Configuring an OpenVPN connection automatically

  1. From the Desktop, click the Network Manager icon at the top right of the screen. If you’re on a wired connection, the icon will be square like mine. If you’re on wireless, it will be a WiFi icon. Select VPN Connections > Add a VPN connection. The Network Manager is displayed.Kali - Click Top Right
  2. From the drop-down menu, select Import a saved VPN configuration…Kali - Connection Type Window
  3. Click Create. The File Browser is displayed.Kali - Click Create
  4. Navigate to the location where you saved your provider’s OpenVPN configuration files and select the .ovpn file of the server to which you want to connect. The Editing VPN window is displayed.Kali - File Browser
  5. Enter your username and password and click Save. If your provider only requires a username, a client identifier, or an account number, and doesn’t require a password, just type anything in the password field. Don’t leave it blank.Kali - Add Username and Password
  6. By clicking the icon to the right of the password field, you can select The password is not required. However, in my experience, you’ll still be prompted for a password regardless of whether or not this option is selected.Kali - Password Not Required
  7. Click Save. The Editing VPN window is closed.

You are then prompted to create a password for a new keyring. Kali Linux is a security-focused Linux distribution. As such, the first time you create a password on the system, it prompts you to create an additional keyring password in order to store your passwords (like the VPN account password) in an encrypted vault (the keyring). You won’t be prompted to enter this password to connect to the VPN.

You will only be prompted to create a keyring password the first time you create a password on your system. If you’ve created the keyring password before, you won’t see this prompt.

  1. Type and confirm your keyring password, and then click Continue. Your OpenVPN connection is now configured.Kali - Keyring Password
  2. To enable your VPN new connection, click the Network Manager icon at the top right of the Desktop. Select VPN Connections / <Your VPN Connection> (mine is named Australia).Kali - Connect VPN
  3. Upon successful connection, you’ll see a notification appear stating that you’re now connected to the VPN.Kali - Connection Notification
  4. You can verify that your IP address has been changed by using the Comparitech IP Address Check Tool.Check IP

We can see that I now have an Australian IP address.

That was the automatic way. But you can also create your connection manually. Knowing how to configure your OpenVPN connection manually can help you if something goes wrong and you need to troubleshoot.

Configuring an OpenVPN connection manually 

Whether creating your connection automatically or manually, you’re going to need your VPN provider’s OpenVPN configuration files.

Once you’ve got the .ovpn files, you’re going to create individual files for your CA certificate and your TLS key (if required).

  • The CA certificate: Each VPN provider has a Certificate Authority that validates connections to its VPN servers. You’re going to need your provider’s CA certificate to configure a VPN client in Kali Linux. It looks like this:Example CA
  • The TLS key: Many VPN providers also require a TLS key to initiate a client connection. You may have heard it referred to as a static key – they’re the same thing. Depending on whether or not your VPN provider requires a static key to establish an OpenVPN connection, you may or not going to need that as well. It looks like this:Static Key

These are all found in the .ovpn configuration files. Refer to the images above if you’re having trouble finding them, but they tend to stand out as blocks of numbers and letters. Once you’ve found them, copy each one to a text file and then save the text files with the extensions below:

  • CA certificate – .crt extension
  • TLS key – .key extension

Here’s how my files look:

Kali - Manual - Files

To create our connection manually, we’ll need more than just the CA certificate and the TLS key. But every other piece of information we need is found in the OpenVPN configuration files. Here’s how:

    1. From the Desktop, click the Network Manager icon at the top right of the screen. If you’re on a wired connection, the icon will be square like mine. If you’re on wireless, it will be a WiFi icon. Select VPN Connections > Add a VPN connection. The Network Manager is displayed.Kali - Click Top Right
    2. From the drop-down menu, select OpenVPN.Kali - Manual - Connection Type Window
    3. Click Create. The Editing VPN window is displayed.Kali - Manual - Click Create
    4. Give the connection a name and enter the VPN server hostname or IP address in the Gateway field, followed by a colon and the port number. vpnserver.com:2049, for example.Kali - Manual - Editing VPN Window
    5. Under Authentication, set the Type field to Password. Enter your username and password and click Save. If your provider only requires a username, a client identifier, or an account number, and doesn’t require a password, just type anything in the password field. Don’t leave it blank.Kali - Manual - Username and Password
    6. As above, by clicking the icon to the right of the password field, you can select The password is not required but in my experience, it still prompts you for a password regardless of whether or not this option is selected.Kali - Manual - No Password Required
    7. Click the CA certificate field. The file browser appears. Navigate to the CA.crt file you created earlier and select it.Kali - Manual - Add CA
    8. Click the Advanced button. The advanced options are displayed.Kali - Manual - Advanced - General
    9. If your VPN provider uses data compression, tick Data compression and select the type of compression from the drop-down menu.
    10. Tick Set virtual device type, leave it set to TUN, and set the name to tun.
    11. Go to the Security tab.Kali - Manual - Advanced - Security
    12. If your VPN provider supports different encryption ciphers, you can manually select your cipher here. If not, leave it to Default.
    13. Go to the TLS Authentication tab. Setting the TLS Authentication options is not required if your VPN provider doesn’t use TLS authentication and does not provide a TLS key.Kali - Manual - Advanced - TLS
    14. Select your provider’s Server Certificate Check method and enter the Subject Match. This is found in the .ovpn configuration file.
    15. Tick Verify peer (server) certificate usage signature and leave the setting to Server.
    16. Under Additional TLS authentication or encryption, select either TLS-Auth or TLS-Crypt, based on the options supported by your VPN provider.
    17. Click the Key File field. The file browser appears. Navigate to the TLS.key file you created earlier and select it.
    18. Click the Key Direction field and select 1 from the drop-down menu.
    19. Click OK. You’re taken back to the Editing VPN window.
    20. Click Save. The Editing VPN window is closed.Kali - Manual - Click Save
    21. If it’s the first time you create a password on this system, you will be prompted to create a keyring password, as above. Type and confirm your keyring password, and then click Continue. Your OpenVPN connection is now configured.Kali - Keyring Password
    22. To enable your VPN new connection, click the Network Manager icon at the top right of the Desktop. Select VPN Connections > <Your VPN Connection > (mine is named Australia).Kali - Connect VPN
    23. Upon successful connection, you’ll see a notification appear stating that you’re now connected to the VPN.Kali - Connection Notification
    24. You can verify that your IP address has been changed by using the Comparitech IP Address Check Tool.Check IP

You’ve now set up an OpenVPN connection to your VPN provider over Linux, using the Network Manager. You can add as many connections as you want by repeating the process. When you want to connect, simply select the server you want to connect to and toggle it on from the Network Manager.

However, in order to secure your traffic, there’s one more step you need to complete. To make sure that your traffic doesn’t leak out unencrypted if your VPN connection should ever drop, we’re going to create a VPN kill switch for our connection. We’re going to do this using iptables. Iptables is a firewall for Linux distributions.

We’re going to be using the terminal window and running some commands in the Terminal. If you’re new to Linux, it might seem scary at first but learning to use the Terminal will greatly help you in mastering your Linux Fu.

However, if you’re running Kali Linux, there’s a good chance you’ve used the Terminal before.

Configuring a VPN kill switch with iptables

Most VPN providers’ client apps include a kill switch. A kill switch will block all traffic from going out to the internet if your device should ever drop the VPN connection. It’s a great feature for security and privacy.

In this section, we’re going to show you how to configure your own VPN kill switch, using iptables, a well-known Linux firewall.

Installing iptables-persistent

  1. Disconnect the VPN.
  2. Launch the Terminal. We’re going to start by installing iptables-persistent.
  3. In the Terminal window type: sudo apt update. Enter your password and press Enter. This will update your package repositories.
  4. Type: sudo apt install iptables-persistent. Enter your password if prompted. You will be prompted to type Y or N to install the package or to abort the installation. Type Y. The package is installed.

The iptables rules are saved in two files, one for IPv4 rules and one for IPv6 rules. The files are:

  • /etc/iptables/rules.v4
  • /etc/iptables/rules.v6

We’re going to start with our IPv4 rules.

Configuring an IPv4 VPN kill switch

  1. Type: sudo nano /etc/iptables/vpn-rules.v4 to create a new IPv4 rules file for our VPN.
  2. Enter your password if prompted. An empty file is displayed.
  3. Copy the following to your file, but insert the IPv4 address of your VPN server instead of <VPN server IPv4 address> and the VPN server’s port instead of <VPN server port>:

*filter

-A OUTPUT -o tun0 -j ACCEPT

-A OUTPUT -d <VPN server IPv4 address> --dport <VPN server port> -j ACCEPT

-A OUTPUT -j DROP

COMMIT

  1. Press Ctrl+X to save and exit. Type Y when asked to save the file.

What these rules do is allow traffic out from the VPN interface, allow a connection to the VPN server via the default route, and then block everything else.

Configuring an IPv6 VPN kill switch

If your VPN provider supports IPv6 (most don’t), you can do the same thing for IPv6 traffic.

  1. In the Terminal window, type: sudo nano /etc/iptables/vpn-rules.v6 to create a new IPv6 rules file for our VPN.
  2. Enter your password if prompted. An empty file is displayed.
  3. Copy the following to your file, but insert the IPv6 address of your VPN server instead of <VPN server IPv6 address> and the VPN server’s port instead of <VPN server port>:

*filter

-A OUTPUT -o tun0 -j ACCEPT

-A OUTPUT -d <VPN server IPv6 address> --dport <VPN server port> -j ACCEPT

-A OUTPUT -j DROP

COMMIT

  1. Press Ctrl+X to save and exit. Type Y when asked to save the file.

Dropping IPv6 traffic

If your VPN provider doesn’t support IPv6, I recommend creating rules to drop that traffic altogether.

  1. In the Terminal window, type: sudo nano /etc/iptables/vpn-rules.v6 to create a new IPv6 rules file for our VPN. Enter your password if prompted. An empty file is displayed.
  2. Copy the following to your file:

*filter

:INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0]

COMMIT

Now, all we need to do is to load our new rules files so the iptables will apply them.

Loading IPv4 firewall rules

In the Terminal window, type: sudo iptables-restore > /etc/iptables/vpn-rules.v4

Loading IPv6 firewall rules

In the Terminal window, type: sudo ip6tables-restore > /etc/iptables/vpn-rules.v6

You now have a working OpenVPN client connection in Kali Linux. You can easily enable and disable your connection by clicking the Network Manager icon, at the top right of the Desktop.

You’ve also configured a VPN kill switch, using iptables. From now on, If your VPN connection should ever drop, all traffic from your device will be blocked. So none of it will go out, unencrypted, to the internet.