Installation instructions for OpenVPN, a Secure Tunneling Daemon
Copyright (C) 2002-2022 OpenVPN Inc. This program is free software;
you can redistribute it and/or modify
it under the terms of the GNU General Public License version 2
as published by the Free Software Foundation.
*************************************************************************
QUICK START:
Unix:
./configure && make && make install
*************************************************************************
To download OpenVPN source code of releases, go to:
https://openvpn.net/community-downloads/
OpenVPN releases are also available as Debian/RPM packages:
https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
OpenVPN development versions can be found here:
https://github.com/OpenVPN/openvpn
https://gitlab.com/OpenVPN/openvpn
https://sourceforge.net/p/openvpn/openvpn/ci/master/tree/
They should all be in sync at any time.
To download easy-rsa go to:
https://github.com/OpenVPN/easy-rsa
To download tap-windows (NDIS 6) driver source code go to:
https://github.com/OpenVPN/tap-windows6
To download ovpn-dco Windows driver source code go to:
https://github.com/OpenVPN/ovpn-dco-win
To get the cross-compilation environment go to:
https://github.com/OpenVPN/openvpn-build
For step-by-step instructions with real-world examples see:
https://community.openvpn.net/openvpn/wiki/GettingStartedwithOVPN
https://community.openvpn.net/openvpn/wiki
https://openvpn.net/community-resources/
Also see the man page for more information.
*************************************************************************
For a list of supported platforms and architectures, and for
instructions how to port OpenVPN to a yet-unsupported architecture,
see the file "PORTS".
*************************************************************************
SYSTEM REQUIREMENTS:
(1) TUN and/or TAP driver to allow user-space programs to control
a virtual point-to-point IP or Ethernet device.
See TUN/TAP Driver References section below for more info.
(2a) OpenSSL library, necessary for encryption, version 1.0.2 or higher
required, available from http://www.openssl.org/
or
(2b) mbed TLS library, an alternative for encryption, version 2.0 or higher
required, available from https://tls.mbed.org/
(3) on Linux, "libnl-gen" is required for kernel netlink support
(4) on Linux, "libcap-ng" is required for Linux capability handling
OPTIONAL:
(5) LZO real-time compression library, required for link compression,
available from http://www.oberhumer.com/opensource/lzo/
(most supported operating systems have LZO in their installable
packages repository. It might be necessary to add LZO_CFLAGS=
and LZO_LIBS= to the configure call to make it find the LZO pieces)
(6) LZ4 compression library
OPTIONAL (for developers only):
(1) Autoconf 2.59 or higher
Automake 1.9 or higher
Libtool
Git
(2) cmocka test framework (http://cmocka.org)
(3) If using t_client.sh test framework, fping/fping6 is needed
Note: t_client.sh needs an external configured OpenVPN server.
See t_client.rc-sample for more info.
*************************************************************************
CHECK OUT SOURCE FROM SOURCE REPOSITORY:
Clone the repository:
git clone https://github.com/OpenVPN/openvpn
git clone https://gitlab.com/OpenVPN/openvpn
git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn
Check out stable version:
git checkout release/2.6
Check out master (unstable) branch:
git checkout master
*************************************************************************
BUILD COMMANDS FROM TARBALL:
./configure
make
sudo make install
*************************************************************************
BUILD COMMANDS FROM SOURCE REPOSITORY CHECKOUT:
autoreconf -i -v -f
./configure
make
sudo make install
*************************************************************************
BUILD A TARBALL FROM SOURCE REPOSITORY CHECKOUT:
autoreconf -i -v -f
./configure
make distcheck
*************************************************************************
TESTS (after BUILD):
make check (Run all tests below)
Test Crypto:
./openvpn --genkey secret key
./openvpn --test-crypto --secret key
Test SSL/TLS negotiations (runs for 2 minutes):
./openvpn --config sample/sample-config-files/loopback-client (In one window)
./openvpn --config sample/sample-config-files/loopback-server (Simultaneously in another window)
For more thorough client-server tests you can configure your own, private test
environment. See tests/t_client.rc-sample for details.
To do the C unit tests, you need to have the "cmocka" test framework
installed on your system. More recent distributions already ship this
as part of their packages/ports. If your system does not have it,
you can install cmocka with these commands:
$ git clone https://git.cryptomilk.org/projects/cmocka.git
$ cd cmocka
$ mkdir build
$ cd build
$ cmake -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Debug ..
$ make
$ sudo make install
*************************************************************************
OPTIONS for ./configure:
To get an overview of all the configure options, run "./configure --help"
ENVIRONMENT for ./configure:
For more fine-grained control on include + library paths for external
components etc., configure can be called with environment variables on
the command line, e.g.
./configure OPENSSL_CFLAGS="-I/usr/local/include" ...
these are also explained in "./configure --help", so not repeated here.
*************************************************************************
Linux distribution packaging:
Each Linux distribution has their own way of doing packaging and their
own set of guidelines of how proper packaging should be done. It
is therefore recommended to reach out to the Linux distributions you
want to have OpenVPN packaged for directly. The OpenVPN project wants
to focus more on the OpenVPN development and less on the packaging
and how packaging is done in all various distributions.
For more details:
* Arch Linux
https://www.archlinux.org/packages/?name=openvpn
* Debian
https://packages.debian.org/search?keywords=openvpn&searchon=names
https://tracker.debian.org/pkg/openvpn
* Fedora / Fedora EPEL (Red Hat Enterprise Linux/CentOS/Scientific Linux)
https://apps.fedoraproject.org/packages/openvpn/overview/
https://src.fedoraproject.org/rpms/openvpn
* Gentoo
https://packages.gentoo.org/packages/net-vpn/openvpn
https://gitweb.gentoo.org/repo/gentoo.git/tree/net-vpn/openvpn
* openSUSE
https://build.opensuse.org/package/show/network:vpn/openvpn
* Ubuntu
https://packages.ubuntu.com/search?keywords=openvpn
In addition, the OpenVPN community provides best-effort package
repositories for CentOS/Fedora, Debian and Ubuntu:
https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
*************************************************************************
TUN/TAP Driver References:
* Linux 2.6 or higher (with integrated TUN/TAP driver):
(1) load driver: modprobe tun
(2) enable routing: echo 1 > /proc/sys/net/ipv4/ip_forward
Note that (1) needs to be done once per reboot. If you install from RPM (see
above) and use the openvpn.init script, these steps are taken care of for you.
* FreeBSD:
FreeBSD ships with the TUN/TAP driver, and the device nodes for tap0,
tap1, tap2, tap3, tun0, tun1, tun2 and tun3 are made by default.
On FreeBSD versions prior to 12.0-RELEASE, there were independent
TUN and TAP drivers, and the TAP driver needed to be loaded manually,
using the command:
# kldload if_tap
For recent FreeBSD versions, TUN/TAP are integrated and always loaded.
FreeBSD 14 contains the ovpn(4) for kernel-level OpenVPN acceleration
(DCO) which will be used by OpenVPN 2.6 and up if available.
* OpenBSD:
OpenBSD has dynamically created tun* devices so you only need
to create an empty /etc/hostname.tun0 (tun1, tun2 and so on) for each tun
you plan to use to create the device(s) at boot.
* Solaris:
You need a TUN/TAP kernel driver for OpenVPN to work:
http://www.whiteboard.ne.jp/~admin2/tuntap/
* Windows
OpenVPN on Windows needs a TUN/TAP kernel driver to work. OpenVPN installers
include this driver, so installing it separately is not usually required.
Starting from Windows 10 2004 / Windows Server 2022, OpenVPN can use the
dco-win driver for kernel-level acceleration for OpenVPN client setups.
This driver is also included in the community-provided OpenVPN installers.
*************************************************************************
CAVEATS & BUGS:
* See the bug tracker on https://github.com/OpenVPN/openvpn/issues
and the wiki on https://community.openvpn.net/wiki for more detailed
caveats on operating systems, and for open and resolved bug reports.
* Note: We only recently switched to GitHub for reporting new issues,
old issues can be found at https://community.openvpn.net/openvpn/report