What OpenVPN is
OpenVPN is a widely supported VPN platform that uses TLS and configurable transport options to build secure point-to-point or remote-access tunnels. It has broad client support and remains useful when compatibility is more important than the smaller configuration surface of WireGuard.
Why I keep it in the lab
I use OpenVPN as an alternative path for remote access and travel-router testing. Running more than one VPN technology teaches me how routing, certificates, client profiles, firewall rules and DNS differ between implementations, and it provides a fallback when a network handles one protocol better than another.
Operational approach
- Issue individual client profiles rather than sharing one identity
- Keep certificate material out of public documentation
- Restrict reachable subnets with firewall policy
- Monitor failed authentication and tunnel stability
- Retire old profiles when devices are replaced
WireGuard versus OpenVPN
WireGuard is usually my first choice for a simple, high-performance tunnel. OpenVPN remains valuable for its mature PKI model, transport flexibility and support across older platforms and network appliances.
Client profile structure
client
dev tun
proto udp
remote vpn.example.invalid 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth-nocache
<ca>
<REDACTED_CA_CERTIFICATE>
</ca>Protect private keys, revoke unused profiles and verify DNS and firewall behaviour before allowing remote access.
Create a lab certificate authority, server certificate and individual client profiles, then bind the OpenVPN service to a controlled interface and route only the subnets required for testing.