What's changed: Initial version (topic 2.12, subtopics 2.12.1–2.12.4)
6.3Configuring and Managing OpenVPN
Learn the fundamentals of VPN (Virtual Private Network) and the open-source implementation OpenVPN: the configuration directory /etc/openvpn/, the openvpn command used by both server and client, and the difference between the two common topologies, point-to-point and site-to-site.
A VPN lets branch offices or remote workers securely reach an internal network, creating an encrypted virtual private line over the public internet. OpenVPN is an open-source VPN implementation using SSL/TLS-based encryption—a common, approachable choice to set up on a Linux server.
6.3.1OpenVPN configuration files and the command
- Configuration files, certificates, and keys live under /etc/openvpn/ (server and client configs are typically managed as separate .conf files).
- The openvpn command uses the same binary on both server and client; the configuration file content (e.g., presence of a
serverdirective) determines the role. - Encryption relies on SSL/TLS-based certificate authentication (CA certificate, server certificate, client certificate) or a pre-shared key; certificate-based setups scale better and are the practical mainstream.
6.3.2Topologies: point-to-point and site-to-site
- Point-to-point (P2P) connects a single pair of endpoints directly—suited to individual remote-worker access into a company network.
- Site-to-site connects entire networks (sites) together, joining head office and branch networks through a single VPN tunnel so hosts on either side can communicate transparently.
- Choose by use case: point-to-point for individual, on-demand device access; site-to-site for an always-on connection between entire sites.
Staples: OpenVPN configuration lives under /etc/openvpn/, both server and client use the same openvpn command, with the config file determining the role, and 1-to-1 = point-to-point, site-to-site = whole networks. The exam also checks the basic concept of why a VPN exists—an encrypted tunnel over the public network.
Typical patterns help this stick. "A sales rep needs to reach the internal file server while traveling" is the classic point-to-point case: each rep's device runs an OpenVPN client and connects individually to the head office's OpenVPN server. By contrast, "keep the Tokyo head office and Osaka branch networks always connected so devices on either side talk transparently" is site-to-site: each site runs an OpenVPN gateway (router or server), routing all inter-site traffic through the tunnel. On the configuration side, /etc/openvpn/ typically holds a separate server config (server.conf) and client config (client.conf), each referencing paths to certificates and keys. A server config usually specifies the internal virtual subnet used inside the VPN (e.g., server 10.8.0.0 255.255.255.0) and pushes routes to the internal network to clients (e.g., push "route 192.168.1.0 255.255.255.0"). Full production setups with certificate auth also stand up a CA, issue per-client certificates, and manage revocation (CRL)—but for L2 scope, knowing where configuration lives, the shared command, and the topology distinction is enough.
| Topology | Unit connected | Typical use |
|---|---|---|
| Point-to-point | Device to device (1-to-1) | Individual remote-worker access |
| Site-to-site | Site to site (whole networks) | Always-on link between offices |
Trap: "OpenVPN has separate dedicated commands for server and client" is wrong—both use the same openvpn command, with the config file determining the role. Also wrong: "site-to-site connects individual devices one by one to a VPN server"—that describes point-to-point; site-to-site connects entire sites (networks) together.
6.3.3Section summary
- Configuration lives under /etc/openvpn/. Both server and client use the same openvpn command (config content determines the role)
- Point-to-point = 1-to-1 (individual access) / site-to-site = whole sites (connects entire networks)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to permanently connect the entire head-office and branch networks so devices on both sides communicate transparently. Which topology is appropriate?
Q2. Which is the standard directory for OpenVPN configuration files, certificates, and keys?
Q3. Which correctly describes the relationship between the commands used on OpenVPN's server side and client side?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.