--- title: "Configuring an OpenVPN Client in the Router - icom OS Routers" slug: "configuring-an-openvpn-client-in-the-router-en" updated: 2026-06-17T09:31:55Z published: 2026-06-17T09:31:55Z canonical: "docs.insys-icom.com/configuring-an-openvpn-client-in-the-router-en" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.insys-icom.com/llms.txt > Use this file to discover all available pages before exploring further. # Configuring an OpenVPN Client in the Router - icom OS Routers The routers of INSYS icom can act as OpenVPN server and/or establish connections to an OpenVPN server as OpenVPN client. This Configuration Guide shows how to configure an INSYS icom router as OpenVPN client. ## Situation The router shall be included into an existing OpenVPN network as client. ## Solution There are several options for configuring an OpenVPN connection: - The [Startup wizard](/kb/docs/en/quickstart-wizard-en) of the router permits to prepare an optional OpenVPN connection besides the configuration of Internet access. - An (additional) OpenVPN connection can be added manually to an already configured router. - Our converter tool can be used to convert an OpenVPN configuration file into an [ASCII configuration](/kb/docs/en/ascii-configuration-files-en) file for configuring the OpenVPN client in the router. It is prerequisite that the respective certificates and keys or an OpenVPN configuration file are available and the configuration of the server is known. > [!WARNING] > Keep your router up to date! > > Update your router to **icom OS 7.3** or later first! All encryption algorithms that are no longer considered sufficiently secure have been removed starting with this version, which eliminates the possibility of such algorithms being used inadvertently. ### Configuration using Startup wizard We act on the assumption that the router is in default settings for the following proceeding. 1. Open the user interface of the router: [https://insys.icom](https://insys.icom) 2. Click on *To Startup wizard* under **Startup wizard** on the splash screen. 3. Click in the *Wizards* → *Startup wizard* menu on START . 4. If necessary, change the settings for *System time* and click on NEXT . 5. Enter a *User name* and *Password* for *Authentication* or configure an *Authentication through certificates* and click on NEXT . 6. Configure the Internet connection and click on NEXT . 7. Select under *Type of VPN connection* **OpenVPN** and as **Client** as *Mode*. 1. If you have an OpenVPN configuration file, select *Import Client Configuration (.ovpn)* and upload the configuration file in the field below. > [!NOTE] > Please note! > > Various OpenVPN servers, such as the **icom Connectivity Suite**, provide ready-made configuration files for clients that contain a complete OpenVPN configuration and the associated certificates and keys 2. If you configure the OpenVPN client manually, select *Manual client configuration* and configure the connection to the OpenVPN server manually: - Enter the address of the OpenVPN server as *VPN server address*. - Enter the port addresses of the tunnel used by the OpenVPN server local and remote for *Tunneling via port*. - Upload the necessary certificates and keys. 8. Click on NEXT . 9. If necessary, modify the LAN settings and click on NEXT . 10. Click on SUBMIT to save the settings of the Startup wizard. 11. Click on FINALIZE to complete the Startup wizard. ### Manual Configuration We act on the assumption that the router is already configured with the networks for WAN (Internet) and LAN (local networks) and other functions. The OpenVPN client will then only be added to this functioning configuration. If OpenVPN connections are already configured, this connection will be added to the existing ones. 1. Open the user interface of the router: [https://insys.icom](https://insys.icom) 2. Click in the *Network* → *Interfaces* menu in the *OpenVPN* section on to add an OpenVPN network. 3. Click on the top right on *to extended view* to show the detailed settings. 4. Enter a reasonable *Description* and select the *Mode* **Client**. 5. Enter under *IP address or domain name of remote site* the address of the OpenVPN server. 6. Enter under *Tunneling via port* the port that is used for the whole data traffic of the tunnel; this can differ between local and remote; however, it must then be ensured that all VPN participants are configured accordingly. 7. Select the *Protocol* used by the server. 8. Check the checkbox *Upload and apply certificates* and upload the *CA certificate*, the *Certificate* and the *Private key*. 9. Configure the other parameters according to the requirements of your OpenVPN server. **Notes regarding these other parameters** Alternatively or additionally to the usage of a client certificate and a private key, a user name/password combination can be used for authentication on the OpenVPN server. However, the CA certificate, which is required by all participants of this VPN, will be required in any case. In addition, it is possible to use a static key for authentication and encryption (tls-crypt) or only for authentication (tls-auth): - If a *key for tls-crypt* is selected, this must also be used by the remote terminal. - If a *key for tls-auth* is selected, it is possible to specify that the static key can only be used for a certain direction. It is important here that this setting is harmonised with the remote VPN terminal, i.e. no direction is configured for both or the settings are complementary (0/1 or 1/0). The same key must also be used by the remote terminal. It must be observed here that both directives are not active at the same time by selecting a key! If the automatic encryption negotiation fails, the *cipher algorithm* configured here will be used to encrypt the data traffic through the tunnel. AES CGM and AES CBC are recommended for this as per TR-02102-2. Not recommended are DES, RC2, CAST, Blowfish and IDEA. The *hash algorithm* configured here will be used independent from the automatic encryption negotiation. SHA-256, 384 and 512 are recommended for this as per TR-02102-2. Not recommended are SHA-1 and 224. The checkbox *Check remote certificate type* allows to check whether the certificate of the remote terminal is a server or client certificate. This allows to avoid Man-in-the-Middle attacks for example. The checkbox *Set default route (redirect-gateway)* allows to set the default route such that any data traffic is routed through the tunnel. The checkbox *Do not bind local address and port (nobind)* can be used to cancel the fixing of the local IP address and the local port for an OpenVPN client. The checkbox *Remote terminal is allowed to change its IP address (float)* allows to continue the use of the tunnel, if the remote terminal changes its IP address after successful authentication. The detailed nature of the messages, which are entered into the log can be set under *Log level*. A **0** deactivates logging completely, a **9** results a very detailed log. Level **3** is recommended as standard. The keys for the data connection are exchanged in regular intervals. The *Interval for renegotiation of data channel key* configures the time, which must expire before new keys are created. The *Ping interval* configures the interval (in seconds) for sending control data via the tunnel, if there is no other data traffic. This can be used by the communication partners to terminate the tunnel in an orderly fashion, in case the tunnel collapses. The ping interval is also used to prevent stateful firewalls at the remote terminal to automatically block the tunnel after a prolonged pause during communication. The value **0** will disable the regular ping. The *Ping restart interval* configures the time in seconds after which the tunnel is to be established again, if no ping from the remote terminal has arrived during the complete time. The value **0** prevents the tunnel to be terminated, even if no ping is received any more. If errors occur during data transmission due to packet size, the packets can be modified accordingly using the parameters *Fragment packets*, *Adjust maximum segment size (mssfix)*, *Link layer MTU (link-mtu)* and *Tunnel interface MTU (tun-mtu)*. These parameters should only be modified if one is aware of the effects and has consulted the OpenVPN reference manual. The *maximal wait time to establish connection* is the time, which is granted for the establishment of the OpenVPN tunnel within the WAN chain. If the tunnel cannot be established within this time, it is considered as not available in the WAN chain. 10. Click on SUBMIT. 11. Click in the *Network* → *Firewall / NAT* menu in the *IP filter* section on to add an IP filter exception (Firewall rule) for tunnel establishment. 12. Enter a reasonable *Description* (e.g. Tunnel establishment …) and select the *Packet direction* OUTPUT. 13. Select the *IP version* used for the tunnel and the *Protocol* used (*All* permits e.g. all IP versions or protocols). 14. Select the *Output interfaces* used for the tunnel (*All* permits e.g. all interfaces). 15. Enter as *Destination port* the port or ports entered above for the tunnel. 16. Click on SUBMIT. 17. Click in the *Network* → *Firewall / NAT* menu in the *IP filter* section on to add an IP filter exception (Firewall rule) for the traffic sent by the router into the tunnel. 18. Enter a reasonable *Description* (e.g. Traffic from router into tunnel …) and select the *Packet direction* OUTPUT. 19. Select the *IP version* used for the tunnel and the *Protocol* used (*All* permits e.g. all IP versions or protocols). 20. Select as *Output interface* above added OpenVPN interface (e.g. *openvpn2*). 21. Click on SUBMIT. 22. Click in the *Network* → *Firewall / NAT* menu in the *IP filter* section on to add an IP filter exception (Firewall rule) for the traffic received by the router from the tunnel. 23. Enter a reasonable *Description* (e.g. Traffic from tunnel into router …) and select the *Packet direction* INPUT. 24. Select the *IP version* used for the tunnel and the *Protocol* used (*All* permits e.g. all IP versions or protocols). 25. Select as *Input interface* above added OpenVPN interface (e.g. *openvpn2*). 26. Click on SUBMIT. 27. Click in the *Network* → *Firewall / NAT* menu in the *IP filter* section on to add an IP filter exception (Firewall rule) for the traffic from the local network into the tunnel. 28. Enter a reasonable *Description* (e.g. Traffic from local network into tunnel …) and select the *Packet direction* FORWARD. 29. Select the *IP version* used for the tunnel and the *Protocol* used (*All* permits e.g. all IP versions or protocols). 30. Select as *Input interface* the IP net of the router connected to the local network (e.g. *net1*). 31. Select as *Output interface* above added OpenVPN interface (e.g. *openvpn2*). 32. Click on SUBMIT. 33. Click in the *Network* → *Firewall / NAT* menu in the *IP filter* section on to add an IP filter exception (Firewall rule) for the traffic from the tunnel into the local network. 34. Enter a reasonable *Description* (e.g. Traffic from tunnel into local network …) and select the *Packet direction* FORWARD. 35. Select the *IP version* used for the tunnel and the *Protocol* used (*All* permits e.g. all IP versions or protocols). 36. Select as *Input interface* above added OpenVPN interface (e.G. *openvpn2*). 37. Select as *Output interface* the IP net of the router connected to the local network (e.G. *net1*). 38. Click on SUBMIT. 39. Activate the [profile](/kb/docs/en/profiles-and-profile-handling-en) with a click on ACTIVATE PROFILE . ### Configuration via OpenVPN configuration file We act on the assumption that the router is already configured with the networks for WAN (Internet) and LAN (local networks) and other functions. The OpenVPN client will then only be added to this functioning configuration. If OpenVPN connections are already configured, this connection will be added to the existing ones. > [!NOTE] > Please note! > > As the converter tool is only available for Windows, you need a PC with the Windows operating system for configuration. The converter tool enables the conversion of an existing OpenVPN configuration file into an ASCII configuration file, which can then be imported into the router to add the configuration of the OpenVPN client to the existing configuration. 1. Download the [converter tool](https://cdn.document360.io/c690fe99-a3eb-474c-a449-c2c75e5df119/Images/Documentation/openvpn_to_icom_os.zip), unzip the file to your configuration PC and execute the tool. 2. Click in the *File selection* section on *Load* and select the OpenVPN configuration file. 3. [Optional] In case CA certificate, client certificate and private key are not contained in the OpenVPN configuration file or the certificates contained therein shall not be used, proceed as follows: 1. Check the checkbox *Additional files* and choose between *Use individual certificates* (if you have individual certificate files) and *Use PKCS#12* (if the certificates are contained in a PKCS#12 container). 2. Upload the individual certificates or the container using the associated *Load* buttons. 3. [Optional] In case the OpenVPN server uses a static key for encryption (crypt) or only for authentication (auth), check the checkbox *Use TLS-auth/crypt* and upload the key using the associated *Load* button. 4. Enter in the *Interface Settings* section under *OpenVPN interface name* a descriptive name that shall be given this OpenVPN interface when adding it to the in router configuration. 5. Select the IP network interface of the router that is connected to the local network to which you want to connect via the OpenVPN connection. 6. Click on *Convert*. 7. Open the user interface of the router: [https://insys.icom](https://insys.icom) 8. Click in the *Administration* → *Profiles* menu in the *ASCII configurations* section on and upload the ASCII configuration file created using the converter tool (the file is located in the unzipped directory of the tool). 9. Click in the list in the *ASCII configurations* section on the line of above uploaded ASCII configuration file and select *Apply ASCII configuration*. 10. Click on APPLY ASCII CONFIGURATION. 11. Activate the [profile](/kb/docs/en/profiles-and-profile-handling-en) with a click on ACTIVATE PROFILE . ### Functional test Open the ![view dashboard outline](https://docs.insys-icom.de/assets/icons/view-dashboard-outline.png) *Status* → *Dashboard* page in the menu and observe the establishment of the WAN chain with the OpenVPN tunnel in the *WAN chain* section. ## Troubleshooting - The status of the WAN chain and their interfaces is displayed on the ![view dashboard outline](https://docs.insys-icom.de/assets/icons/view-dashboard-outline.png) *Status* → *Dashboard* page. If an interface does not achieve the **online** condition, its condition can also be examined on this page. - When configuring the OpenVPN connection with the Startup wizard, only the most important settings are made, but in most cases these are sufficient to establish a connection. If this is not possible, check the detailed settings of the OpenVPN connection. To do this, click on in the line of the created OpenVPN interface in the *Network* → *Interfaces* menu in the *OpenVPN* section to check or edit the settings. Click on *to extended view* at the top right to show the detailed settings. - In case the OpenVPN server requires a static key for authentication and encryption (tls-crypt) or only for authentication (tls-auth) additionally, or a user name/password combination for authentication additionally, these need to be configured also. - If no network traffic is achieved, the tools integrated in the router can be used for debugging. - Check in the ![view dashboard outline](https://docs.insys-icom.de/assets/icons/view-dashboard-outline.png) *Status* → *Log-View* menu the messages in the *OpenVPN* log. - Disable the IP filters for IPv4 in the *Network* → *Firewall / NAT* menu under *Settings IP filter* to check whether incorrect filter settings are the reason for connection problems. Standard IP address: https://192.168.1.1; login depending on configuration; default for earlier firmware versions: *User name*: **insys**, *Password*: **icom**