What's the proper and most secure and convenient way of connecting a VPN over OpenVPN in Debian 9.1 with KDE?

Is that:

  • Running sudo openvpn --config config-path in the console and leaving the console window opened to connect / stay connected
  • Pressing ctrl+c to disconnect

With the most secure and convenient way I mean something that potentially would also allow me to switch between IPs in OpenVPN without non-VPN traffic and ensures (or allows me to ensure) that I'm connected to my VPN all the time with OpenVPN.

  • Your way sounds fine, as far as I know, just inconvenient. You can add the OpenVPN connection information to Network Manager for fast connect/disconnect. You can also run openvpn --daemon in your console to do the configuration and go to background and then pkill openvpn later to disconnect.
    – Patrick
    Sep 2, 2017 at 14:48

2 Answers 2


A secure and also easy way is to use iptables because it works even before and after the tun device is available.

for ip in "${vpn_only_addresses[@]}"; do
    iptables -A OUTPUT -d "$ip" -o "$openvpn_if" -j ACCEPT
    iptables -A OUTPUT -d "$ip" -j DROP

Maybe something similar could be done with advanced routing. Perhaps ip rule can work with output interface rules even when the interface does not exist. But that is more complicated that this Netfilter solution.


How to securely connect to openvpn?

From the openvpn docs:

Running the OpenVPN client with the downloaded client config file:

Usually, the easiest way to install an OpenVPN client is to use the --config argument to specify the location of the downloaded client config file:

openvpn --config client.ovpn 

You can use the --daemon option to run openvpn on background as a daemon according to the openvpn manpages:

--daemon [progname]

Become a daemon after all initialization functions are completed. This option will cause all message and error output to be sent to the syslog file (such as /var/log/messages), except for the output of scripts and ifconfig commands, which will go to /dev/null unless otherwise redirected. The syslog redirection occurs immediately at the point that --daemon is parsed on the command line even though the daemonization point occurs later. If one of the --log options is present, it will supercede syslog redirection.

openvpn --config client.ovpn --daemon

How to securely disconnect openvpn?

According to the man page and the official docs openvpn accept SIGINIT and SIGTERMsignals allowing openvn to exit securely.

SIGINT, SIGTERM Causes OpenVPN to exit gracefully.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .