KB
Access & VPN

OpenVPN Connect for iOS and Android

5 min read936 words2 code blocks

At a glance#

  • Purpose: Install and configure the OpenVPN Connect app on a user's phone or tablet so they can reach internal systems remotely.
  • Applies to: iOS 13+ and Android 8+.
  • Risk: Low — client-side configuration only.
  • Time: About 15 minutes per device.

Overview#

OpenVPN Connect is the official client from OpenVPN Inc. It reads a .ovpn profile — a single file containing the server address, protocol, certificates and keys — and uses it to build an encrypted tunnel.

The steps are nearly identical on iOS and Android. Both are covered below, with the differences called out.

Warning: A .ovpn profile usually embeds the user's private key and certificate. Anyone holding that file can connect to the internal network as that user. Distribute profiles through a channel you control — an internal file share or a password-protected archive — never over public email or messaging apps. Issue one profile per user, never a shared one.

Before you start#

You will need:

  • The user's .ovpn profile file, generated on the OpenVPN server for that specific person.
  • Their username and password, if the server uses password authentication in addition to certificates.
  • A device with internet access.
Note: If the profile has not been generated yet, create it on the OpenVPN server first. Each user should have their own so that access can be revoked individually by revoking their certificate.

Procedure — iOS (iPhone / iPad)#

1. Install the app#

  1. Open the App Store.
  2. Search for OpenVPN Connect — published by OpenVPN Inc.
  3. Tap Get to install.

2. Open the app and accept the data policy#

Launch OpenVPN Connect and review the data usage policy when prompted.

3. Get the profile onto the device#

iOS does not have an open file system, so the profile must arrive by one of these routes:

MethodHow
Files app (recommended)Save the .ovpn to iCloud Drive or on-device storage, then in OpenVPN Connect choose Import Profile → File and browse to it.
Share sheetTap the .ovpn in whichever app received it, choose the share icon, then Copy to OpenVPN.
URLIf the server publishes profiles over HTTPS, choose Import Profile → URL and enter the address.

4. Import and name the profile#

  1. Select the profile file.
  2. Tap Add.
  3. If prompted for a username, enter it and optionally save the password.
  4. Give the profile a recognisable name if several will be present.

5. Allow the VPN configuration#

iOS asks for permission to add a VPN configuration. Tap Allow and confirm with Face ID, Touch ID or the passcode. This is a one-time prompt per profile.

6. Connect#

Toggle the switch next to the profile. The status changes to Connected and a VPN badge appears in the status bar.

Procedure — Android#

1. Install the app#

  1. Open the Google Play Store.
  2. Search for OpenVPN Connect — published by OpenVPN Inc.
  3. Tap Install.

2. Open the app and accept the data policy#

3. Import the profile#

Android has a normal file system, so this is simpler:

  1. Tap Import Profile.
  2. Choose File.
  3. Browse to the .ovpn — usually in Downloads — or pick it from Google Drive.
  4. Tap Import.

Alternatively choose URL if the server publishes profiles over HTTPS.

4. Enter credentials#

Enter the username if prompted. Tick Save password only if the device is protected by a screen lock.

5. Allow the VPN connection request#

Android shows a system dialog asking permission to set up a VPN connection. Tap OK. This is a one-time prompt.

6. Connect#

Toggle the switch next to the profile. A key icon appears in the notification bar when connected.

Verification#

Confirm the tunnel is genuinely carrying traffic rather than just showing as connected:

  1. In the app, check that Bytes In and Bytes Out are both increasing.
  2. Visit an IP-checking site in a browser — the address shown should be the VPN's public IP, not the mobile carrier's.
  3. Open an internal resource that is only reachable over the VPN. This is the real test.

On the server, confirm the session appeared:

bash
sudo cat /var/log/openvpn/openvpn-status.log
sudo journalctl -u openvpn@server -n 50

Troubleshooting#

SymptomCause and fix
"No profiles imported" after selecting the fileThe file is not a valid .ovpn, or was corrupted in transfer. Re-send it, avoiding apps that alter attachments.
Connects then immediately dropsCertificate expired or revoked, or wrong credentials. Check the server log for the reason.
Connected but internal resources unreachableRoutes are not being pushed. Confirm the server config includes the relevant push "route ..." lines.
Connected but no internet at allFull-tunnel mode without a working DNS push. Confirm push "dhcp-option DNS ..." on the server.
TLS handshake failedServer unreachable on the configured port, or a firewall is blocking it. Confirm the port is open from the mobile network.
Works on Wi-Fi, fails on mobile dataSome carriers block UDP. Try a TCP profile on port 443.
iOS drops the VPN when the screen locksExpected iOS behaviour. Enable Seamless Tunnel and Connect on Demand in the app settings.
"Missing external certificate"The profile references a separate certificate file. Ask for a profile with the certificates embedded inline.

Revoking access#

When a user leaves, revoke their certificate on the server rather than relying on deleting the app:

bash
cd /etc/openvpn/easy-rsa
./easyrsa revoke username
./easyrsa gen-crl
sudo systemctl restart openvpn@server

Deleting the profile from the phone does nothing if the user kept a copy of the file.