Free OpenVPN on Windows, macOS and Linux
Desktop is where OpenVPN is at its best: no app store, no battery manager killing the tunnel, and full control over routing and DNS. It also has no one-tap import — that deep link only exists on mobile — so every route here starts with saving the file.
- A saved .ovpn file. Press Download on any server in the list; the file lands in your Downloads folder.
- Administrator or sudo rights. Creating a network interface is a privileged operation on every desktop OS, and no client can avoid it.
- The username and password, if the server's download dialog showed one. They are published with the config and shared by everybody — not an account.
Windows
OpenVPN GUI · Windows 10 and 11- 01
Install the OpenVPN community client
Get the Windows installer from OpenVPN's official community downloads page — take it from there and nowhere else, because the top search results for "openvpn download" are mirrors that bundle their own extras. Keep the default components — the Wintun driver is what creates the network adapter, and skipping it gives you a client that installs cleanly and then cannot connect to anything. The install needs administrator rights; running the tunnel afterwards does not.
- 02
Import the file
Right-click the OpenVPN GUI icon in the system tray (it may be hidden under the chevron) and choose Import → Import file…, then pick the .ovpn you saved. Equivalently, drop it into:
%USERPROFILE%\OpenVPN\config\
and then Reload configurations from the same menu. Profiles placed here belong to your user account only, which is what you want.
- 03
Connect
Right-click the tray icon again and pick the profile → Connect. A log window scrolls past; the icon turns green and a balloon shows the assigned IP when the tunnel is up. If the profile needs credentials, a prompt appears first — tick Save password to be asked once rather than every time.
macOS
Tunnelblick · Intel and Apple silicon- 01
Install Tunnelblick
Free, open source, and the long-standing default on the Mac. Download it from tunnelblick.net and nowhere else — the project warns about impostor download sites, and they rank well. Open the downloaded disk image and run the Tunnelblick app inside it; it installs itself and asks for your Mac password so it can set up its privileged helper. OpenVPN Connect also has a macOS build if you would rather stay with the official client; the import step below is the same idea in both.
- 02
Drag the .ovpn onto Tunnelblick
Drop the file onto the Tunnelblick icon in the menu bar or in Applications. It asks whether the configuration is for only me or for all users — choose only me — and then for your Mac password to install it. Double-clicking the file in Finder does the same thing.
- 03
Connect
Click the Tunnelblick icon in the menu bar and choose Connect [profile]. The icon fills in when the tunnel is up. On the first connection macOS may also ask to allow a network extension — that is the OS, not the server.
Linux
openvpn CLI · NetworkManager · systemd- 01
Install openvpn
sudo apt install openvpn # Debian, Ubuntu sudo dnf install openvpn # Fedora, RHEL sudo pacman -S openvpn # Arch
- 02
Run it against the file
sudo openvpn --config ~/Downloads/your-server.ovpn
It stays in the foreground and logs to the terminal, which is the fastest way to see what a server is doing. Initialization Sequence Completed is the line that means you are connected. Ctrl-C tears it down.
- 03
Supply credentials without being prompted
Put the username on the first line and the password on the second, then lock the file down:
printf '%s\n%s\n' 'username' 'password' > ~/vpn-auth chmod 600 ~/vpn-auth sudo openvpn --config server.ovpn --auth-user-pass ~/vpn-auth
- 04
Or import it into NetworkManager
For a tunnel you can toggle from the desktop's network menu like any other connection:
nmcli connection import type openvpn file ~/Downloads/your-server.ovpn nmcli connection up your-server
You may need network-manager-openvpn (and the matching GNOME plugin) installed first.
- 05
Or start it at boot with systemd
The unit reads its profile by name from /etc/openvpn/client/, and the extension must be .conf, not .ovpn:
sudo cp your-server.ovpn /etc/openvpn/client/hunt.conf sudo systemctl enable --now openvpn-client@hunt
When it does not work
Linux: DNS still goes to your ISP after connecting
The classic Linux leak. The openvpn command cannot rewrite /etc/resolv.conf by itself — it needs a helper script, and without one the server pushes DNS settings that are simply discarded. Install openvpn-systemd-resolved (or use the update-resolv-conf script shipped by your distribution) and add:
script-security 2 up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf
NetworkManager handles this for you, which is a good reason to prefer it.
Windows: "All TAP-Windows adapters on this system are currently in use"
A leftover adapter from a previous session or another VPN client. Reboot, or run Add a new TAP virtual ethernet adapter from the OpenVPN entry in the Start menu. On a modern install, switching the profile to Wintun avoids the whole class of problem.
macOS: Tunnelblick connects, then "no OpenVPN process"
Its privileged helper did not install or was invalidated by a macOS update. Quit Tunnelblick, launch it again, and let it ask for your password. If it does not ask, reinstall it — that repairs the helper.
AUTH_FAILED in the log
The server wants a username and password. They are on the same server's download dialog on this site, in the credentials block.
TLS handshake failed / it just times out
Either the server has gone away since the last probe — volunteer machines do, and it is exactly why we re-check every five minutes — or the port is blocked on your network. Corporate and university networks routinely allow only 443; try a TCP server on that port, or take the next server down the list.
Connected, but nothing loads
The OpenVPN daemon is alive and its own internet is not. Our probe measures the handshake, which proves the server is listening — it cannot prove the machine can reach anything on your behalf. Nothing to fix locally; move on to another server.
Before you rely on it
Once connected, check what the internet sees: search for "what is my IP" and confirm the address and country match the server you chose. Do the same for DNS with a leak test. It takes ten seconds and it is the only way to know the tunnel is doing what you think it is.
And the part no configuration file can change: the operator of that server can see every destination you visit. That is the actual trade you are making, on desktop as much as on a phone.