Setting Up OpenVPN, NAT and Routing on Windows Server 2025

Last updated: Aug 1, 2026

This tutorial explains how to install and configure an OpenVPN server on Microsoft Windows Server 2025. It covers the complete setup, including server and client configuration, certificate generation, Windows Firewall rules, and NAT and LAN routing with RRAS. This allows remote VPN clients to access hosts on the private network behind the OpenVPN server.

OpenVPN is a powerful VPN solution that offers several advantages:
- Free and open source
- Compatible with most operating systems
- Reliable and supported by an active community
- Relatively easy to deploy
- Highly configurable

Network diagram

We will first deploy a simple OpenVPN setup in which a Windows client establishes a VPN connection to a Windows Server 2025 host.

OpenVPN Server

OpenVPN server properties:
- Operating system: Windows Server 2025
- Role: OpenVPN server
- LAN IP address: 192.168.0.200
- VPN IP address: 10.50.8.1
- VPN network: 10.50.8.0/24
- Protocol and port: UDP 1194

Prerequisites

OpenSSL

OpenSSL is required to generate the certificates and private keys used to authenticate the OpenVPN server and its clients. On Windows Server 2025, this tutorial uses the Win64 OpenSSL packages provided by Shining Light Productions.

Download OpenSSL

Download the latest 64-bit version of Win64 OpenSSL Light.

Win32 and Win64 OpenSSL download page with the Win64 OpenSSL Light installer for 64-bit Windows highlighted — Download the latest **Win64 OpenSSL Light** installer for 64-bit Windows systems.

Install OpenSSL

Start the OpenSSL installer. If the required Microsoft Visual C++ 2026 Redistributable (x64) is missing, click Yes to download it:

OpenSSL setup warning indicating that Microsoft Visual C++ Redistributable for 64-bit systems is missing, with the Yes button highlighted — Click **Yes** to download the Microsoft Visual C++ Redistributable required by OpenSSL.

Run the downloaded installer, accept the license terms, and click Install. When the installation completes, click Close:

Microsoft Visual C++ Redistributable x64 installer showing the license agreement, Install button and successful installation screen — Accept the license terms, install the Microsoft Visual C++ Redistributable, then close the installer after setup completes successfully.

Select I accept the agreement, then click Next:

OpenSSL Light installer displaying the license agreement with the I accept the agreement option selected — Accept the OpenSSL license agreement to continue the installation.

Keep the default installation folder, or select another destination, then click Next:

OpenSSL Light installer showing the default installation folder C:\Program Files\OpenSSL-Win64 — Keep the default OpenSSL installation folder, or select another destination, then click **Next**.

Keep the default Start Menu folder, or choose another one, then click Next:

OpenSSL Light installer showing OpenSSL as the default Start Menu folder — Keep the default **OpenSSL** Start Menu folder, or choose another folder, then click **Next**.

Select The OpenSSL binaries (bin) directory, then click Next:

OpenSSL Light installer showing the OpenSSL binaries bin directory option selected for the DLL files — Select **The OpenSSL binaries (bin) directory** as the destination for the OpenSSL DLL files, then click **Next**.

Review the installation settings, then click Install:

OpenSSL Light installer displaying the selected destination folder, Start Menu folder and DLL location before installation — Review the OpenSSL installation settings, then click **Install** to begin.

When the installation is complete, click Finish to close the setup wizard (and make a donation if you can to support the project lead 😊):

OpenSSL Light setup wizard confirming that the installation is complete and displaying optional donation choices — Click **Finish** to close the OpenSSL setup wizard after the installation completes.

Add OpenSSL to the System Path

Add the OpenSSL bin directory to the Windows system Path environment variable so that the openssl command can be run from any Command Prompt or PowerShell session.

Run SystemPropertiesAdvanced to open the advanced system settings:

Windows Run dialog with SystemPropertiesAdvanced entered to open Advanced System Properties with administrative privileges — Run `SystemPropertiesAdvanced` to open the Advanced System Properties window.

On the Advanced tab, click Environment Variables…:

Windows System Properties window on the Advanced tab with the Environment Variables button highlighted — Click **Environment Variables…** from the **Advanced** tab of the System Properties window.

Under System variables, select Path, then click Edit…:

Windows Environment Variables window with the Path entry selected under System variables and the Edit button highlighted — Under **System variables**, select **Path**, then click **Edit…**.

Click New, add %ProgramFiles%\OpenSSL-Win64\bin, then click OK to save the change:

Windows Edit environment variable window showing %ProgramFiles%\OpenSSL-Win64\bin added to the system Path — Click **New**, add `%ProgramFiles%\OpenSSL-Win64\bin` to the system **Path**, then click OK.

Open a new PowerShell window and run the following command to verify that OpenSSL is available from the system Path:

PowerShell window showing the openssl version command and the installed OpenSSL version — Run `openssl version` in a new PowerShell window to verify that OpenSSL is installed and available in the system **Path**.

Windows Firewall

Windows Firewall must allow inbound OpenVPN connections on UDP port 1194. An additional ICMPv4 rule can also be created to allow VPN clients to test connectivity to the server with the ping command.

From an elevated Command Prompt, create the inbound OpenVPN rule:

C:\Windows\system32> netsh advfirewall firewall add rule name="OpenVPN UDP 1194" dir=in action=allow protocol=UDP localport=1194

Optionally, allow ICMP echo requests from the OpenVPN network:

C:\Windows\system32> netsh advfirewall firewall add rule name="OpenVPN ICMPv4 Echo" dir=in action=allow protocol=ICMPv4:8,any remoteip=10.50.8.0/24

Alternatively, create the same rules from an elevated PowerShell session:

PS C:\> New-NetFirewallRule -DisplayName "OpenVPN UDP 1194" -Direction Inbound -Action Allow -Protocol UDP -LocalPort 1194

PS C:\> New-NetFirewallRule -DisplayName "OpenVPN ICMPv4 Echo" -Direction Inbound -Action Allow -Protocol ICMPv4 -IcmpType 8 -RemoteAddress 10.50.8.0/24

Installing OpenVPN

Download the latest 64-bit OpenVPN Community Edition installer for Windows from the official OpenVPN download page.

OpenVPN Community Edition download page showing the 64-bit Windows MSI installer — Download the latest OpenVPN Community Edition MSI installer for 64-bit Windows systems.

Because this installation will be used as an OpenVPN server, select Customize to choose the required components:

OpenVPN setup window displaying the Install Now and Customize options, with Customize highlighted — Select **Customize** to choose the OpenVPN components installed on the server.

Ensure that OpenVPN Service is selected. The OpenVPN Pre-Logon Access Provider component is optional and is not required for a standard OpenVPN server installation:

OpenVPN custom installation window showing OpenVPN Service and the optional OpenVPN Pre-Logon Access Provider component — eep **OpenVPN Service** selected. The **OpenVPN Pre-Logon Access Provider** component is optional and can be disabled for a standard server installation.

Select EasyRSA 3 Certificate Management Scripts to generate the certificates and private keys required by the OpenVPN server and clients:

OpenVPN custom installation window showing EasyRSA 3 Certificate Management Scripts selected under OpenSSL Utilities and the Install Now button highlighted — Select **EasyRSA 3 Certificate Management Scripts**, then click **Install Now** to install OpenVPN and its certificate-management tools.

When the installation is complete, click Close:

OpenVPN setup window confirming that the installation is complete, with the Close button highlighted — Click **Close** after the OpenVPN installation completes.

Certificates and PKI

Set Up the Certificate Authority and Generate Certificates

In this section, we will use Easy-RSA to create a Public Key Infrastructure (PKI), including the Certificate Authority, server certificate, client certificate, and their associated private keys.

Open Windows Terminal, then select the Command Prompt profile:

Search for Terminal, then open the Command Prompt profile.

Run the following commands to open the Easy-RSA shell:

C:\Windows\system32> cd "C:\Program Files\OpenVPN\easy-rsa"

C:\Program Files\OpenVPN\easy-rsa> .\EasyRSA-Start.bat

Welcome to the EasyRSA 3 Shell for Windows.
Easy-RSA 3 is available under a GNU GPLv2 license.

Invoke 'easyrsa' to call the program. Without commands, help is displayed.

Using directory: C:/Program Files/OpenVPN/easy-rsa


EasyRSA-Shell: #

Initialize a new Public Key Infrastructure (PKI):

EasyRSA-Shell: # ./easyrsa init-pki

Easy-RSA shell running the easyrsa init-pki command and asking for confirmation before removing and reinitializing the existing PKI directory — Run `./easyrsa init-pki`. If an existing PKI directory is detected, type `yes` to replace it and initialize a new one.

Create the Certificate Authority (CA). Enter a strong passphrase to protect the CA private key, then specify a Common Name:

EasyRSA-Shell: # ./easyrsa build-ca
[…]
Enter PEM pass phrase:MyPassW0rd
Verifying - Enter PEM pass phrase:MyPassW0rd
[…]
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:ovpn

Generate and sign the OpenVPN server certificate and private key:

EasyRSA-Shell: # ./easyrsa build-server-full server nopass
[…]
Confirm request details: yes
[…]
Enter pass phrase for c:\Program Files\OpenVPN\easy-rsa\pki\private\ca.key:MyPassW0rd

Generate the Diffie-Hellman parameters used by the OpenVPN server:

EasyRSA-Shell: # ./easyrsa gen-dh

Generate and sign a client certificate and private key named client01:

EasyRSA-Shell: # ./easyrsa build-client-full client01 nopass
[…]
Confirm request details: yes
[…]
Enter pass phrase for c:\Program Files\OpenVPN\easy-rsa\pki\private\ca.key:MyPassW0rd

🚨 Security note: The nopass option creates private keys without passphrase protection. This simplifies unattended startup for the server and avoids prompting users when they connect, but anyone who obtains a private key may use it immediately. Protect these files carefully and consider omitting nopass for client certificates when stronger security is required.

Copy the Server Certificates and Keys

Copy the following OpenVPN server files to C:\Program Files\OpenVPN\config-auto:

ca.crt from C:\Program Files\OpenVPN\easy-rsa\pki
dh.pem from C:\Program Files\OpenVPN\easy-rsa\pki
server.crt from C:\Program Files\OpenVPN\easy-rsa\pki\issued
server.key from C:\Program Files\OpenVPN\easy-rsa\pki\private

Windows File Explorer showing ca.crt, client.ovpn, client01.crt and client01.key in the OpenVPN client configuration directory — Place the CA certificate, client certificate, private key and `client.ovpn` file in the selected OpenVPN client configuration directory.

OpenVPN Server Configuration File

Create or edit C:\Program Files\OpenVPN\config-auto\server.ovpn using a text editor running with administrator privileges:

# Listen for OpenVPN client connections on UDP port 1194
port 1194
proto udp
dev tun

# Server certificate and cryptographic files
ca ca.crt
cert server.crt
key server.key
dh dh.pem

# VPN address pool assigned to connected clients
server 10.50.8.0 255.255.255.0
ifconfig-pool-persist ipp.txt

# Detect inactive or disconnected clients
keepalive 10 120

# Preserve the key and tunnel interface across restarts
persist-key
persist-tun

# Write connection status information to this file
status openvpn-status.log

# Logging verbosity
verb 3

Restart the OpenVPN Service

Restart OpenVPNService to load the new server configuration.

Run services.msc to open the Windows Services management console:

Windows Run dialog with services.msc entered to open the Services management console — Run `services.msc` to open the Windows Services management console.

Right-click OpenVPNService, then select Restart:

Windows Services management console showing the OpenVPNService context menu with the Restart command highlighted — Right-click **OpenVPNService**, then select **Restart** to reload the OpenVPN server configuration.

Alternatively, restart the service from an elevated Command Prompt:

C:\Windows\system32> net stop OpenVPNService
C:\Windows\system32> net start OpenVPNService

Or restart it from an elevated PowerShell session:

PS C:\> Restart-Service -Name OpenVPNService -PassThru

Windows Client Configuration

Install OpenVPN on the Windows Client

Download the same 64-bit OpenVPN Community Edition installer used on the server from the official OpenVPN download page, then install it using the default options.

Copy the Client Certificates and Private Key

Copy the following files from the OpenVPN server:

ca.crt from C:\Program Files\OpenVPN\easy-rsa\pki
client01.crt from C:\Program Files\OpenVPN\easy-rsa\pki\issued
client01.key from C:\Program Files\OpenVPN\easy-rsa\pki\private

Place the files in one of the following OpenVPN configuration directories on the Windows client:

C:\Users\user\OpenVPN\config\ — recommended for a per-user configuration
C:\Program Files\OpenVPN\config\ — available system-wide and requires administrator privileges

🚨 Security note: The client01.key file contains the client's private key. Transfer it securely and restrict access to the intended user and administrators.

The client configuration directory should now contain the following files:

Windows File Explorer showing the OpenVPN config directory containing ca.crt, client.ovpn, client01.crt and client01.key — Place the CA certificate, client certificate, private key and `client.ovpn` configuration file in `C:\Program Files\OpenVPN\config`.

Create the client.ovpn configuration file in either C:\Users\user\OpenVPN\config\ or C:\Program Files\OpenVPN\config\:

# Configure this file as an OpenVPN client profile
client

# Use a routed IP tunnel
dev tun

# Connect to the server over UDP
proto udp

# Replace this hostname with the public IP address or DNS name
# of your OpenVPN server
remote WAN.STD.ROCKS 1194

# Retry DNS resolution indefinitely if the server is unavailable
resolv-retry infinite

# Do not bind the client to a fixed local port
nobind

# Preserve the private key and tunnel interface across reconnects
persist-key
persist-tun

# Client certificate and private key
ca ca.crt
cert client01.crt
key client01.key

# Logging verbosity
verb 3

Run OpenVPN GUI with administrator privileges, then connect to the VPN profile:

OpenVPN GUI context menu opened from the Windows notification area with the Connect command highlighted — Right-click the **OpenVPN GUI** icon in the Windows notification area, then select **Connect**.

An OpenVPN notification confirms that the connection has been established:

OpenVPN GUI notification confirming that the client is connected and has been assigned the VPN address 10.50.8.6 — The OpenVPN GUI notification confirms that the VPN connection is established and that the client has received the address `10.50.8.6`.

Use the VPN address 10.50.8.1 to test connectivity to the OpenVPN server:

Windows PowerShell showing successful ping replies from the OpenVPN server at 10.50.8.1, with File Explorer accessing a server share through the same VPN address — Verify the VPN connection by pinging `10.50.8.1` and accessing a server share through `\\10.50.8.1`.

Enabling Routing and NAT

At this stage, the remote Windows client can connect to the OpenVPN server and reach its VPN address. To access other hosts on the remote LAN 192.168.0.0/24, we must enable LAN routing and Network Address Translation (NAT) on Windows Server 2025.

🚨 Note: With the NAT configuration described below, VPN clients can access hosts on the 192.168.0.0/24 LAN. However, the OpenVPN server itself may not be reachable through its LAN address 192.168.0.200. In that case, use its VPN address 10.50.8.1 instead.

OpenVPN architecture showing a Windows client connecting through UDP port 1194 to Windows Server 2025, with routing and NAT between the VPN network 10.50.8.0/24 and the remote LAN 192.168.0.0/24 — OpenVPN routing and NAT architecture allowing a remote Windows client to access hosts on the `192.168.0.0/24` LAN through Windows Server 2025.

OpenVPN Server

Update the Server Configuration

Edit C:\Program Files\OpenVPN\config-auto\server.ovpn with administrator privileges, then add a pushed route for the remote LAN:

port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh.pem

server 10.50.8.0 255.255.255.0
ifconfig-pool-persist ipp.txt

# Advertise the remote LAN to connected VPN clients
push "route 192.168.0.0 255.255.255.0"

# Optional: configure an internal DNS server for VPN clients
push "dhcp-option DNS 192.168.0.200"

keepalive 10 120

persist-key
persist-tun

status openvpn-status.log

verb 3

💡 Note: Keep the dhcp-option DNS directive only if 192.168.0.200 is actually running a DNS service that should be used by the VPN clients.

Restart OpenVPNService from an elevated PowerShell session to apply the new configuration:

PS C:\> Restart-Service -Name OpenVPNService -PassThru

Install the Routing Role Service

Open an elevated PowerShell session and run the following command to install the Windows Routing role service and its management tools:

PS C:> Install-WindowsFeature -Name Routing -IncludeManagementTools

Configure Routing and Remote Access

Run rrasmgmt.msc to open the Routing and Remote Access management console:

Windows Run dialog with rrasmgmt.msc entered to open the Routing and Remote Access management console — Run `rrasmgmt.msc` to open the **Routing and Remote Access** management console.

Right-click the server name, then select Configure and Enable Routing and Remote Access:

Routing and Remote Access console showing the server context menu with Configure and Enable Routing and Remote Access highlighted — Right-click the server in the **Routing and Remote Access** console, then select **Configure and Enable Routing and Remote Access**.

Click Next to start the Routing and Remote Access Server Setup Wizard:

Routing and Remote Access Server Setup Wizard welcome screen with the Next button highlighted — Click **Next** to begin configuring Routing and Remote Access.

Select Custom configuration, then click Next:

Routing and Remote Access Server Setup Wizard showing Custom configuration selected and the Next button highlighted — Select **Custom configuration** to choose the required RRAS services manually, then click **Next**.

Select NAT and LAN routing, then click Next:

Routing and Remote Access Server Setup Wizard showing NAT and LAN routing selected in the custom configuration options — Select **NAT** and **LAN routing** to enable traffic forwarding between the OpenVPN network and the remote LAN, then click **Next**.

Review the selected services, then click Finish:

Routing and Remote Access Server Setup Wizard completion screen summarizing the NAT and LAN routing services, with the Finish button highlighted — Review the selected **NAT** and **LAN routing** services, then click **Finish** to complete the RRAS configuration.

Click Start service to start the Routing and Remote Access service. At this stage, the VPN client should be able to reach the Windows Server 2025 host through its LAN address 192.168.0.200 or its VPN address 10.50.8.1, depending on the routing and firewall configuration:

Routing and Remote Access dialog indicating that the service is ready to use, with the Start service button highlighted — Click **Start service** to start the **Routing and Remote Access** service.

To allow VPN clients to access hosts on the remote LAN, add the LAN network interface to the RRAS NAT configuration:

Routing and Remote Access console showing the IPv4 NAT context menu with the New Interface option highlighted — Right-click **NAT** under **IPv4**, then select **New Interface…** to add an interface to the NAT configuration.

Select the network interface connected to the remote LAN, here Ethernet1 with the address 192.168.0.200, then click OK:

RRAS New Interface for Network Address Translation window showing Ethernet1 selected from the available network interfaces — Select **Ethernet1**, the interface connected to the `192.168.0.0/24` LAN, then click OK.

In the interface properties, select Public interface connected to the Internet, enable NAT on this interface, then click OK:

💡 Note: Although RRAS labels this option Public interface connected to the Internet, the selected interface is the server interface connected to the remote LAN in this configuration. RRAS will translate traffic originating from the OpenVPN network before forwarding it to the LAN.

Network Address Translation properties for Ethernet1 showing Public interface connected to the Internet and Enable NAT on this interface selected — Select **Public interface connected to the Internet**, enable **NAT on this interface**, then click OK.

OpenVPN Client

Open a Command Prompt and run route print to verify that the route to the remote LAN 192.168.0.0/24 has been added by OpenVPN:

Windows Command Prompt showing the route print output with the route to 192.168.0.0/24 through the OpenVPN tunnel highlighted — Run `route print` and verify that a route to `192.168.0.0/24` is present through the OpenVPN tunnel.

Test connectivity to hosts on the remote LAN:

Two Windows Command Prompt windows showing successful ping replies from the OpenVPN server at 192.168.0.200 and the remote router at 192.168.0.254 — Verify access to the remote LAN by pinging the OpenVPN server at `192.168.0.200` and the router at `192.168.0.254` through the VPN tunnel.