Manual OpenVPN

OpenVPN

Location: Connection → OpenVPN (status at Status → OpenVPN Status)

Configures the router as either an OpenVPN client (connecting out to a remote VPN) or an OpenVPN server (letting remote devices connect in). Choose your mode from OpenVPN Configuration: Disabled / Client / Server. A live OpenVPN Status readout shows Running-Connected, Running-Not-Connected, or Not Running. A Clear All Existing OpenVPN Keys button is available if you need to start over — it warns before permanently deleting your current keys.

Server mode

Configuration: internal tunnel IP and subnet mask, port, protocol (UDP/TCP), and a multi-select Cipher list (ChaCha20-Poly1305, AES-GCM 256/128-bit, AES-CBC 256/128-bit) the server will negotiate with clients. Client-to-Client Traffic controls whether connected clients can see each other or only the server; LAN Subnet Access controls whether clients can reach your actual home network or just the VPN tunnel itself. If LAN access is allowed, Advertised Additional Server Subnets lets you tell clients about other subnets this server can route to. Credential Re-Use decides whether each client needs its own unique credentials or several clients can share one set. Clients Use VPN For chooses full-tunnel (all client traffic) vs. split-tunnel (only traffic destined for something behind the VPN).

Allowed Clients: add a client with a name, its internal tunnel IP, how it connects to the server (DDNS name / WAN IP / another domain), and optionally a subnet routed behind that client (for a site-to-site setup rather than a single road-warrior device). Each configured client gets a Download button producing a .zip or .ovpn file ready to drop into that client's OpenVPN app.

The very first time you enable Server mode, expect a 5–10 minute one-time wait while cryptographic parameters are generated — the page warns you before starting.

Client mode

Two ways to configure:

• Upload Client Configuration File(s) — a single zip, individual files, or a single .ovpn, depending on what your VPN provider gave you.
• Configure Manually — server address/port/protocol/cipher, plus a Non-OpenVPN Traffic choice: Allow (lets traffic fall back to your normal internet connection if the VPN drops) or Block All (safer if the whole point is that traffic must never leave un-tunneled, at the cost of losing internet entirely if the VPN fails).

Note: Gargoyle does not support TAP-mode OpenVPN configurations — only TUN.

Status → OpenVPN Status

A live table of connected clients (server mode) — connected-from address and connected-since time — or "No Clients Connected."

See also

• WireGuard — a newer VPN option with similar client/server structure
• DDNS — configuring a domain name clients can use to reach a server behind a dynamic IP