How to Start OpenVPN Automatically at Boot on CentOS & RHEL (systemd & SysVinit)

When configuring an unattended Linux server to maintain a persistent site-to-site or client OpenVPN tunnel, failing to register the profile with the init system means the VPN tunnel stays down after every kernel reboot or maintenance window.

In both modern systemd distributions and legacy SysVinit systems, OpenVPN expects configuration files inside /etc/openvpn/ to use the .conf extension rather than .ovpn.

Modern RHEL 8/9, Rocky Linux & CentOS 7+ (systemd)

On modern Enterprise Linux distributions (systemd), OpenVPN separates client and server unit templates into /etc/openvpn/client/ and /etc/openvpn/server/:

1. Copy your .ovpn profile into /etc/openvpn/client/ with a .conf extension and restrict permissions to root:

sudo install -m 600 my-tunnel.ovpn /etc/openvpn/client/my-tunnel.conf

2. Enable and start the parameterized openvpn-client@ systemd unit (matching the filename without .conf):

sudo systemctl enable --now [email protected]
sudo systemctl status [email protected]

Automatic Reconnection Hardening

To ensure the OpenVPN daemon automatically recovers if the upstream network link drops during boot, verify your .conf profile includes:

persist-key
persist-tun
resolv-retry infinite
keepalive 10 60

Legacy CentOS 6 (SysVinit & chkconfig)

On legacy CentOS 6 systems using SysVinit, the /etc/init.d/openvpn init script scans /etc/openvpn/*.conf at runlevels 3 and 5. Rename your .ovpn file to .conf and enable the service via chkconfig:

mv my-cert.ovpn /etc/openvpn/my-cert.conf
chmod 600 /etc/openvpn/my-cert.conf
chkconfig --level 35 openvpn on
service openvpn restart