# How to Start OpenVPN Automatically at Boot on CentOS & RHEL (systemd & SysVinit)

> How to configure OpenVPN client and server profiles to start automatically on boot in RHEL, Rocky Linux, and CentOS using systemd or legacy chkconfig.

- Canonical URL: <https://carlossura.com/blog/start-openvpn-at-boot-centos-6/>
- Author: Carlos Sura
- Published: 2019-09-24
- Updated: 2026-10-20
- Tags: linux, centos, vpn, openvpn, systemd, rhel

When configuring an unattended Linux server to maintain a persistent site-to-site or client **OpenVPN** tunnel, failing to register the profile with the init system means the VPN tunnel stays down after every kernel reboot or maintenance window.

In both modern `systemd` distributions and legacy SysVinit systems, OpenVPN expects configuration files inside `/etc/openvpn/` to use the `.conf` extension rather than `.ovpn`.

---

## Modern RHEL 8/9, Rocky Linux & CentOS 7+ (`systemd`)

On modern Enterprise Linux distributions (`systemd`), OpenVPN separates client and server unit templates into `/etc/openvpn/client/` and `/etc/openvpn/server/`:

1. Copy your `.ovpn` profile into `/etc/openvpn/client/` with a `.conf` extension and restrict permissions to `root`:

```bash
sudo install -m 600 my-tunnel.ovpn /etc/openvpn/client/my-tunnel.conf
```

2. Enable and start the parameterized `openvpn-client@` systemd unit (matching the filename without `.conf`):

```bash
sudo systemctl enable --now openvpn-client@my-tunnel.service
sudo systemctl status openvpn-client@my-tunnel.service
```

---

## Automatic Reconnection Hardening

To ensure the OpenVPN daemon automatically recovers if the upstream network link drops during boot, verify your `.conf` profile includes:

```ini
persist-key
persist-tun
resolv-retry infinite
keepalive 10 60
```

---

## Legacy CentOS 6 (`SysVinit` & `chkconfig`)

On legacy CentOS 6 systems using SysVinit, the `/etc/init.d/openvpn` init script scans `/etc/openvpn/*.conf` at runlevels `3` and `5`. Rename your `.ovpn` file to `.conf` and enable the service via `chkconfig`:

```bash
mv my-cert.ovpn /etc/openvpn/my-cert.conf
chmod 600 /etc/openvpn/my-cert.conf
chkconfig --level 35 openvpn on
service openvpn restart
```