# OpenVPN

An OpenVPN monitor authenticates with your credentials and brings up a tunnel from your `.ovpn` config.

:::tip[New to TunnelHQ?]
Start with the [Quick start](/docs/quickstart/).
:::

## Adding an OpenVPN monitor

Paste the contents of your `.ovpn` file into **Add monitor**, or upload the file. TunnelHQ reads the host, port, and protocol from the config's `remote` and `proto` lines.

| Field | Required | Details |
| --- | --- | --- |
| Config | Yes | The contents of the `.ovpn` file, pasted or uploaded. |
| Username, Password | Yes | The credentials the server expects. |

:::caution[Username and password required]
OpenVPN monitors need a username and password, as used by configs with `auth-user-pass`. When your config contains `auth-user-pass`, the Add dialog asks for them. A certificate-only config, without `auth-user-pass`, can't be added yet.
:::

After you add the monitor, you can change its host, port, and **Protocol** (`UDP` or `TCP`) in the monitor's settings.

```text title="client.ovpn"
client
dev tun
proto udp
remote vpn.example.com 1194
auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
…
-----END CERTIFICATE-----
</ca>
```

To monitor many OpenVPN servers at once, upload their `.ovpn` files in [Import monitors](/docs/import/).

## When a check fails

The most common failure is **Tunnel unreachable**, followed by a rejected configuration. Because OpenVPN uses credentials, a refusal from the server matters too.

- **Tunnel unreachable**: the tunnel didn't come up. Check that the server is running, and that the host, port, and protocol in the config's `remote` and `proto` lines match the server.
- **Couldn't complete this check — the monitor's configuration or credentials were rejected. The server's status is unknown.**: the config or credentials couldn't be used. The monitor shows **Unknown**, with no alert. Check them against a client that connects.
- **Server reachable — it rejected the monitor's credentials or certificate.**: the server answered and refused them. The monitor reads **Degraded** with no alert, unless it passed a check in the last 30 days: then TunnelHQ treats the refusal as an outage, and the monitor goes **Down** after its retries and alerts.

[What a failed check says](/docs/concepts/monitors/#what-a-failed-check-says) lists every failure message.