OpenVPN monitoring
To monitor an OpenVPN server, complete the same TLS handshake and login a real client does. TunnelHQ runs it from outside with your .ovpn config, every 1 to 5 minutes by plan, and alerts you in 20 channels when it fails.
TunnelHQ checks OpenVPN over UDP and TCP, with AES-256-GCM and ChaCha20 cipher suites, TLS-Auth and TLS-Crypt.
Why OpenVPN needs protocol-aware monitoring
OpenVPN's flexibility is also what makes it hard to monitor. A single server can be configured with dozens of cipher, auth, and compression combinations. A TCP port check against OpenVPN/443 returns a TLS handshake attempt to anything. Including a stopped openvpn process where systemd hasn't noticed yet.
Common silent failures that port-only monitors miss:
- Expired TLS certificate on the server side (cert chain still present but past
notAfter) - TLS-Auth key mismatch after a rotation
- Wrong cipher negotiation (server was reconfigured, client config wasn't updated)
- Stale OpenVPN process where the control channel responds but the data channel is broken
- MTU mismatches causing fragmentation-triggered handshake timeouts
TunnelHQ parses your .ovpn config and performs an actual OpenVPN control channel exchange, all the way through HMAC verification.
How TunnelHQ monitors OpenVPN
1. Upload your .ovpn config
Paste the config or upload the file. TunnelHQ parses:
remote <host> <port>. Endpointproto udp | tcp. Transportcipher/auth. Negotiated via TLS<ca>,<cert>,<key>,<tls-auth>,<tls-crypt>. Embedded keys and certs- Direction flags, compression settings
OpenVPN tunnels also need the username and password the server expects, as used by configs with auth-user-pass.
2. Real OpenVPN handshake
TunnelHQ negotiates the TLS control channel, verifies the server cert against the CA, exchanges the HMAC tls-auth/tls-crypt challenge, and validates the key material. Only a successful full exchange counts as "up".
3. UDP and TCP supported
OpenVPN's most common deployment is UDP/1194 for performance, TCP/443 for censorship resistance. TunnelHQ monitors both, and will distinguish between "UDP path blocked" vs. "server actually down".
4. Checks by country
Pin a tunnel to several countries (Pro and Business) and each is checked on its own. If OpenVPN fails from one but succeeds from others, you know it's regional. Often BGP routing, ISP-level blocking, or geographic rate-limiting. Not a server issue.
Alerts and integrations
Alerts go out on every state change to any of 20 channels, including:
- Email. Included in every plan
- Slack. Threaded with incident IDs
- Telegram, Discord. Bot integrations
- Webhook. Raw JSON POST for custom pipelines
What a failed check tells you
A failed check comes with a message that says where to look. On an OpenVPN tunnel the most common is Tunnel unreachable, followed by a rejected configuration. Because OpenVPN uses credentials, a refusal from the server matters too.
- Tunnel unreachable. The tunnel didn't come up. Check that the server is running, and that the host, port, and protocol in the config's
remoteandprotolines match the server. - Couldn't complete this check — the monitor's configuration or credentials were rejected. The server's status is unknown. The config or credentials couldn't be used. The tunnel shows Unknown, with no alert. Check them against a client that connects.
- Server reachable — it rejected the monitor's credentials or certificate. The server answered and refused them. The tunnel reads Degraded with no alert, unless it passed a check in the last 30 days: then TunnelHQ treats the refusal as an outage, and the tunnel goes Down after its retries and alerts.
Pricing for OpenVPN monitoring
All plans include OpenVPN monitoring.
| Plan | Tunnels | Check interval | Price |
|---|---|---|---|
| Free trial | 14 days free on every plan. Your card is charged on day 15, and you can cancel any time before. | ||
| Starter | 20 | 5 min | $12/mo or $84/yr |
| Pro | 100 | 2 min | $39/mo or $276/yr |
| Business | 500 | 1 min | $99/mo or $756/yr |
Read more
OpenVPN monitoring questions
Does TunnelHQ support both UDP and TCP OpenVPN?
Yes. Auto-detected from the proto line in your .ovpn config. Both are first-class.
What about tls-crypt-v2?
Supported. TunnelHQ handles tls-auth, tls-crypt, and tls-crypt-v2 keys. If your config uses embedded key material, paste the full config and TunnelHQ will use it directly.
Does TunnelHQ need my client certificate and private key?
Yes. Without the client cert/key, we can't do a real handshake. Everything is stored with AES-256-GCM encryption and never shared. For best hygiene, generate a dedicated monitoring client cert separate from your real users' credentials, and revoke it if you ever stop using TunnelHQ.
Can TunnelHQ monitor self-hosted OpenVPN Access Server?
Yes. Same .ovpn user-exported config format works. TunnelHQ doesn't need the admin interface; it just needs a standard client config.