🔒 OpenVPN Go

A pure-Go OpenVPN client implementation with userspace TUN device.
No CGo. No system drivers. No root required for the tunnel itself.

Implements the full OpenVPN protocol stack — TLS handshake, reliable transport, data channel encryption, and raw IP packet I/O through a virtual TUN interface. Supports TCP and UDP protocols, tls-auth, tls-crypt, and multiple cipher/auth combinations.

---

✨ Features

🛡️ Full OpenVPN Protocol

• TLS Handshake — Complete OpenVPN control channel over TLS
• Hard Reset / Soft Reset — Standard OpenVPN session negotiation
• Reliable Transport Layer — Packet ordering, retransmission, and ACK management
• Data Channel Encryption — AES-CBC and AES-GCM cipher suites
• HMAC Authentication — SHA1, SHA256, SHA512 packet authentication
• Key Derivation — TLS 1.0 PRF (RFC 2246) for data channel key generation
• Packet ID Replay Protection — Sequential packet ID tracking with overflow detection

🔐 Security Features

• tls-auth — HMAC authentication of control channel packets
• tls-crypt — Encryption + authentication of control channel packets
• Static Key Parsing — OpenVPN static key V1 format support
• Key Direction — Configurable key direction (0/1) for tls-auth/tls-crypt
• Certificate Authentication — CA, client cert, and client key (file or inline)
• Username/Password Auth — auth-user-pass from file or inline block

🌐 Userspace TUN Device

• Pure-Go implementation — No kernel TUN/TAP drivers needed
• Raw IP packet I/O — Read/Write raw IPv4/IPv6 packets through the VPN tunnel
• net.Conn-compatible interface — Implements Read(), Write(), LocalAddr(), RemoteAddr()
• Tunnel info access — Retrieve assigned IP, gateway, IPv6, MTU, PeerID via TunnelInfo()
• Dual-stack support — IPv4 and IPv6 tunnel addresses

⚙️ Architecture

• 6-layer transport stack — NetworkIO → Muxer → Reliable → Control → TLS → Data
• Concurrent worker model — All protocol layers run as independent goroutines
• Channel-based message passing — Zero shared mutable state between workers
• Graceful shutdown — Worker manager with coordinated shutdown sequence
• Protocol framing — TCP length-prefixed and UDP raw framing support
• Functional options pattern — Flexible Config with WithConfigFile(), WithAuthFile(), WithLogger()

📝 Configuration

• Full .ovpn file parser — Reads standard OpenVPN configuration files
• Supported directives:
  • remote, proto (tcp/udp), cipher, auth, dev
  • ca, cert, key (file path or inline blocks)
  • auth-user-pass (file path or inline block)
  • tls-auth, tls-crypt (file path or inline blocks)
  • key-direction, tls-version-max
  • compress (empty/stub), comp-lzo no
  • proxy-obfs4 (pluggable transport support)
• Inline certificate support — <ca>, <cert>, <key>, <tls-auth>, <tls-crypt>, <auth-user-pass>
• Supported ciphers: AES-128-CBC, AES-192-CBC, AES-256-CBC, AES-128-GCM, AES-192-GCM, AES-256-GCM
• Supported auth: SHA1, SHA256, SHA512

🧪 Testing

• Integration tests — Real VPN connection tests with multiple providers
• VPNGate support — Test with public VPNGate servers (no auth required)
• Surfshark support — Test with Surfshark (tls-auth + external credentials)
• HTTP exit IP verification — Confirms traffic exits through the VPN
• Raw TCP packet builders — Full IPv4 + TCP packet construction with checksums

---

📦 Installation

go get github.com/galang-rs/ovpn

---

🚀 How to Use

As a Library

package main

import (
    "context"
    "fmt"
    "net"

    "github.com/galang-rs/ovpn/pkg/config"
    "github.com/galang-rs/ovpn/pkg/tunnel"
)

func main() {
    // 1. Load configuration from .ovpn file
    cfg := config.NewConfig(config.WithConfigFile("config.ovpn"))

    // 2. Start the VPN tunnel
    ctx := context.Background()
    tun, err := tunnel.Start(ctx, &net.Dialer{}, cfg)
    if err != nil {
        panic(err)
    }
    defer tun.Close()

    // 3. Get tunnel info
    ti := tun.TunnelInfo()
    fmt.Printf("Tunnel IP: %s\n", ti.IP)
    fmt.Printf("Gateway:   %s\n", ti.GW)
    fmt.Printf("MTU:       %d\n", ti.MTU)
    if ti.IPv6 != "" {
        fmt.Printf("IPv6:      %s/%s\n", ti.IPv6, ti.IPv6NetMask)
    }

    // 4. Read/Write raw IP packets
    buf := make([]byte, 4096)
    n, _ := tun.Read(buf)  // Read decrypted IP packet from VPN
    fmt.Printf("Received %d bytes\n", n)

    // tun.Write(ipPacket)  // Send IP packet through VPN
}

With External Auth File

cfg := config.NewConfig(
    config.WithConfigFile("surfshark.ovpn"),
    config.WithAuthFile("auth.txt"),      // username on line 1, password on line 2
)

As a CLI

# Build the CLI
go build -o ovpn ./cmd/ovpn/

# Run with a config file
./ovpn config.ovpn

# Or use default (config.ovpn in current directory)
./ovpn

With Programmatic Configuration

cfg := config.NewConfig(
    config.WithOpenVPNOptions(&config.OpenVPNOptions{
        Remote:   "vpn.example.com",
        Port:     "1194",
        Proto:    config.ProtoUDP,
        Cipher:   "AES-256-GCM",
        Auth:     "SHA512",
        Username: "myuser",
        Password: "mypass",
        CA:       caCertPEM,       // []byte
        Cert:     clientCertPEM,   // []byte
        Key:      clientKeyPEM,    // []byte
    }),
    config.WithLogger(myCustomLogger),
)

Auth File Format

username
password

Running Tests

# Test with VPNGate (public, no credentials needed)
go test ./pkg/vpn/... -v -run TestVPNConnectVPNGate -timeout 60s

# Test with Surfshark (requires valid auth.txt)
go test ./pkg/vpn/... -v -run TestVPNConnectSurfshark -timeout 60s

---

🏗️ Project Structure

ovpn/
├── cmd/
│   └── ovpn/
│       └── main.go                # CLI entry point
├── internal/
│   ├── bytesx/                    # Byte utilities
│   ├── domain/
│   │   ├── opcode.go              # OpenVPN opcodes (P_CONTROL_*, P_DATA_*, etc.)
│   │   ├── packet.go              # Packet serialization/deserialization
│   │   ├── session.go             # Session state & TunnelInfo
│   │   └── notification.go        # TLS notification types
│   ├── optional/                   # Generic Optional type
│   ├── port/                       # Port utilities
│   ├── security/
│   │   ├── hmac.go                # HMAC computation & verification
│   │   └── statickey.go           # OpenVPN static key V1 parser
│   ├── session/
│   │   ├── manager.go             # Session manager (state machine)
│   │   ├── datachannel_key.go     # Data channel key derivation (TLS PRF)
│   │   └── keysource.go           # Random key source generation
│   ├── transport/
│   │   ├── control/               # Control channel worker
│   │   ├── data/                  # Data channel worker
│   │   ├── muxer/                 # Protocol demuxer
│   │   ├── networkio/             # TCP/UDP I/O with framing
│   │   ├── reliable/             # Reliable transport (ACK, retransmit)
│   │   └── tls/                   # TLS session worker
│   ├── tunstack/
│   │   └── tun.go                 # Userspace TUN device
│   └── worker/
│       └── manager.go             # Goroutine lifecycle manager
├── pkg/
│   ├── config/
│   │   ├── config.go              # Config + functional options
│   │   ├── options.go             # OpenVPNOptions, ciphers, auth methods
│   │   └── parser.go             # .ovpn file parser (with inline blocks)
│   ├── tunnel/
│   │   └── tunnel.go              # Public tunnel API
│   └── vpn/
│       └── vpn_test.go            # Integration tests
└── go.mod

---

🔧 Dependencies

Zero external dependencies — uses only the Go standard library.

---

📄 License

MIT License

Copyright (c) 2026 Galang Reisduanto

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

---

ADDITIONAL TERMS:

1. Attribution — If you use this software in a product, an acknowledgment
   in the product documentation or "About" section would be appreciated
   but is not required.

2. Non-Endorsement — The name "galang-rs" or "Galang Reisduanto" may not
   be used to endorse or promote products derived from this software without
   specific prior written permission.

3. Good Faith — This software is shared in good faith for the benefit of
   the open-source community. Commercial use is permitted and encouraged.

---

📬 Feature Requests & Contact

Have an idea, bug report, or custom feature request? Feel free to reach out!

📧 Email: galangreisduanto@gmail.com

---

☕ Support & Donate

If this project helped you, consider buying me a coffee! Your support helps keep the project active and maintained.

📧 PayPal: galangreisduanto1@gmail.com

Every donation, no matter how small, is greatly appreciated and motivates continued development. 🙏

---

Made with ❤️ by Galang Reisduanto