How to Use OpenVPN and When to Choose It

• Devices that only speak OpenVPN: router firmware (OpenWrt, Merlin, DD-WRT), NAS (Synology, QNAP), Linux servers, old systems. Hiddify does not install there and AnyConnect has no client.
• Unattended, connect-at-boot setups: the configuration is a single file that the system’s VPN settings can start at boot with no interface interaction.
• Daily use on phones and laptops: AnyConnect needs no import and Hiddify handles packet loss better; both are more convenient for daily use. OpenVPN tries UDP first and falls back to TCP automatically when UDP is blocked, so it stays connected; on such networks AnyConnect is faster.
• One account works with all three; there is no need to pick just one.

Pick your system and follow the screenshots. The button on the right plays the video, and any screenshot enlarges when you click it.

• iPhone and iPad have no video: install the official OpenVPN Connect from the table on this site’s OpenVPN page, log in and click a region’s flag to download its .ovpn file, then open or import it in the client and connect.
• Besides OpenVPN Connect, Windows can use OpenVPN GUI and macOS Tunnelblick; all read the same profile.
• Windows, macOS, Android and iOS profiles have credentials built in, so there is nothing to enter; only Linux asks for your site email and password on the first connection.
• One file per region; download as many as you need.

• OpenWrt router: install luci-app-openvpn, upload the .ovpn, enable it, and the whole LAN takes the route. A router on this site’s firmware skips this — just log in with the account.
• Synology NAS: Control Panel → Network → Network Interface → Create → VPN → OpenVPN (via importing a .ovpn file). Tick “Use default gateway on remote network” only if the NAS’s outbound traffic should take the route; leave it unticked if you only want the NAS reachable.
• QNAP NAS: QVPN → VPN Client → Add → OpenVPN, import the file.
• Linux desktop: Network settings → VPN → Import from file. Command line (install the openvpn package on Debian/Ubuntu first): openvpn --config <file> For start at boot, place the file in /etc/openvpn/client/ and enable the matching systemd unit.

Connected from inside China, all traffic leaves overseas and Chinese sites slow down on the detour. This site offers a “China direct” tool: download, double-click, and Chinese IPs go direct while everything else takes the route — shared by the Cisco and OpenVPN sections. The LAN is direct already and needs no handling.

Users abroad should ignore this tool — it sends Chinese sites around the route, the opposite of what watching Chinese video needs.

For finer rules (by domain, by app) use the router option or Hiddify routing rules.

1. Try another region’s profile. If another region connects, that one server is temporarily unreachable.
2. Read the log. AUTH_FAILED means wrong credentials or an expired account; a UDP timeout followed by a successful TCP connection means your network restricts UDP — it works, just slower; TLS handshake failed / TLS key negotiation failed on both UDP and TCP means the server is unreachable from this network — change network or region; after a password change, download the profile again, the old one’s password is dead.
3. Change networks. If broadband fails, try mobile data once and vice versa; on campus and office networks that block UDP, OpenVPN falls back to TCP and still connects but slowly — if it is too slow, switch to AnyConnect over TLS.
4. Update the client. Old OpenVPN clients do not understand the newer encryption settings and show import errors or connection failures.
5. After the account expires the server ends the session; reconnect after renewing, the profile stays valid.

The profile carries your credentials — it is the account. Do not send it to others or upload it anywhere public. If it leaks, change your password on the site: old files stop working immediately, then download again.

The handshake itself is encrypted: without the key in your profile nobody can even start one, so the servers are invisible to scanners. That is also why old clients must be updated — OpenVPN releases before 2.5 do not support this handshake.

Encryption is AES-256-GCM, comparable in strength to AnyConnect.