Configuring a Windows PC as an OpenVPN Server for Multiple-Site VPN

The target environment connects approximately four sites to the same VPN: one server site and three client sites.
An OpenVPN server runs on a Windows PC, while a Raspberry Pi is used only for DDNS updates, not as an OpenVPN server.

The VPN endpoint is unified as <vpn-hostname> (example: vpn.example.org:1194/UDP), and existing internet traffic for each site continues to use normal local internet lines.
Only 10.77.0.0/24 is sent through the tunnel in a split-tunnel setup.

Overall Architecture

                             Internet
                                |
                      vpn.example.org
                            UDP 1194
                                |
                       Server-site Router
                                |
                         Windows PC (OpenVPN Server)
                            10.77.0.1
                     /        |         \
                    /         |          \
         10.77.0.11   10.77.0.12   10.77.0.13
         client-01     client-02     client-03

Raspberry Pi:
- Monitor the server site's dynamic public IPv4
- Run DDNS updates (XServer A record) only

1. DNS Policy for the VPN Host

Configure vpn.example.org as a dedicated A record, separate from the website’s DNS records, pointing to the OpenVPN server site’s public IPv4 address.

DNS	Value
Parent domain A records	185.199.108.153 / 185.199.109.153 / 185.199.110.153 / 185.199.111.153
`vpn.example.org` A record	current server-site IPv4 (`<server-site public IPv4>`)
TTL	300

2. Using XServer DNS as DDNS

The nameservers used are XServer (ns1.xdomain.ne.jp / ns2.xdomain.ne.jp / ns3.xdomain.ne.jp).
The Raspberry Pi calls the API to update vpn.example.org, but does not call it every time.

systemd timer runs every five minutes.
Update logic:

Get current global IPv4
Compare with /var/lib/xserver-ddns/last_ip
Exit without API call if unchanged
Call API if changed
Update last_ip only on success

Check commands:

sudo cat /var/lib/xserver-ddns/last_ip
systemctl list-timers xserver-ddns.timer
journalctl -u xserver-ddns.service -n 30 --no-pager

From Windows, confirm only DNS resolution:

Resolve-DnsName vpn.example.org -Type A

3. OpenVPN Server (Windows) Design

Server Requirements

Using OpenVPN Community Edition 2.7.x with subnet 10.77.0.0/24.
OpenVPN server address is 10.77.0.1.

Server: 10.77.0.1/24
Client-to-client: enabled

Build Steps and Server Configuration

Install OpenVPN Community Edition 2.7.x on the Windows PC and run the server through OpenVPNService. Build the configuration in this order:

Configure the VPN subnet and UDP listener in the server configuration
Issue a client certificate with a unique Common Name for each PC
Create a CCD file whose name matches each Common Name
Create a separate .ovpn profile for each client
Start OpenVPNService, then check the listener and log

The network-related portion of the server configuration is:

port 1194
proto udp
dev tun
topology subnet
server 10.77.0.0 255.255.255.0
client-config-dir ccd
client-to-client
persist-key
persist-tun
verb 3

Explicitly setting topology subnet makes each CCD ifconfig-push pair represent a client address and subnet mask. Adjust the client-config-dir path to the directory where the CCD files are stored.

To preserve split tunneling, do not configure or push redirect-gateway. Only traffic for the VPN subnet 10.77.0.0/24 enters the tunnel; ordinary internet traffic continues to use each site’s default route.

Client Static IP (CCD)

Do not share one .ovpn for all clients.
Issue separate certificates per client and fix addresses in ccd.

client-01         ifconfig-push 10.77.0.11 255.255.255.0
client-02         ifconfig-push 10.77.0.12 255.255.255.0
client-03         ifconfig-push 10.77.0.13 255.255.255.0

Each CCD filename must match the Common Name in the corresponding client certificate. For example, a certificate with the Common Name client-01 uses the client-01 file in the ccd directory.

The network-related portion of each client configuration is:

client
dev tun
proto udp
remote vpn.example.org 1194
nobind
persist-key
persist-tun
verb 3

Associate each PC’s profile with the client certificate issued specifically for that PC.

Run OpenVPN as a Windows service.
Check status:

Get-Service OpenVPNService
Get-NetUDPEndpoint -LocalPort 1194

On normal startup, C:\ProgramData\OpenVPN\Log\server.log should include:

Initialization Sequence Completed

4. Windows Client Operation

Clients are operated by manual connect/disconnect in OpenVPN GUI.
Avoid enabling both service auto-connect and GUI manual connect because double connections can happen.

Operation steps:

Start OpenVPN GUI
Connect
Perform needed work
Disconnect

Example key client log lines:

VERIFY OK
Peer Connection Initiated
ASSIGN_IP,,10.77.0.11
Initialization Sequence Completed
CONNECTED,SUCCESS,10.77.0.11

5. Enable Client-to-Client Traffic

Set client-to-client so traffic between VPN clients is allowed.

10.77.0.11 ↕ 10.77.0.12 ↕ 10.77.0.13

Reachability also depends on each endpoint Windows Firewall policy.

6. RDP, Ping, and Custom Port Access

Example of using RDP to OpenVPN server 10.77.0.1:

Test-NetConnection 10.77.0.1 -Port 3389

Expected key output:

RemoteAddress    : 10.77.0.1
RemotePort       : 3389
SourceAddress    : 10.77.0.11
TcpTestSucceeded : True

Run RDP:

mstsc /v:10.77.0.1

In Windows Firewall, keep the existing LAN RDP rule and add a VPN-specific rule. Do not remove existing LAN rules, as that can narrow the allowed scope.

New-NetFirewallRule `
    -DisplayName "RDP from OpenVPN" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 3389 `
    -RemoteAddress 10.77.0.0/24 `
    -Action Allow `
    -Profile Any

Allow ICMP only inside VPN:

New-NetFirewallRule `
    -DisplayName "ICMPv4 from OpenVPN" `
    -Direction Inbound `
    -Protocol ICMPv4 `
    -IcmpType 8 `
    -RemoteAddress 10.77.0.0/24 `
    -Action Allow `
    -Profile Any

Example additional port (TCP 8080):

New-NetFirewallRule `
    -DisplayName "TCP 8080 from OpenVPN" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 8080 `
    -RemoteAddress 10.77.0.0/24 `
    -Action Allow `
    -Profile Any

7. Router Settings (Published)

Set the router as follows to allow external OpenVPN connections.

Protocol: UDP
External Port: 1194
Internal Port: 1194
Destination: OpenVPN Server PC LAN IP

Forward UDP 1194 to the OpenVPN server.

8. Operational Security Rules

Define rules clearly:

Issue different client certificates per PC
Do not reuse .ovpn files (one per device)
Exclude by certificate revocation when a device is out of use
Minimize public exposure and open only 1194/UDP on router/server

9. If a Certificate Must Be Removed

To fully exclude a device rather than temporary stop, revoke the certificate.

Operational image:

Decide to end usage of the device
Revoke that client certificate on the server
Recreate/distribute updated CRL
Attempt reconnect and confirm revocation takes effect

10. Router-Specific Issue

With TP-Link Deco X20 used here, there was a port forwarding issue.
For detailed troubleshooting, refer to the separate article.

Deco X20: Port Forwarding Fails