Thinh DVT

Run OpenVPN 2.4 Alongside OpenVPN 2.7 on Linux

The problem

Recently, I needed to connect to my company’s VPN server. Unfortunately, the VPN infrastructure is quite old and only works reliably with OpenVPN 2.4.9. The server still uses legacy settings such as the BF-CBC cipher, which are deprecated in modern OpenVPN releases.

My system already uses OpenVPN 2.7, and simply downgrading the package isn’t an option. Older versions depend on OpenSSL 1.1, while the rest of my system has already migrated to OpenSSL 3. Replacing the system package would break dependencies and interfere with applications such as NetworkManager.

Instead of downgrading the entire system, I decided to install OpenVPN 2.4.9 alongside the existing installation. This allows:

  • OpenVPN 2.7 to remain the system default.
  • NetworkManager to continue working normally.
  • OpenVPN 2.4.9 to be launched manually whenever I need to connect to the company’s VPN.

In this tutorial, I’ll show you how to run two versions of OpenVPN on the same machine without breaking your existing installation.

Tutorial

Step 1: Downgrade OpenVPN from 2.7 to 2.4

First, use the downgrade tool, don’t worry, we can just upgrade it back later

sudo downgrade openvpn
  • Select 2.4.9
  • Downgrade it

Now when you run it, it will indicate missing linked libraries:

./openvpn 
./openvpn: error while loading shared libraries: libcrypto.so.1.1: cannot open shared object file: No such file or directory

You can see what it is missing by running this command:

ldd /usr/sbin/openvpn 
	linux-vdso.so.1 (0x00007f355333c000)
	liblzo2.so.2 => /usr/lib/liblzo2.so.2 (0x00007f355321b000)
	liblz4.so.1 => /usr/lib/liblz4.so.1 (0x00007f35531f6000)
	libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007f35531f1000)
	libpkcs11-helper.so.1 => /usr/lib/libpkcs11-helper.so.1 (0x00007f35531d0000)
	libcrypto.so.1.1 => not found
	libssl.so.1.1 => not found
	libsystemd.so.0 => /usr/lib/libsystemd.so.0 (0x00007f3553093000)
	libdl.so.2 => /usr/lib/libdl.so.2 (0x00007f355308e000)
	libc.so.6 => /usr/lib/libc.so.6 (0x00007f3552e00000)
	libcrypto.so.3 => /usr/lib/libcrypto.so.3 (0x00007f3552800000)
    ...

You can see that it is missing these packages:

libcrypto.so.1.1 => not found
libssl.so.1.1 => not found

Step 2: Download those packages

  • Now, if we download it via pacman, or yay, it will break the whole system. Instead we just need to build it directly from source and collect thosse 2 .so files.
git clone https://github.com/kzalewski/openssl-1.1.1.git
cd openssl-1.1.1/
./config
make

Step 3: Organize the files

After make, we check if the libraries exist. While we are inside that git directory:

─▶ ls libcrypto.so.1.1 
-rwxr-xr-x 1 thkinh thkinh 3512384 Jun 21 12:35 libcrypto.so.1.1
─▶ ls libssl.so.1.1 
-rwxr-xr-x 1 thkinh thkinh 733896 Jun 21 12:35 libssl.so.1.1

So far, we have collected all the things we need, now we only need craft it together in a tidy directory. I will use /opt/openvpn24/ as my ultimate directory in this setup.

sudo mkdir -p /opt/openvpn24
sudo mkdir -p /opt/openvpn24/bin
sudo mkdir -p /opt/openvpn24/lib

Move the files in its place:

sudo cp /usr/sbin/openvpn /opt/openvpn/bin/
sudo cp ./libcrypto.so.1.1 /opt/openvpn/lib/
sudo cp ./libssl.so.1.1 /opt/openvpn/lib/

Step 4: Run the file

In order for openvpn to run, we have to tell it where to link the libraries. In this tutorial, I will create this script:

#!/bin/sh
# this is the /opt/openvpn24/run.sh script
export LD_LIBRARY_PATH=/opt/openvpn24/lib
exec /opt/openvpn24/bin/openvpn "$@"

Now run it!

sudo chmod +x /opt/openvpn24/run.sh
/opt/openvpn24/run.sh --version

Step 5: Clean up (IMPORTANT)

  • Now you are having 2 distinct package of openvpn, one is /usr/sbin/openvpn installed via pacman, one is /opt/openvpn24/bin/openvpn that is copied from the former.
  • You need to put /usr/sbin/openvpn back to its latest version, just by updating it.
sudo pacman -S openvpn
  • Now if you want to, you can delete the cloned git repo back then too.
  • After this, you now have 2 distinct package of openvpn, one is the latest version, one is 2.4.9. You can use it via /opt/openvpn24/run.sh <args>.