Bottom Line: Decide Whether You Want an OpenVPN Server or an OpenVPN Client Before Installing Anything
The forum question asked for “OpenVPN Connect,” but the reply installed OpenVPN Access Server. These are not the same product. Access Server turns ZimaOS into a VPN server that remote clients connect to. OpenVPN Connect is a client application used on endpoints such as Windows, macOS, Android and iOS. On headless Linux, OpenVPN recommends Linux client tools instead of the desktop OpenVPN Connect app.
If You Want to Reach Your Home Network Remotely, You Need the Server Role
OpenVPN's official Docker deployment uses Access Server:
docker run -d --name=openvpn-as --device /dev/net/tun --cap-add=MKNOD --cap-add=NET_ADMIN -p 943:943 -p 443:443 -p 1194:1194/udp -v /DATA/AppData/openvpn:/openvpn --restart=unless-stopped openvpn/openvpn-asThe OpenVPN Access Server is the current upstream source. Keep the persistent /openvpn data path on real ZimaOS storage so certificates and server configuration survive container recreation.
Do Not Publish Every Management Port to the Internet
Access Server uses a web administration interface plus VPN listener ports. You still need a public IP or intentional router forwarding for inbound remote connections. Expose only what your chosen configuration requires, keep the admin UI restricted, and use HTTPS. The exact external/internal port choices depend on your router and whether another reverse proxy already owns 443.
If You Want ZimaOS Itself to Connect to Another OpenVPN Server, That Is a Client Role
OpenVPN's Linux client options include OpenVPN 3 Linux, the open-source openvpn client and NetworkManager plugins on normal Linux distributions. ZimaOS, however, is a headless appliance OS with a read-only system model, so installing a desktop client into the base system is not the cleanest path.
The OpenVPN Linux clients makes the server/client distinction explicit.
Routing the Whole ZimaOS Host Through a VPN Is an Advanced Change
If an OpenVPN client changes the host's default route, ZimaClient remote access, App Store downloads, Docker networking and local LAN access can all be affected. Decide whether you really need the host behind the VPN or only one application container. For a downloader or scraper, routing only that container through a VPN gateway is usually easier to reason about.
For Normal Remote NAS Access, Tailscale or WireGuard Is Simpler on Current ZimaOS
Current ZimaOS carries Tailscale, WireGuard Easy, Firefly and NetBird directly in the App Store. If your goal is simply to reach files or the dashboard from outside home, those paths require less custom container/network work than building OpenVPN Access Server from scratch.
The ZimaOS VPN options shows the supported choices, while the Tailscale requirements covers the most straightforward overlay option.
Use Portainer or Compose for a Deliberate Custom OpenVPN Stack
If you specifically need OpenVPN compatibility, manage the container configuration as Compose or another reproducible definition rather than a one-off command you cannot reconstruct later. Preserve volume paths, TUN device access, capabilities and port mappings in source-controlled configuration.
The Portainer requirements is useful for users who prefer a container UI, and the ZimaOS app requirements provides the broader ZimaOS app model.
Verify the VPN From Both Sides
For Access Server, connect from a phone on cellular data and confirm the VPN-assigned address and intended LAN access. For a client configuration, confirm the ZimaOS route table before and after connection:
ip addr
ip route
curl ifconfig.meDo not declare success merely because a container says “running.” Prove that traffic is taking the expected path and that local administration still works.
FAQ
Is OpenVPN Connect the same as Access Server?
No. OpenVPN Connect is primarily an endpoint client, while Access Server is the self-hosted VPN server product.
Can OpenVPN Access Server run in Docker on ZimaOS?
Yes, the official Access Server image supports Docker and requires TUN device access, NET_ADMIN capability, persistent storage and appropriate ports.
Do I need port forwarding?
For a self-hosted inbound OpenVPN server behind a home router, usually yes unless another public routing arrangement is used.
Can I make ZimaOS a VPN client?
Technically yes with Linux OpenVPN tooling or a carefully designed container, but host-wide routing changes can disrupt LAN and remote-access behavior.
Should I use OpenVPN or Tailscale?
Use OpenVPN when compatibility or an existing OpenVPN infrastructure matters. For simple ZimaOS remote access, the current App Store Tailscale/WireGuard paths are easier.
