# VPN Server

> Step five turns on an OpenVPN server and issues the first client certificate.

Source: https://joinnasnet.com/en/guides/nasnet-panel/easy-config/vpn-server/
Last updated: 2026-08-14

---

## Overview

The **VPN server** step sets up an inbound VPN so your own devices can dial
back into the router from outside. It issues OpenVPN client certificates, so
what you provide here is the passphrase that protects them plus one user
account to start with. More users can be added later from the
[VPN Server tab](/en/guides/nasnet-panel/vpn-server/).

This step only appears in Dual-Link mode. Choosing Starlink-Only in the first
step removes it and leaves the inbound VPN server switched off.

## Before you start

- You are in Dual-Link mode.
- Decide on a certificate passphrase, because you will need it again when you import
  a client certificate on a device.
- Decide on the first VPN account's username and password.

## Steps

1. Turn the switch from **Disabled** to **Enabled**. Leaving it off skips the
   rest of this step and no VPN server is created.
2. Fill in the **Certificate passphrase**. This protects the client
   certificates the router issues.
3. Fill in **Username** for the first VPN account.
4. Fill in **Password** for that account.
5. Watch the certificate preview beside the form update with the username, then
   press **Apply**.

## Reference

| Field | What it does | Default |
| ----- | ------------ | ------- |
| Enable switch | Creates an OpenVPN server on the router. | Disabled |
| **Certificate passphrase** | Password protecting the issued client certificates. Required when enabled. | empty |
| **Username** | Name of the first VPN user. Required when enabled. | empty |
| **Password** | Password for that user. Required when enabled. | empty |

## Troubleshooting

**"Certificate passphrase is required."** The step is enabled but the
passphrase field is empty.

**"Username is required." / "Password is required."** Fill in the first user's
credentials, or turn the step off if you do not want a VPN server.

**The step is missing from the wizard.** You chose Starlink-Only in step one.
Go **Back** to the first step and switch to Dual-Link if you want an inbound
VPN server.

## Related

- [Applying the configuration](/en/guides/nasnet-panel/easy-config/apply/)
- [VPN Server tab](/en/guides/nasnet-panel/vpn-server/)