OpenVPN Server Backup and Restore Guide

Updated 4 November 2026 · Standard formula, shown below

This guide walks you through backing up and restoring your self-managed OpenVPN server and OpenVPN Access Server. You’ll learn what files and settings to copy, how to store them safely, and how to recover your server after a failure or migration. Before starting, make sure you have root or sudo access to your server and know your OpenVPN version.

What You’ll Need

SSH access to your OpenVPN server (root or sudo privileges)
A secure location to store backups (local drive, external storage, or cloud storage)
Basic familiarity with the command line
For Access Server: the sacli command-line tool (comes with the installation)

Step-by-Step

For OpenVPN Community Server (Self-Managed)

Identify your configuration directory. The default is /etc/openvpn. Confirm with ls /etc/openvpn. You should see server.conf and your CA and certificate files.
Create a backup directory. For example: mkdir -p ~/openvpn-backup
Copy the configuration directory. Run cp -a /etc/openvpn ~/openvpn-backup/. The -a flag preserves permissions and timestamps.
Include the Easy-RSA PKI directory. If you used Easy-RSA to generate certificates, back up the PKI folder (often /etc/openvpn/easy-rsa/pki or ~/easy-rsa/pki). Copy it as well: cp -a /path/to/pki ~/openvpn-backup/
Back up client configuration files. If you have static client configs in /etc/openvpn/ccd, copy that folder too.
Compress and timestamp the backup. Use tar -czf openvpn-backup-$(date +%Y%m%d).tar.gz ~/openvpn-backup
Move the archive to a safe location. Use scp, rsync, or a cloud sync tool to copy it off the server.
To restore: Extract the archive on the new server: tar -xzf openvpn-backup-XXXX.tar.gz
Copy the files back. cp -a ~/openvpn-backup/openvpn/* /etc/openvpn/ (adjust paths as needed). Restore the PKI directory similarly.
Set proper permissions. Ensure private keys are readable only by root: chmod 600 /etc/openvpn/*.key
Restart OpenVPN. systemctl restart openvpn@server (or your service name). Check status with systemctl status openvpn@server

For OpenVPN Access Server

Use the built-in backup tool. OpenVPN Access Server includes sacli. Run sudo sacli --backup to create a backup file (usually saved to /tmp/backup.tar.gz).
Copy the backup file off the server. Move it to a safe location with scp or similar.
To restore: Install the same version of Access Server on the new machine (or the same version as your backup).
Run the restore command. sudo sacli --restore /path/to/backup.tar.gz
Restart the service. sudo systemctl restart openvpnas (or service openvpnas restart).
Verify. Log in to the Admin UI and check that users, settings, and certificates are intact.

Common Mistakes

Forgetting the PKI directory. Without the CA and private keys, clients cannot connect and you cannot issue new certificates.
Backing up only the config files. You also need the server certificate, key, and CA certificate (usually in /etc/openvpn).
Not preserving file permissions. If keys are world-readable, OpenVPN may refuse to start. Always use -a with cp or tar with -p.
Restoring to a different version. OpenVPN Access Server backups are version-specific. Restoring to a newer or older version can cause issues.
Not testing the backup. A backup you never restore is not a backup. Test it on a staging server.

Tips

Automate backups. Use cron to run a backup script weekly. For example, a simple script that tars the config and PKI and uploads to a remote server.
Keep multiple generations. Retain the last 7 or 30 days of backups so you can roll back to an earlier state if needed.
Document your setup. Note the OpenVPN version, network settings, and any custom scripts. This makes restoration smoother.
Use a version control system. Store your config files in Git to track changes and revert easily.
For Access Server, use the backup feature via the Admin UI. Itâ€™s easier and includes all settings.

Troubleshooting

OpenVPN fails to start after restore. Check the log with journalctl -u openvpn@server or tail -f /var/log/openvpn.log. Common issues: missing files, wrong permissions, or mismatched certificate/key pairs.
Clients canâ€™t connect. Verify that the server IP and port in the config match the new server. Also check firewall rules (ufw, iptables) to allow UDP/TCP on the VPN port.
Access Server restore fails. Ensure youâ€™re using the same version. If not, upgrade the new server to the same version before restoring.
Certificate errors. If the serverâ€™s certificate is expired or the CA is missing, regenerate certificates using Easy-RSA and update the server config.
Permissions errors. Run chmod -R 600 /etc/openvpn/*.key and chmod 644 /etc/openvpn/*.crt to fix common permission issues.

Frequently Asked Questions

Do I need to back up the entire /etc/openvpn directory?

Yes, it contains the server config, certificates, and keys. However, you can skip the ccd folder if you donâ€™t use per-client configs.

Can I restore my OpenVPN server on a different machine with a different IP?

Yes, but you must update the server config to reflect the new IP or hostname. Client configs that reference the old IP will also need updating.

How often should I back up my OpenVPN server?

At least weekly, or whenever you make significant changes (adding users, changing settings). For production servers, daily backups are recommended.

What is the difference between backing up the community server and Access Server?

Community server backups are manual file copies. Access Server has a built-in tool (sacli) that packages everything into one file.

Can I restore user passwords and certificates?

Yes, if you back up the PKI (for community) or the Access Server backup file, all user credentials and certificates are included.

Is it safe to store backups in the cloud?

Yes, but encrypt them first. Use GPG or store them in a secure cloud bucket with encryption enabled.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.