VPN that gives you .ovpn config files

Most VPN providers sell an application. The file underneath is the actual service, which is why a VPN that gives you .ovpn config files is worth seeking out deliberately. An .ovpn file is a plain text OpenVPN profile. It carries the server address, the transport settings and the cryptographic material, and any standard OpenVPN client can read it. A provider that hands you that file is selling you a tunnel. A provider that hides it is selling you software that happens to contain a tunnel.

TP-Link puts the same point plainly in its router setup documentation: "Configuration files from OpenVPN service providers are the key to accessing the VPN service" (tp-link.com/us/support/faq/4468). That sentence is written for people whose hardware cannot run an app at all, and it is the clearest statement of what you are actually buying.

The app is a wrapper. It selects a server, writes a profile, hands that profile to a bundled client, and manages firewall rules around it. Strip the wrapper away and the profile is what remains. Everything the tunnel does is decided in that file.

Open the file and you learn four things no marketing page states:

• Which host you actually connect to, as a hostname or an IP address
• Which transport the provider uses, proto udp or proto tcp, and on which port
• Whether the certificate material is inlined or split into separate side-car files
• Whether the provider pushes DNS and a default route, or leaves both to you

Those four facts decide whether the profile works on a router and whether you can build a firewall rule around it. They also decide whether you can diagnose a failure without opening a support ticket. Here is the trade in full.

Neither column is universally better. The left column trades convenience for control and reach. The right column trades control for a shorter path from payment to working tunnel.

Five signals separate a genuine config-file provider from one that mentions manual setup and then buries it.

Look for a downloads page reachable before payment. A provider confident in its files documents them publicly. Proton VPN, for example, publishes a configuration download page that lets you pick a platform, a server and a set of VPN options before generating the file (protonvpn.com/support/wireguard-configurations). If the only route to a config file is a support conversation, treat manual setup as unsupported in practice.

Check whether files are per-server or per-account. Per-server files mean one download per location, and switching location means importing another profile. Mullvad's documentation describes exactly this pattern and names individual server files such as se-mma-wg-001 (mullvad.net/en/help/wireguard-and-mullvad-vpn). A per-account file is more convenient and gives you less choice.

Confirm the certificate material is inlined. A portable .ovpn file contains <ca>, <cert>, <key> and usually <tls-crypt> blocks inside the file itself. A profile that references ca.crt and client.key as separate paths breaks the moment you move it to a phone or a router. Inlining is what makes one file a complete credential.

Find the regeneration path before you need it. Keys get rotated, servers get retired, and a profile that worked last month can stop working. Ask whether you can regenerate a config yourself from an account page, or whether it requires a support request. Mullvad's own guidance is worth noting here: running its script again reuses the existing key, and it advises creating a separate key for each device.

Require both protocols. A provider that ships only WireGuard leaves you with nothing on a network that drops UDP, because WireGuard has no TCP transport. The WireGuard project states the constraint directly: "All packets are sent over UDP" (wireguard.com/protocol). An OpenVPN profile on TCP 443 is the standard fallback, and you cannot improvise one after the fact. The buying question for the WireGuard half is covered separately in what to expect from a cheap VPN with a WireGuard config file.

An .ovpn file is plain text and you can open it in any editor. The top of the file holds connection directives. The bottom usually holds the inlined key material.

Inline blocks and why they matter for portability

Inline blocks are the difference between a file and a folder. When <ca>, <cert>, <key> and <tls-crypt> sit inside the profile, the profile is self-contained. Move it to Android, to a Synology box, to an OpenWrt router, and it still connects. When those blocks are external file references, every move becomes a path-fixing exercise. Providers that expect router users inline everything, because they have to.

Treat the file as a credential from that point forward. It contains a private key, so anyone holding a copy can connect as you.

What a provider can and cannot change after you download it

A provider can change what happens at the other end of the connection. It can retire a server, move an IP address, rotate the server certificate, or stop accepting an old cipher. Any of those breaks a downloaded profile without touching your copy of it.

A provider cannot reach into your file. Once downloaded, the profile is yours, and it stays exactly as written until you replace it. That is the honest version of "no app required": nothing updates itself, which means nothing changes without your knowledge and nothing gets fixed without your action. For the format itself, see the notes on using an OpenVPN profile.

This is the practical argument for config-file delivery, and it is a reach argument rather than a privacy one. Several common platforms accept a profile and cannot run a vendor application.

Verify each row against current firmware before you rely on it. These platforms change, and a table like this rots faster than any other part of a buying guide.

The gluetun row carries a detail worth knowing before you pay. Its custom provider reads an OpenVPN profile from the path you set in OPENVPN_CUSTOM_CONFIG, alongside VPN_SERVICE_PROVIDER=custom and VPN_TYPE=openvpn. The WireGuard side works differently. There the key, the endpoint and the tunnel address are separate variables, including WIREGUARD_PRIVATE_KEY, WIREGUARD_PUBLIC_KEY and WIREGUARD_ENDPOINT_IP. A WireGuard config still works, and you transcribe it field by field rather than mounting the file.

The NetworkManager row turns on the same kind of detail. The nmcli manual states that VPN configurations are imported by NetworkManager VPN plugins, and that the proper plugin has to be installed for the import to run at all. A provider handing you a file cannot help you there. That part is yours.

Config-file delivery suits people who already run their own firewall rules. It is genuinely worse for several other readers, and pretending otherwise would be dishonest.

Choose an app-based provider if you want one click and no maintenance. Manual setup means installing a client, importing a profile, and re-importing it when something rotates. That is a small task repeated indefinitely, and it is not free.

Choose an app-based provider if you need a managed kill switch on mobile. Building one yourself on a phone is harder than on a desktop, because you do not control the firewall directly. Check what your own handset offers before you decide. Open the system VPN settings, look for an always-on or block-outside-the-tunnel option, and confirm it applies to the standard client you intend to import into.

Choose an app-based provider if you want automatic server selection or obfuscation. Load-based server picking lives in the app, and stealth transports are usually proprietary and bound to the vendor's own client. Neither travels inside a standard profile.

Note that these are not exclusive choices. Proton VPN ships apps for Windows, macOS, Android and iOS or iPadOS and also publishes downloadable configurations for any client "that also matches official specifications". A provider can do both, and some do.

Put these four to any provider, in writing, before money changes hands.

• Ask whether config files are downloadable before payment, or only after
• Ask whether files are issued per server or per account, and how many you may hold
• Ask whether you can regenerate a config yourself without contacting support
• Ask whether both an .ovpn profile and a WireGuard config are available on the same account

An answer you cannot get before paying is an answer. Providers that treat manual setup as a supported path document it, and providers that treat it as an exception route it through a support queue.

PulseVPN is config-file based. You import an .ovpn profile or a WireGuard config into a standard client, and there is no proprietary PulseVPN app. Both protocols are supported and both run on the same account at the same time, which is what the UDP-blocked case above turns on. A subscription covers three simultaneous connections and sixteen exit regions.

Four things about the files themselves are settled rather than a matter of asking.

• .ovpn profiles are unlimited on an account, and WireGuard configs are capped at three
• Delivery is per server: each OpenVPN download is a ZIP holding a UDP profile and a TCP profile for that server
• Both of those profiles connect on port 80, so the TCP fallback is in the file you already have
• Profiles authenticate with auth-user-pass and carry an inline <ca>, so there is no client certificate to expire

The last point is worth a sentence on its own, because it changes what can go wrong. A profile with no client certificate cannot stop working because a certificate ran out. Your credentials and the account behind them are what the server evaluates.

Plans are $2.50 for one month, $7.50 for three months, $14.00 for six months and $26.00 for twelve months. Dividing the multi-month totals gives $2.50, $2.33 and $2.17 per month respectively. A 24-hour free trial is available with no card, and subscriptions can be settled in cryptocurrency. See paying with crypto for the payment path, and generating a config for the first-run procedure.

Put the four questions above to us as well. Anything that depends on how an account is provisioned, rather than on what the tunnel does, is worth having in writing before money changes hands.