---
name: "openvpn3-service-client"
section: "8"
platform: "linux"
package: "openvpn3-client"
version: "24.1+dfsg-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/openvpn3-service-client"
---

# openvpn3-service-client(8)

OpenVPN 3 Linux VPN Client backend service

## NAME

openvpn3-service-client - OpenVPN 3 Linux VPN Client backend service

## SYNOPSIS

```
openvpn3-service-client [OPTIONS]
openvpn3-service-client -h | --help
```

## DESCRIPTION

The **openvpn3-service-client** process is a backend service for OpenVPN 3 Linux, responsible for a single VPN session.  This service will be started automatically by the **openvpn3-service-backendstart** starts, which is initiated when the **openvpn3-service-sessionmgr** is requested to start a new VPN session.

It will run one **openvpn3-service-client** per active VPN session.

This service must be started by the **openvpn3-service-backendstart** process, as it gather more information from the session manager before starting the client process with the given arguments.  This process must run as the *\_openvpn* user and requires no privileges.  All privileged operations, like creating and configuring the virtual network adapter, IP addresses, routes and DNS, is handled by a the **openvpn3-service-netcfg** service.

Beware that running this with another user account than *\_openvpn* also requires updating the D-Bus policy as well.

## OPTIONS

- **-h, --help**

  Print  usage and help details to the terminal

- **--version**

  Prints the version of the program and exists

- **--log-level** *LEVEL*

  Sets the default log verbosity for log events generated by this service.  The default is **3**.  Valid values are **0** to **6**.  Higher log levels results in more verbose logs and log level **6** will contain all debug log events.

  This setting will be overridden if the configuration file used contains the **--verb** option (see the [**openvpn**(8)](/openvpn/8.md) man page for details) or the **log-level** configuration profile override has been set (see [**openvpn3-config-manage**(1)](/openvpn3-config-manage/1.md)).

- **--log-file** *LOG\_DESTINATION*

  By default, logging will go via the **openvpn3-service-log** service.  By providing this argument, logging will also be sent to *LOG\_DESTINATION*, which can be either a filename or **stdout:** where the latter one sends log data to the console.

- **--colour**

  This will add colours to log events when logging to file or terminal.  Log events will be coloured based on the log level of the event.

- **--disable-protect-socket**

  The VPN client can protect the socket being used for the UDP/TCP connection to the VPN server from being routed over the VPN itself.  This makes the routing table simpler and does not need any specific routing entries if the default gateway is changed. Unfortunately, this does not work on all systems and to get a functional VPN tunnel, this socket protection needs to be disabled.  By setting this option, it will not be possible to make use of the **--set-somark** feature in **openvpn3-service-netcfg**.

## SEE ALSO

[**openvpn3**(1)](/openvpn3/1.md) [**openvpn3-config-manage**(1)](/openvpn3-config-manage/1.md) [**openvpn3-service-backendstart**(8)](/openvpn3-service-backendstart/8.md) [**openvpn3-service-netcfg**(8)](/openvpn3-service-netcfg/8.md) [**openvpn**(8)](/openvpn/8.md)