We’ve been using OpenVPN at work for a while now. The technology itself is decent enough, but if you’re a Windows XP user, you’ll quickly get annoyed by the shortcomings of the rather Spartan OpenVPN GUI.
Personally, I had two main gripes. The first was that the TAP adapter, i.e. the virtual network interface,
would generate a cable unplugged system tray notification unless the VPN connection had been established. My second, more debatable annoyance was that, for security purposes, there’s no way to store your credentials in the client. In this article, I propose a straightforward solution to both these issues.

- OpenVPN GUI
Dynamically Enabling the TAP Adapter
Under Windows XP, when you know a network connection is unavailable, the easy way to get rid of the cable unplugged warning is to disable the connection. This also works for the TAP adapter. Hence, if you can be bothered, just right-click the tray icon, select Disable, and there goes the warning. However, you will have to re-enable the adapter every time you want to use your VPN connection.
Luckily, you can also do so from the command line. Moreover, OpenVPN GUI can execute a batch script upon establishing as well as disengaging the VPN connection. Combining the two, you can fully automate the enabling-disabling process as follows.
Install Microsoft’s DevCon utility for managing devices from the command line—if you thought the built-in Netsh would help you here, guess again. For convenience, be sure to add the containing folder to your PATH, or just place DevCon in system32, for instance.
Run the following command to obtain the TAP interface’s ID:
devcon find TAP*
On my machine, it was simply ROOT\NET\0000.
Open your OpenVPN configuration folder. Usually, it’s
C:\Program Files\OpenVPN\config
For the connection you wish to automate, there will be a .ovpn file sitting there. We will now create two small batch scripts, one for connection and one for disconnection.
Still in the configuration folder, create a text file called profile_pre.bat. For instance, if your configuration file were called work.ovpn, you’d create work_pre.bat. Be sure to follow this naming scheme, as it’s required by OpenVPN GUI.
The batch file should contain the following text:
@echo off
echo Bringing up TAP interface ...
devcon enable @ROOT\NET\0000
The first two lines aren’t required, but they clean stuff up a bit. The main thing is of course the last line, which you may need to modify if you got a different device ID earlier.
Similarly, create another file called profile_down.bat, responsible for disabling the adapter when you disconnect:
@echo off
echo Taking down TAP interface ...
devcon disable @ROOT\NET\0000
And that’s it. When you establish a VPN connection, a command prompt window should briefly pop up, enabling the adapter. When the connection is terminated, the same thing should happen, disabling the adapter.
Maybe you don’t want those windows to pop up. That can be arranged: just pass the option --show_script_window 0 to OpenVPN GUI.
Automatically Entering Credentials
As I mentioned, this second part is a bit more questionable. You may have strong feelings against automatically filling in logon dialogs, as do I. At the end of this article, I will discuss reducing the security risk a bit. However, if you are truly concerned about security, just memorize your password and enter it manually, or, better yet, use certificates instead. The latter wasn’t an option for me, which is the only reason why I explored automatically entering credentials—apart from laziness.
Before we begin, you should look at unofficial OpenVPN GUI builds that do allow storing your password. Just Google for the enable-password-save option and you’ll probably find a couple. Personally, I prefer using the official build and hacking my way around that.
… Although hacking is such a strong word, isn’t it? All we need to do is automate filling in the logon dialog. Several tools exist for this purpose, such as AutoHotkey. I went with AutoIt, since I already had it installed.
So, if you don’t have AutoIt already, grab it and install it.
Fire up AutoIt’s script editor and paste the following code:
; Close OpenVPN GUI if it’s already running.
; You may be using a different version.
ProcessClose("openvpn-gui-1.0.3.exe")
; Start OpenVPN GUI.
; Change version, profile, and path if necessary.
Run("openvpn-gui-1.0.3.exe --connect work.ovpn", _
"C:\Program Files\OpenVPN\bin")
; Wait until the authentication dialog pops up.
WinWaitActive("OpenVPN - User Authentication")
; Fill in your username.
Send("username")
; Tab to the password field.
Send("{TAB}")
; Fill in your password.
Send("password")
; Confirm dialog input.
Send("{ENTER}")
Save the file as openvpn-work.au3 or whatever you like.
If you double-click the file, OpenVPN GUI will be fired up, AutoIt will automagically fill in your credentials and when it’s finished, you’ll have your VPN connection up. Note that the batch scripts from the first part of this article will not be affected by this at all.
Now to address that security concern expressed earlier. You can obscure your logon information a little by turning the plain-text AutoIt script into an executable. For this purpose, AutoIt comes with a utility called Aut2Exe. To build the executable, just right-click the .au3 file and select Compile Script. A .exe file of the same name will be generated. An additional benefit of this is that you can easily distribute this file instead of installing AutoIt on all your computers. Note, however, that it will still be easy to extract your credentials from the binary code.
Room for Improvement
So far, I’ve only found one shortcoming to this technique. Sometimes, the OpenVPN GUI logon dialog won’t get focus, blocking the AutoIt script until you click on the taskbar button. It still beats typing in the whole lot.
So, personally, I’ve attained my goal. I no longer have to burden myself with enabling and disabling the TAP adapter or entering my credentials. Hopefully, I won’t be the only one benefiting from this short tutorial. If nothing else, it’ll probably spark some comments about how much easier this stuff is on Linux or OS X. To which I say, “Meh.”