Changing the server is only half the upgrade. Every laptop still holds yesterday's config, and until each user imports the fresh file and connects with it - password, code and all - the new security is a setting, not a fact.
The last third of the video is the part offices skip: download the client configuration file for the user, import it into the OpenVPN client, and connect - entering the username, the password and the one time code. This page covers that distribution job properly: why a fresh download matters after the authentication change, how to get files to people without leaking them, and the external network test the video ends on.
The config issued before the upgrade was created for a different login world - one where the file alone was trusted. After authentication and MFA change on the server, hand out configs generated in the new world, matched to each named user, exactly as the video does from the user's configuration page. It also gives you a clean cut off point: any config downloaded before the upgrade date is retired on sight. When every laptop runs a fresh, named config, your audit list and reality finally agree with each other.
On the user's machine, open the OpenVPN client, import the configuration file, and connect. The prompts arrive in order: username, password, then the one time code from the authenticator app. Save nothing extra - if the client offers to remember the password, office policy should say no on shared machines and think carefully on personal ones. Delete the old profile from the client rather than leaving two; a user with two profiles will pick the wrong one on the busiest day of the year, in front of a client, on a deadline.
A config file plus a phished password used to be the whole attack; with MFA the file alone is weaker - but it is still one of the three factors, and it names your server to the world. Deliver configs through a channel tied to the person: in person with a pen drive, your organisation's file system with their login, or a password manager's secure share. Not the office group chat, not an email thread that will be forwarded for years. When someone leaves, their copy of the file is one more reason the account itself must be disabled the same day.
The video's closing warning deserves its own step: connect from an external network before declaring victory. Testing from the office Wi Fi proves almost nothing - some setups even appear to work because the client never truly left the building's network. Use mobile data or a home connection. The connected catch is DHCP: if your internet connection receives its public address by DHCP, that address can change, and a config pointing at the old address fails from outside while working fine in your memory of yesterday. The honest fix is a dynamic DNS name for the firewall, so configs point at a name that follows the address - set it once, and outside testing becomes boring, which is what you want.
Roll out to everyone else before you retire your own old access, and keep one verified working admin path until the last user is migrated. The classic self inflicted wound of VPN upgrades is changing authentication on Friday evening and discovering on Saturday that your own enrolment was the untested one. Your account, your MFA, your fresh config - tested from mobile data - is the last item on the checklist, not the first casualty of it.
The client configuration download, the import, and the first connection with username, password and code - end to end.
▶️ Watch Full VideoThey should not be able to complete the new login with an outdated setup, and either way the old profiles should be deleted during the rollout. If someone connects without being asked for a code, treat it as a finding and investigate the same day.
Test the address the config points to. If your internet public address is assigned by DHCP it may have changed, or the firewall is not reachable from outside at all. The durable fix is a dynamic DNS name for the firewall so configs use a name, not a raw changing address - exactly the limitation the video closes with.
It is the weakest acceptable option and best avoided: email lives forever and gets forwarded. Hand it over in person or through an authenticated internal system. With MFA on, a leaked file alone no longer connects - but it still tells an attacker where your door is.