Your firewall can double as your VPN server — no extra box, no extra software licence. This guide follows the exact order from the video: install the OpenVPN app, confirm the address clients will dial, create one client per person, import the config file, and fix the one problem almost everyone meets on the first connection.
One naming note before we start: Untangle is now Arista Edge Threat Management (ETM) NG Firewall — Arista acquired Untangle in 2022 and renamed the product, but the screens in this guide are the same ones you see in the video. The best part has not changed either: the OpenVPN app is part of the free core apps, while the WireGuard and IPsec VPN apps sit behind a subscription. So the setup below costs nothing beyond the firewall you already run. Follow the steps in order — most failed VPN setups are simply steps done in the wrong order.
Log in to the firewall's web interface from a browser, exactly as the video begins. Then:
That is the entire server installation. Everything after this is configuration, and configuration is where the care goes.
Every client config file Untangle generates points at one server address. If that address is wrong, nothing else matters. In the video this is checked under Configure → Network, where the firewall's static public IP is verified — a static IP is the cleanest foundation because the address baked into every config file never changes.
The same address lives under Config → Administration → Public Address, and this is the value used when client configs are generated, so confirm it is correct and reachable from the internet. No static IP from your ISP? Set up the built-in Dynamic DNS (Config → Network → Dynamic DNS) and use that hostname as the public address instead — a name can follow a changing IP, a hard-coded number cannot. One warning: if your firewall sits behind another router, that router must forward UDP port 1194 to the firewall, or clients will knock on a door nobody opens.
Open the OpenVPN app and go to Server → Remote Clients, then add a client for each person and device: ramesh-laptop, priya-phone, and so on. Each client gets its own certificate inside its own config file, which is what makes revocation clean later — when someone leaves, you delete their client and only their access dies.
While creating clients you will assign each one to a Group (Server → Groups). The group decides big behaviours, most importantly Full Tunnel and Push DNS. The Default Group is fine for a first setup; Step 5 shows why the group matters more than it looks.
From the Remote Clients list, download the client config file (the .ovpn file) for the user you just created. On the laptop or phone, install the official OpenVPN Connect app, import that file, and connect — this is exactly the sequence the video demonstrates.
Treat that file with respect starting now: it contains the server's address plus the client's certificate and private key. Whoever holds the file holds the access. Hand it over the way you would hand over an office key, not the way you forward a meme.
This is the problem the video spends its second half on, and it is the most common first-day OpenVPN complaint: the client says Connected, yet the machine does not behave as if it is really on the office network — addresses and routing are not what they should be. The fix shown in the video:
The re-download is not optional decoration. Tunnel behaviour is written into the generated config, so a group change only reaches a laptop when a new config does — Arista's own documentation says the same: after changing a group, redownload and redeploy the client config. Whether Full Tunnel is right for everyone on your team is a real decision with real costs, and it gets its own honest page in this series — but as a first working setup, this is the route the video proves end to end.
Never declare victory from a laptop sitting on the office Wi-Fi — that path can succeed even when the real internet path is broken. Connect through a phone hotspot or any genuinely outside network, then check three things: the client shows Connected with an address from the VPN pool, a ping to an exported office address answers (start with the firewall's own LAN IP), and a real resource — a shared folder, Tally, a printer page — actually opens. On the firewall, the OpenVPN Status tab should show your live session. If the tunnel is up but nothing inside opens, the usual suspect is the Exported Networks list under the Server tab: clients can only reach networks the firewall has been told to export to them.
Watch the video first if any screen differs from your version — the full install, client creation and the Full Tunnel fix are all shown live.
▶️ Watch Full VideoYes. OpenVPN is one of the free core apps in NG Firewall, including the server and per-user client profiles. The subscription VPN apps in this product are WireGuard and IPsec. A small office can run its whole remote-access setup on the free OpenVPN app.
It is the simplest option, and it is what the video uses. Without one, use the built-in Dynamic DNS service and put that hostname in Config, Administration, Public Address, so generated config files carry a name that follows your changing IP instead of a number that goes stale.
Work in this order. First, confirm the target network is listed under Exported Networks in the OpenVPN Server settings. Second, if you changed any group setting — like Full Tunnel — download and import a fresh config file, because the old file keeps the old behaviour. Third, test by IP address; if IP works but names fail, it is DNS, and Push DNS in the group is the fix.