# openvpn-monitor, a Flask dashboard that reads the OpenVPN management console

> openvpn-monitor is a Flask application that shows the state of OpenVPN servers, including every current connection, with a map, a session table and traffic counters. It talks to the OpenVPN management console over a local socket or port, and it can monitor a remote server as well as one on the same host.

**furlongm/openvpn-monitor** — openvpn-monitor is a web based OpenVPN monitor, that shows current connection information, such as users, location and data transferred.

- Repository: https://github.com/furlongm/openvpn-monitor
- Website: http://openvpn-monitor.openbytes.ie
- Stars: 1,063 · Forks: 300
- Language: Python
- License: GPL-3.0
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/furlongm-openvpn-monitor

## It reads the management console, not the log file

The architecture is one sentence long: openvpn-monitor is a Flask app that displays the status of OpenVPN servers, including all current connections, and it uses the OpenVPN management console. That single choice determines what the tool can and cannot do. The management console is a control channel built into the OpenVPN daemon, and it exposes the live session table, not a replay of the log. The practical result is that the dashboard reflects who is connected right now, with the data the daemon actually has rather than lines parsed out of a log file that may lag or be rotated away. It also means the monitor inherits the console's privileges, since the console can be used to manage the server, not just observe it. The app typically runs on the same host as the OpenVPN server, but the documentation states it can also manage remote servers, so the deployment is a matter of pointing it at a console you can reach.

## Enabling the management interface on the server

Everything depends on this line in the OpenVPN server configuration, and the documentation gives both forms. The first runs the management console on 127.0.0.1 port 5555 with the management password read from a file, and the second runs it on a Unix socket instead, also with the password from the same file.

```
management 127.0.0.1 5555 pw-file
```

```
management socket-name unix pw-file
```

The password file mechanism matters more than it looks. A management console with a weak or empty password is a remote control for the VPN server, not a read-only status feed, and the documentation explicitly refers you to the OpenVPN documentation for how to secure access to the management interface. The localhost binding in the first form is the right default for a monitor on the same host; if you intend to monitor a remote server, the port form needs to be reachable from the monitor host and therefore needs a deliberate network decision.

## Installing from source, and what the dev stack needs

The source path is a checkout, a frontend build, a virtual environment and a requirements install, and the frontend build is the step that surprises people. The static assets are pulled with yarnpkg into a modules folder inside the package, and the dependency list shows what the UI is made of: Bootstrap 3, Leaflet with its fullscreen plugin and a marker spiderfier, and tablesorter for the session table. The Python side is a small pinned set: Flask, Flask-WTF, geoip2, humanize and semver. The geoip2 library is the reason the map works, and the geolite2-city database appears in the package installation lines for the RHEL routes. The development server is started with the Flask app runner in debug mode, which is a development command and not a deployment.

## Six installation routes, and the one you probably want

The documentation offers source, deb and rpm packages, Apache, Docker, a virtualenv with pip and gunicorn, and nginx with uwsgi. The package route is the smoothest for a server: the repository key is fetched, a source list entry is written for the distribution, and the package is installed by name, with the same pattern for Ubuntu 24.04, Debian 12 and the RHEL 9 family. The gunicorn route is the smallest production setup, a virtual environment under /srv with the package installed from pip and a single gunicorn invocation binding the app. The Docker route is a one-liner that maps port 80, with the docker instructions in a separate repository explaining how to generate a dynamic configuration from environment variables alone. The Apache and nginx routes are the most involved, because they mean writing a WSGI configuration, a uWSGI application config and a site block, and the documentation spells all three out in full.

## The nginx and uwsgi route, in full

The nginx route is worth walking through because it shows the shape of a real deployment. The application is installed into /srv, the virtual environment is created, and the uWSGI application config is written with a base of /srv, the project name, the python3 plugin, a chdir into the project, the virtualenv path, and a mount that maps the URL prefix onto the app module. The nginx site block listens on port 80 and passes requests to the uwsgi Unix socket. Enabling both is a matter of symlinking the config into the enabled directory and restarting the services, and the default nginx site is removed so it does not shadow the configuration.

```
[uwsgi]
base = /srv
project = openvpn-monitor
plugins = python3
chdir = %(base)/%(project)
virtualenv = %(chdir)/.venv
module = openvpn-monitor:application
```

One detail in the Apache route deserves attention: the example configuration defines a Python path variable that has to be rewritten with sed to point at the checkout location, which is a sign that the packaged configuration is written for the source layout rather than a system install.

## SELinux and the RHEL specifics

The RHEL instructions carry an assumption that has bitten more than one administrator: the EPEL repository has to be installed first. The SELinux part is where the real work is. If SELinux is enabled, the host and port do not simply work, and the documentation lists the three changes required: the policycoreutils Python utilities package, a semanage rule adding tcp port 5555 to the openvpn_port_t type, and setting the httpd_can_network_connect boolean to 1 so that the web server is permitted to open network connections, which is what the app does when it talks to a management console. The RHEL package route also sets the crypto policy to DEFAULT:SHA1, which is a legacy accommodation rather than a recommendation. The OpenVPN monitor is a web application with network access on both sides, and SELinux is entirely right to be suspicious of that.

## Maintenance state and what the release history says

The project is not archived, and the last push to the repository was on 2026-04-26. The release history is much quieter than that push date suggests: 2.0.4 from 2025-01-02, 2.0.3 from 2024-12-23, and before that 1.1.3 from 2021-02-24. The gap between 1.1.3 and 2.0.3 is nearly four years, which is a fair signal about how this kind of tool ages. The version in the packaging metadata is 2.0.0 while the releases have moved past it, and the version file is read separately by the packaging script, so the number in the repository and the number in the release tag are not the same source of truth. The setup script walks the static and template directories to collect package data, and installs the example configuration files into /etc/openvpn-monitor when the prefix is /usr, or into the prefix itself otherwise. The licence is GPL-3.0, with the text in COPYING.

## Conclusion

Adopt openvpn-monitor if you run an OpenVPN server and need a live view of who is connected, where they are and how much they have transferred, and skip it if you only have one server and one user, because the management console and the OpenVPN logs already tell you that. Verify three things before you deploy it: that the management interface is bound to localhost and password protected, since the documentation points you to the OpenVPN documentation for securing it and the app inherits whatever access the console allows; that the web server is not exposed to the internet without authentication of your own, because the dashboard lists connected users; and that the OS and Python versions match a supported combination, since the listed targets are Ubuntu 24.04, Debian 11 and the RHEL 9 family.

## FAQ

### What is openvpn-monitor and how does it get its data?

It is a Flask app that displays the status of OpenVPN servers, including all current connections. It uses the OpenVPN management console, typically on the same host as the server, and it can also manage remote servers.

### How do I enable the OpenVPN management console for openvpn-monitor?

Add `management 127.0.0.1 5555 pw-file` to the OpenVPN server configuration, with the management password in /etc/openvpn/pw-file, or use `management socket-name unix pw-file` to run it on a Unix socket. The documentation refers to the OpenVPN documentation for securing the management interface.

### How do I install openvpn-monitor on Debian or Ubuntu?

Fetch the repository key into /usr/share/keyrings, write a deb source list entry for your distribution, run `apt update`, then `apt -y install python3-openvpn-monitor`. The documentation also covers RPM packages, Docker, Apache, gunicorn and nginx with uwsgi.

### What does openvpn-monitor need when SELinux is enabled on RHEL?

Install policycoreutils-python-utils, add the port with `semanage port -a -t openvpn_port_t -p tcp 5555`, and set `setsebool -P httpd_can_network_connect 1`. The RHEL instructions also assume the EPEL repository has been installed first.

## Sources

- [furlongm/openvpn-monitor on GitHub](https://github.com/furlongm/openvpn-monitor)
- [License: GPL-3.0](https://github.com/furlongm/openvpn-monitor/blob/main/LICENSE)
- [Project website](http://openvpn-monitor.openbytes.ie)
- [README](https://github.com/furlongm/openvpn-monitor/blob/main/README.md)
- [Releases](https://github.com/furlongm/openvpn-monitor/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/furlongm-openvpn-monitor