ExpressVPN on Vero V

[aldurbano]

Hi

was using ExpressVPN with Zomboided VPN Manager, which stopped working since last OSMC update.

Actual Status: Linux osmc 4.9.269-87-osmc / Kodi 21.4 2025-11-29 / OpenVPN 2.5.1

After removing VPN Manager, I tryed installing the “universal” linux app from ExpressVPN:

expressvpn-linux-universal-14.0.1.12858_release.run

However this will not install: “not supported”.

Should Zomboided/service.vpn.manager still work with the actual osmc version? Log below.

-Aldo

2026-04-21 03:24:58.850 T:13406 info : VPN Mgr : (vpnplatform.py) VPN log file start >>>
2026-04-21 03:24:58.850 T:13406 info : 2026-04-21 03:24:56 DEPRECATED OPTION: --cipher set to ‘AES-256-CBC’ but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add ‘AES-256-CBC’ to --data-ciphers or change --cipher ‘AES-256-CBC’ to --data-ciphers-fallback ‘AES-256-CBC’ to silence this warning.
2026-04-21 03:24:58.850 T:13406 info : 2026-04-21 03:24:56 WARNING: --keysize is DEPRECATED and will be removed in OpenVPN 2.6
2026-04-21 03:24:58.850 T:13406 info : 2026-04-21 03:24:56 WARNING: file ‘/home/osmc/.kodi/userdata/addon_data/service.vpn.manager/ExpressVPN/user.key’ is group or others accessible
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 WARNING: file ‘/home/osmc/.kodi/addons/service.vpn.manager/ExpressVPN/pass.txt’ is group or others accessible
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 OpenVPN 2.5.1 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Aug 25 2025
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 library versions: OpenSSL 1.1.1w 11 Sep 2023, LZO 2.10
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 TCP/UDP: Preserving recently used remote address: [AF_INET]212.30.36.252:1195
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 UDP link local: (not bound)
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 UDP link remote: [AF_INET]212.30.36.252:1195
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-11094-2a, emailAddress=support@expressvpn.com, serial=1030711
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 TLS_ERROR: BIO read tls_read_plaintext error
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 TLS Error: TLS object → incoming plaintext read error
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 TLS Error: TLS handshake failed
2026-04-21 03:24:58.851 T:13406 info : 2026-04-21 03:24:56 SIGTERM[soft,tls-error] received, process exiting
2026-04-21 03:24:58.852 T:13406 info : VPN Mgr : (vpnplatform.py) <<< VPN log file end

[Tom_Doyle]

Hi,

Doesn’t look like Zomboided has been updated for quite some time, so probably won’t work with the latest version of kodi.

This should get you going again if you are happy to use the commandline:-

OpenVPN setup for private internet access (PIA VPN) OSMC – underscorenews.net

The guide is quite old and for Private Internet Access, but should work for ExpressVPN.

Regards Tom.

VPN Installation

Looking to put a vpn on my Vero 5. I normally usually use zomboid open vpn but have had some issues with it. Also Brian hornsby add on no longer works. Is there another way, I can get a stand alone version of from my provider, either as android or Debian, but don’t know if they can be used on vero 5. Any suggestions as to the best way to get it working.

[aldurbano]

thanks for the hint with “PIA VPN”. Adapting the connection with ExpressVPN is quite obvious.

However, upon CTRL-C, to end the openvpn manual connection,

the external IP Address returns to the original state:

$ wget -qO - icanhazip.com will not return the VPN assigned address afterwrds.

Thus, setting up connecting at startup, will show no VPN assigned address.

Perhaps there is a proper way of ending the connection procedure.

If this still works for “PIA VPN”, the ExpressVPN connection settings might make the difference.

Cheers, Aldo

[Tom_Doyle]

Hi,

Does the connection come up if you run:

sudo systemctl enable --now openvpn

If so the the connection should work again after a reboot.

Regards Tom.

[aldurbano]

@Tom_Doyle

systemctl enable --now openvpn

after this no internet connection, also after reboot.
curl ifconfig.me or arp hostname reported only errors or nothing.
Addons like Radio didn’t work anymore.
To regain internet connection:
systemctl disable --now openvpn
Now the device works normally again.
openvpn status below.
Thanks, Aldo

Here the status of the openvpn service disabled:

osmc@osmc:~$ systemctl status openvpnopenvpn.service - OpenVPN service
Loaded: loaded (/lib/systemd/system/openvpn.service; disabled; vendor preset: enabled)
Active: inactive (dead)
osmc@osmc:~$

Here the status as it was enabled:

openvpn.service - OpenVPN service
Loaded: loaded (/lib/systemd/system/openvpn.service; enabled; vendor preset: enabled)
Active: active (exited) since Fri 2026-04-24 00:12:18 CEST; 3min 5s ago
Process: 2514 ExecStart=/bin/true (code=exited, status=0/SUCCESS)
Main PID: 2514 (code=exited, status=0/SUCCESS)

Apr 24 00:12:18 osmc systemd[1]: Starting OpenVPN service…
Apr 24 00:12:18 osmc systemd[1]: Finished OpenVPN service.
root@osmc:~#

[Tom_Doyle]

Hi,

You could try bypassing /etc/default/openvpn and calling the the service that calls. So example if you conf file is called vpn.conf. You would issue:

sudo systemctl start openvpn@vpn

If that works, please issue:

sudo systemctl diable openvpn
sudo systemctl enable openvpn@vpn

Regards Tom.

[aldurbano]

@Tom_Doyle

systemctl enable openvpn@

Using ExpressVPN setupfile located here:
/etc/openvpn/evpn_myproxy.conf
Issued:

systemctl start openvpn@evpn_myproxy

From other termial (No external address returned, DNS error):
$ wget -qO - icanhazip.com
$ arp google.com
google.com: Unknown server error
$

However, I found a line on the EpressVPN site which works:

openvpn --config /etc/openvpn/evpn_myproxy.conf --script-security 2 --up /etc/openvpn/update-resolv-conf --down /etc/openvpn/update-resolv-conf

There is also mentioned, leaving the process running, no CTRL-C

Not really practicable, requiring a computer connected via ssh for the service to be active.
Upon CTRL-C, the VPN connection is resumed and the direct connection reestablished.

The app from ExpressVPN, which would establish a permanent vpn service, is not supported on Vero

BR, Aldo

[mhthbreeivskqkny]

@aldurbano

Not really practicable, requiring a computer connected via ssh for the service to be active.

Add an ampersand to the end of the command to background the process then you can log out of ssh.

@aldurbano

openvpn --config /etc/openvpn/evpn_myproxy.conf --script-security 2 --up /etc/openvpn/update-resolv-conf --down /etc/openvpn/update-resolv-conf &

Unless vero works differently than every other linux.

[Tom_Doyle]

Hi,

No it should work. Does DNS work when the VPN is down?

If so could you share your conf file, please?

Regards Tom.

[aldurbano]

yes, it works, thanks.

[aldurbano]

Connecting and disconnecting works now:
Connect:

openvpn /etc/openvpn/evpn_myproxy.conf &

Disconnect:

killall openvpn

To connect with a short command line, added those lines to the connection file:
auth-user-pass /etc/openvpn/login.conf $$$ containing credentials $$$
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Running at startup still dosn’t work: no vpn connection established after reboot.

Modified ExpressVPN connection file below.

BR, Aldo

$ cat /etc/openvpn/evpn_myproxy.conf
dev tun
fast-io
persist-key
persist-tun
nobind
remote italy-cosenza-ca-version-2.expressnetw.com 1195

remote-random
pull
comp-lzo no
tls-client
verify-x509-name Server name-prefix
ns-cert-type server
key-direction 1
route-method exe
route-delay 2
tun-mtu 1500
fragment 1300
mssfix 1200
verb 3
cipher AES-256-GCM
auth SHA512
sndbuf 524288
rcvbuf 524288
auth-user-pass /etc/openvpn/login.conf
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

[Tom_Doyle]

Hi,

For testing can you please comment out and remove these lines:-

@aldurbano

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Then try systemctl start openvpn@evpn_myproxy again. You should now how dns, but it won’t vpn provided ones.

If that works we can then look in to getting the vpn provided dns servers working.

Regards Tom.

[aldurbano]

Just don’t understand the test.
To clarify the situation: establishing a connection via vpn manually now works.
With ‘&’ the ssh session might be logged out.
Here the sequence showing Disconnecting, Connecting and Getting vpn / direct ip addrsses:

killall openvpn

openvpn /etc/openvpn/evpn_myproxy.conf & # Connet manually

$ curl ifconfig.me; echo # Get external ip address, providd by the vpn sevice
2.57.170.208
$ arp dm.ateconsult.eu # Get external ip address, direct
dm.ateconsult.eu (84.155.211.220) – no entry
$

Automatically connecting on startup via /etc/default/openvpn: AUTOSTART=evpn_myproxy
want have any effect.

BR, Aldo

[Tom_Doyle]

Hi,

@aldurbano

systemctl start openvpn@evpn_myproxy

From other termial (No external address returned, DNS error):
$ wget -qO - icanhazip.com
$ arp google.com
google.com: Unknown server error

You had no dns when when running the above command. Looking to fix this, so we can just enable that service, so it runs on startup.

Regards Tom.

[aldurbano]

with this command, dns is gone. Device to be rebooted to regain dns.

Check external address is direct (no vpn service active)
$ curl ifconfig.me; echo
84.155.211.220

systemctl start openvpn@evpn_myproxy

$ arp dm.ateconsult.eu
dm.ateconsult.eu: Unknown server error
Reboot
Afterwards external ip address is direct again
$ curl ifconfig.me; echo
84.155.211.220
$
<<<<<<<

[Tom_Doyle]

Hi,

This is with the lines commented or removed out of the config file?

Regards Tom.

[aldurbano]

nope Worksing after commenting out the three lines in /etc/openvpn/evpn_myproxy.conf:

#script-security 2
#up /etc/openvpn/update-resolv-conf
#down /etc/openvpn/update-resolv-conf

Connection get stopped with systemctl stop openvpn

Result below.

BR, Aldo

---

Check external address is direct (no vpn service active)
$ curl ifconfig.me; echo
84.155.211.241

systemctl start openvpn@evpn_myproxy

$ arp dm.ateconsult.eu
dm.ateconsult.eu (84.155.221.241) – no entry
$ curl ifconfig.me; echo
212.30.36.94

systemctl stop openvpn

$ curl ifconfig.me; echo
84.155.221.241
$

---

[fzinken]

@aldurbano

Result below.

Which means it is working?

[Tom_Doyle]

Hi,

So looks like the vpn works without those lines, but not using the VPN providers dns. As far as I am aware this solution still works:-

Network connectivity issues vpn

Hi Tee77, I believe I’ve created a working script which will allow you to use the dns servers from your VPN provider, with no requirement for on resolvconf or openresolv. I would appreciate it if you were happy to test, before doing so you should probably check out the script; it can be found here: https://raw.githubusercontent.com/tomdoyle87/bash-scripts/main/connman-update-resolv I reworked this script for resolvconf: GitHub - alfredopalhares/openvpn-update-resolv-conf: Script that update…

then try with sudo systemctl start openvpn@evpn_myproxy

If that works issues:-

sudo systemctl enable openvpn@evpn_myproxy

Regards Tom.

[aldurbano]

systemctl start / stop is working, but not systemctl enable / disable.