Breadcrumbs

Configuring ExpressVPN on Konnect Open

Overview

This guide walks through adding an ExpressVPN OpenVPN profile to a Konnect Open device and routing an access network through that VPN using an SD-WAN policy route. It also shows how to switch a policy route to a different VPN profile, and how multiple VPN profiles and policy routes can run at the same time.

The example throughout uses a profile named vpnexpress-canada (ExpressVPN Canada – Toronto) and the access network 192.168.70.0/24.

What this capability enables

This turns a single Konnect Open into a multi-country VPN router, with per-network control over where each network exits to the Internet:

  1. Multiple VPN profiles. Set up many VPN profiles on one device (for example, 10), across one or more VPN providers.

  2. All connected at once. Keep every profile up and connected at the same time, and use policy routes to send any access network, or traffic to specific Internet IPs, over any of the VPNs.

Example: a streaming TV network exits through a USA VPN so US services work as expected, while the crew network goes out natively or through a VPN in Spain, Hong Kong, Japan, or wherever the crew prefers. ExpressVPN alone offers locations in over 100 countries.

Figure-01.png
Figure 1. Example: a Konnect Open RS400 with three ExpressVPN profiles connected at once. Streaming TV exits in the USA, Crew Wi-Fi in Spain, Guest Wi-Fi in Japan, and Vessel Ops goes out natively.

Prerequisites

  • An active ExpressVPN account and subscription.

  • Konnect Open running release v2.0.0.492 or later.

  • Access to the device in http://cloud.kognitive.net .

  • The subnet of the access network you want to send over the VPN (visible under the LAN menu).

Part 1: Get your ExpressVPN credentials and .ovpn file

Do this from your workstation or laptop. You will need two things from the ExpressVPN portal: the OpenVPN username/password, and an .ovpn file for the location where the VPN should terminate.

  1. Sign in to http://expressvpn.com in your browser and click Set Up Devices in the left menu.

Figure-02.png
Figure 2. ExpressVPN portal home, with Set Up Devices highlighted

  1. On the Set up your apps page, expand Advanced setup (left menu) and click Manual Configuration.

Figure-03.png
Figure 3. Advanced setup → Manual Configuration

  1. Copy the Username and Password shown under Setup (box 1). Keep them handy for Part 2.

Figure-04.png
Figure 4. Manual configuration page: (1) OpenVPN username and password, (2) location list

Note: These are OpenVPN credentials generated by ExpressVPN for manual setups. They are not the email and password you use to sign in to http://expressvpn.com.

  1. Under step 2 on the same page (box 2), choose the location where the VPN should terminate. For this example, expand Americas and select Canada – Toronto. The browser downloads the matching .ovpn file, e.g. my_expressvpn_canada_-_toronto_udp.ovpn.

Figure-05.png
Figure 5. Selecting Canada – Toronto downloads the .ovpn file to the Downloads folder

Part 2: Create the OpenVPN profile on Konnect Open

  1. In http://cloud.kognitive.net, go to Sites → Topology → <your device> and click the gear icon for the Konnect Open device to open its Configuration.

Figure-06.png
Figure 6. Konnect Open device Configuration page

  1. Select VPN in the left menu, then click Add OpenVPN Profile. On a new system the profile list is empty.

Figure-07.png
Figure 7. VPN page with the Add OpenVPN Profile button (existing profiles shown here for reference)

  1. In the Provider step, enter a Profile Name (e.g. vpnexpress-canada), leave Service Provider set to Manual, and click Next.

Figure-08.png
Figure 8. Add OpenVPN Profile, Provider step

  1. In the Authentication step, click Choose .ovpn file and select the file downloaded in Part 1.

Figure-09.png
Figure 9. Authentication step: upload .ovpn file and enter credentials
Figure-10.png
Figure 10. Selecting the downloaded .ovpn file

  1. Enter the Username and Password copied from the ExpressVPN Manual Configuration page.

Figure-11.png
Figure 11. Where each value comes from: ExpressVPN portal (top) mapped to the Konnect Open dialog (bottom)

  1. Click Configure OpenVPN. The profile is created but is Not Activated yet.

Figure-12.png
Figure 12. New profile listed with state Not Activated

Part 3: Enable the VPN profile

  1. Click the toggle on the left side of the profile row. After a few seconds the state changes to Connected.

Figure-13.png
Figure 13. vpnexpress-canada enabled and Connected

Troubleshooting: If the profile does not reach the Connected state, re-check the username/password and confirm the correct .ovpn file was uploaded.

Part 4: Route an access network over the VPN

  1. Confirm the subnet of the access network under the LAN menu. In this example it is 192.168.70.0/24.

  2. Go to SD-WAN → Policy Routes and click Add Policy Route. Set the Source Network(s) to the access network and select the VPN profile to use.

In the example below, a policy route already sends 192.168.70.0/24 to the ExpressVPN UK (London) profile. The No. of flows column shows the active flows using the route (117 here).

Figure-14.png
Figure 14. Existing policy route sending 192.168.70.0/24 to ExpressVPN-UK

Switching a policy route to a different VPN profile

  1. Click the gear icon on the policy route, choose the new profile from the VPN Profile list (here vpnexpress-canada), and click Update.

Figure-15.png
Figure 15. Edit Policy Route: selecting vpnexpress-canada

After the update, the policy route shows the new VPN profile.

Figure-16.png
Figure 16. Policy route now using vpnexpress-canada

Note: A policy route sends its source network over exactly one VPN profile. Other policy routes can point to other VPN profiles at the same time.

Part 5: Verify

From a workstation connected to the 192.168.70.0/24 network, check your public IP and run a speed test. Both should show the VPN exit location (Toronto, Canada in this example).

Figure-17.png
Figure 17. WhatIsMyIP showing a Toronto, Canada address via the VPN
Figure-18.png
Figure 18. Speed test run over the VPN

Additional capabilities

  • Multiple VPN providers at once - Profiles from different providers (e.g. ExpressVPN, Proton VPN, NordVPN) can be active simultaneously.

  • Multiple profiles and policy routes - For example, send the whole access network (192.168.70.0/24) to the Canada VPN while a more specific policy route sends a media server (192.168.70.100/32) to a USA VPN.

  • Native (non-VPN) routing for a specific host is not supported yet; it is planned for a future release.