I needed Azure P2S with Entra ID on Linux, so I ended up building a client for it

I recently needed to connect my Linux machine to an existing Azure Point-to-Site VPN that uses Microsoft Entra ID authentication.

And that turned out to be surprisingly awkward. First of all the Linux version of The Azure VPN Client never made it past preview and officially supported only Ubuntu 20.04 and 22.04. As of August 31, Microsoft has officially retired it: it's no longer supported, won't receive fixes or security updates, and the package is being removed from Microsoft's Linux repository.

Even before its retirement, it wasn't much help in my case: it still authenticated using the old app id, so the connection was rejected.

The suggested Linux replacements are regular OpenVPN or strongSwan, but they require certificate or RADIUS authentication. That doesn't really help if your existing P2S gateway uses Entra ID.

So I started digging into whether regular OpenVPN could connect using an Entra access token.

During the investigation I found this post by u/cveld and Luca Boccassi patches. Once I had a working connection, I started removing changes one by one to see what was really required.

At least on the Azure Public gateway I tested, OpenVPN didn't need to imitate the official client's TLS behavior, OCC string, or peer-info. The connection worked with only two buffer changes:

• USER_PASS_LEN: 128 -> 4096
• TLS_CHANNEL_BUF_SIZE: 2048 -> 8192

The Azure Entra token is simply much larger than the username/password buffer OpenVPN expects, and the resulting payload also exceeds its default buffer.

By this point, my invetigation had grown into a pile of code for authentication, profile parsing, routing, DNS, and privilege handling. So I decided to clean it up a bit and turn it into a proper CLI.

openp2s connect azurevpnconfig.xml

It can:

• import an Azure VPN XML profile;
• authenticate through the Entra device-code flow;
• connect using the minimally patched OpenVPN;
• apply pushed routes and split DNS through systemd-resolved;
• show connection status and disconnect cleanly;
• inspect profiles and run doctor/probe diagnostics;
• keep the access token out of generated configuration files and clean up temporary state.

The OpenVPN patch is intentionally small. I don't want to maintain a permanent fork – the goal is to reduce or remove it when the necessary upstream buffer changes become available.

Repo: https://github.com/wyruweso/openp2s

It's unofficial, still young, and currently tested against only one real environment. I'd be very interested in feedback from anyone using different gateway configurations – or from people who know the OpenVPN control channel well enough to spot things I may have missed.