[Feature] OpenVPN tls-auth

[FisherBig]

Verification Steps

• I have read the documentation and confirmed that this feature is not implemented
• I have searched for the feature request I want to propose in the Issue Tracker and did not find it
• I am a non-Chinese user.

Description

Please add tls-auth

[reg-chen]

I would like to add more context for this request.

tls-auth / key-direction support would significantly improve OpenVPN provider compatibility. Many commercial VPN providers still provide manual OpenVPN .ovpn profiles using static key control-channel authentication, for example:

• <tls-auth> ... </tls-auth>
• key-direction 1

Known examples include Surfshark and NordVPN manual OpenVPN profiles.

Test environment

• Clash Verge Rev: Clash.Verge_2.5.2+autobuild.0603.462d9f5
• Bundled Mihomo core: v1.19.26
• Mihomo OpenVPN outbound works with PIA Strong OpenVPN profiles
• PIA Strong profiles do not require tls-auth
• Surfshark OpenVPN profiles still fail because they require tls-auth + key-direction

Working case: PIA Strong OpenVPN

PIA Strong OpenVPN profiles work in Clash Verge Rev / Mihomo OpenVPN outbound.

A working Mihomo OpenVPN proxy looks like this:

- name: "PIA-OpenVPN-Test"
  type: openvpn
  server: taiwan.privacy.network
  port: 1197
  proto: udp
  username: "..."
  password: "..."
  dev: tun
  cipher: AES-256-CBC
  auth: SHA256
  udp: true
  comp-lzo: adaptive
  ca: |
    ...

PIA Strong profiles use:

proto udp
remote taiwan.privacy.network 1197
cipher aes-256-cbc
auth sha256
auth-user-pass
compress

They do not include:

tls-auth
key-direction
tls-crypt

So PIA can currently work because it avoids the tls-auth / key-direction compatibility blocker.

Failing case: Surfshark OpenVPN

Surfshark manual OpenVPN profiles use tls-auth and key-direction.

A redacted Surfshark profile looks like this:

client
dev tun
proto udp
remote tw-tai.prod.surfshark.com 1194
remote-random
nobind
tun-mtu 1500
mssfix 1450
ping 15
ping-restart 0
reneg-sec 0

remote-cert-tls server
auth-user-pass

#comp-lzo
verb 3
fast-io
cipher AES-256-CBC
auth SHA512

<ca>
-----BEGIN CERTIFICATE-----
[REDACTED CA CERTIFICATE]
-----END CERTIFICATE-----
</ca>

key-direction 1

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
[REDACTED TLS-AUTH STATIC KEY]
-----END OpenVPN Static key V1-----
</tls-auth>

The important difference is:

PIA Strong:
  auth-user-pass
  no tls-auth
  no key-direction
  works

Surfshark:
  auth-user-pass
  tls-auth
  key-direction 1
  fails

This suggests that the remaining blocker is tls-auth / key-direction support, not OpenVPN outbound in general.

Expected YAML mapping

A possible Mihomo YAML mapping could be:

tls-auth: |
  ...
key-direction: 1

or any other schema that fits the current OpenVPN outbound design.

Why this matters

This is not provider-specific support. tls-auth / key-direction is a standard OpenVPN profile pattern still used by many commercial VPN providers.

Without tls-auth / key-direction support, Mihomo OpenVPN outbound can work with providers like PIA, but cannot use many other commercial OpenVPN profiles such as Surfshark or NordVPN.

Would it be feasible to support inline <tls-auth> and key-direction in Mihomo OpenVPN outbound?

Thank you.

[Rifal-Prasetyo]

nah, i also still waiting for this

[ivanglushko]

Deal breaker for me too (given the setup openvpn from amnezia app)

[crypt0nX]

Hi, I created a PR here.