Drıftstack docs
Docs

.ovpn refused or ‘Proxy config was rejected’: unsupported lines / script-security

You might be here because: “Driftstack does not run scripts from VPN configs” · “remove this line and try again” · “ovpn won’t save” · “Proxy config was rejected when the session ended” · “remove unsupported lines button” · “script-security 2 in my config” · “needs a client line” · “my ovpn file is rejected” · “can’t upload ovpn”

Short answer

Driftstack never runs scripts from a VPN config, so a .ovpn with a script line (up, down, route-up, plugin…) is refused and the message names the line. Press Remove unsupported lines in the editor, or delete that line and paste again. A plain script-security 2 line is lowered to 1 automatically, not refused. Some other lines are refused when you save too, each with its own sentence: a line that reads or writes a file on the server, and a line the OpenVPN that runs your session does not accept. Routing lines (route, redirect-gateway, …) are not refused: they are removed automatically when you save.

Check first

  • Signed in and online? Proxies save to your account.
  • Read the exact refusal under the form — it names the line or field.

Likely causes and fixes

  1. A script line from your provider’s file (commonly up /etc/openvpn/update-resolv-conf). Press the repair button, or delete the numbered line(s) the message names and paste again. The note says exactly what was changed.
  2. A line OpenVPN itself no longer accepts, or Windows-only (keysize, tls-remote, block-outside-dns, register-dns, …). The save is refused: the message names the line and says it “is not accepted by the OpenVPN that runs your session … so it would refuse the whole config. Remove this line and try again.” Remove unsupported lines takes them out for you.
  3. A line that reads or writes a file on the server (for example log, status, or auth-user-pass followed by a file name). The save is refused with “… reads a file on the server; Driftstack does not read files from VPN configs.” or “… writes a file on the server; Driftstack does not let VPN configs write files.” For auth-user-pass, keep just auth-user-pass on the line and enter the username and password with the VPN.
  4. Missing client line. The file must be a client configuration with a client line and a remote line; the app offers Add the missing client line.
  5. The session ended with “Proxy config was rejected”. The VPN software refused the stored config. Open the proxy and re-paste it — the app will offer to remove what it no longer accepts.
  6. “Line N: your OpenVPN config contains a NUL (zero) byte”. The file is corrupted; re-download it from the provider.

If it still fails

Press Talk to a person in this chat (or open Help) and include the exact refusal sentence and the line number — never the config file, certificates or keys. If a config with no script lines and inline certificates is still refused, a person should look.