The problem 🚧

Uploading a NordVPN .ovpn to the UDR’s OpenVPN client failed with “The configuration file contains an incorrectly formatted or unsupported option.”

Cause: the new NordVPN configs (filenames ending in _2.6) use <tls-crypt> for the control channel. The UniFi Dream Router’s OpenVPN client only supports the older <tls-auth> format. You cannot edit a tls-crypt file into a working one — the NordVPN server expects tls-crypt, so swapping the tag just moves the failure to the TLS handshake. Both ends have to match.

The fix âś…

Download the legacy (tls-auth) config instead of the current one.

Legacy per-server URL pattern (swap the server name):

https://downloads.nordcdn.com/configs/files/ovpn_legacy/servers/tr81.nordvpn.com.udp1194.ovpn
  • .udp1194.ovpn for UDP, .tcp443.ovpn for TCP
  • The key is ovpn_legacy in the path
  • Bulk archive alt: https://downloads.nordcdn.com/configs/archives/servers/ovpn.zip

How to tell if a file is the right one 🔍

  • âś… Good (works on UDR): contains <tls-auth> + key-direction 1, cipher AES-256-CBC, auth SHA512
  • ❌ Bad (fails on UDR): contains <tls-crypt>, filename has _2.6

Quick check:

grep -l tls-auth *.ovpn    # good
grep -l tls-crypt *.ovpn   # bad

Loading it on the UDR đź“Ą

  • Upload the legacy .ovpn to Network → VPN → OpenVPN client
  • Put NordVPN service credentials (not account login) in the Username/Password UI fields
  • Do NOT add auth-user-pass /config/... or route-nopull — those are for EdgeRouter CLI, not UDR
  • Set a policy/traffic route to send the intended source through the tunnel

Notes đź“ť

  • NordVPN’s official Ubiquiti guide is written for EdgeRouter (SSH/EdgeOS), not UDR — ignore the set interfaces openvpn vtun0 CLI steps.
  • Legacy OpenVPN files are being phased out. Future-proof fix: use WireGuard (NordLynx) via the UDR’s native WireGuard client — faster and sidesteps the whole tls-crypt problem.
  • Multiple remote lines / non-1194 ports in the legacy file are fine; trim to one remote only if the UDR complains.