Dietpi-vpn not working with NordVPN since 15 Jul 2026 with Service Credentials

gordon.freeman87 · 15 July 2026 14:41

Creating a bug report/issue

I have searched the existing open and closed issues

Required Information

DietPi version | G_DIETPI_VERSION_CORE=10; G_DIETPI_VERSION_SUB=5; G_DIETPI_VERSION_RC=2; G_GITBRANCH=‘master’; G_GITOWNER=‘MichaIng’
Distro version | trixie
Kernel version | Linux NanoPi 6.1.115-vendor-rk35xx #1 SMP Sun Jul 5 09:57:57 UTC 2026 aarch64 GNU/Linux
Architecture | arm64
SBC model | NanoPi 6 series (aarch64) (NanoPi R6C)
Power supply used | 70W Spigen + 100W Duracell USB-C cable
SD card used | SanDisk Extreme 128 GB

Additional Information (if applicable)

Software title | dietpi-vpn
Was the software title installed freshly or updated/migrated? No
Can this issue be replicated on a fresh installation of DietPi?
← If you sent a “dietpi-bugreport”, please paste the ID here →
Bug report ID | e0b39351-5ac7-4c66-a2d9-a7e4b562968e

Steps to reproduce

dietpi-vpn is configured to connect to sg481.nordvpn.com.udp.ovpn server (NordVPN) with service credentials(e.g. Username:wU**********, Password: 234sd*******) and has been working w/o any issues for past 2 years but it stopped working today without any updates to system or modifications. Screen output below when I connect to VPN via dietpi-vpn with UDP protocol

Expected behaviour

I should be able to login to NordVPN via dietpi-vpn using service credentials and UDP protocol

…

Actual behaviour

              │ Connection failed/timeout: sg481.nordvpn.com.udp.ovpn                                                                │
              │                                                                                                                      │
              │ Please verify account details are correct.                                                                           │
              │                                                                                                                      │
              │ If problems persist, please check the service status: "systemctl -l status dietpi-vpn"

…

Extra details

I have repasted service credentials into dietpi-vpn from NordVPN portal but same issue persists.
I tried with nordvpn command line application and I can login to Nord via access token so this issue is isolated to dietpi-vpn
[flexget]root:/mnt/dietpi_userdata/scripts# nordvpn connect Singapore
Connecting to Singapore #650 (sg650.nordvpn.com)
You are connected to Singapore #650 (sg650.nordvpn.com)!

…

[flexget]root:/mnt/dietpi_userdata/scripts# dietpi-vpn

[  OK  ] DietPi-VPN | chmod +x /var/lib/dietpi/dietpi-vpn/static_up.sh /var/lib/dietpi/dietpi-vpn/static_down.sh

[  OK  ] DietPi-VPN | umask 0077

[ INFO ] DietPi-VPN | Generating OVPN file, please wait...

[  OK  ] DietPi-VPN | cp -f /etc/openvpn/nordvpn/ovpn_udp/sg481.nordvpn.com.udp.ovpn /etc/openvpn/client.ovpn

[  OK  ] DietPi-VPN | umask 0022

[  OK  ] DietPi-VPN | chmod 0600 /var/lib/dietpi/dietpi-vpn/settings_ovpn.conf /var/lib/dietpi/dietpi-vpn/settings_dietpi.conf /etc/openvpn/client.ovpn

[  OK  ] DietPi-VPN | chown root:root /var/lib/dietpi/dietpi-vpn/settings_ovpn.conf /var/lib/dietpi/dietpi-vpn/settings_dietpi.conf /etc/openvpn/client.ovpn

[  OK  ] DietPi-VPN | Setting in /etc/openvpn/client.ovpn adjusted: auth-user-pass /var/lib/dietpi/dietpi-vpn/settings_ovpn.conf

[  OK  ] DietPi-VPN | Added setting script-security 2 to /etc/openvpn/client.ovpn after line auth SHA512

[  OK  ] DietPi-VPN | Added setting up /var/lib/dietpi/dietpi-vpn/static_up.sh to /etc/openvpn/client.ovpn after line script-security 2

[  OK  ] DietPi-VPN | Added setting down /var/lib/dietpi/dietpi-vpn/static_down.sh to /etc/openvpn/client.ovpn after line up /var/lib/dietpi/dietpi-vpn/static_up.sh

[  OK  ] DietPi-VPN | sed --follow-symlinks -i /^[[:blank:]]*route-up[[:blank:]]/d /etc/openvpn/client.ovpn

[  OK  ] DietPi-VPN | sed --follow-symlinks -i /^[[:blank:]]*route-pre-down[[:blank:]]/d /etc/openvpn/client.ovpn

[ INFO ] DietPi-VPN | Checking for required APT packages: openvpn

[  OK  ] DietPi-VPN | systemctl restart dietpi-vpn

[ ..   ] DietPi-VPN | Waiting for connection (14/20)

...

[flexget]root:/mnt/dietpi_userdata/scripts# systemctl -l status dietpi-vpn

○ dietpi-vpn.service - VPN Client (DietPi)

     Loaded: loaded (/etc/systemd/system/dietpi-vpn.service; enabled; preset: enabled)

     Active: inactive (dead) since Wed 2026-07-15 20:04:46 IST; 29s ago

   Duration: 21.650s

 Invocation: 45d15170aa814094ac78cc6f49e5763f

    Process: 3506 ExecStart=/usr/sbin/openvpn --suppress-timestamps --nobind --config /etc/openvpn/client.ovpn (code=exited, status=0/SUCCESS)

   Main PID: 3506 (code=exited, status=0/SUCCESS)

     Status: "Pre-connection initialization successful"

   Mem peak: 2M

        CPU: 98ms

Jul 15 20:04:25 NanoPi systemd[1]: Started dietpi-vpn.service - VPN Client (DietPi).

Jul 15 20:04:25 NanoPi openvpn[3506]: TCP/UDP: Preserving recently used remote address: [AF_INET]84.17.39.215:1194

Jul 15 20:04:25 NanoPi openvpn[3506]: Socket Buffers: R=[212992->212992] S=[212992->212992]

Jul 15 20:04:25 NanoPi openvpn[3506]: UDPv4 link local: (not bound)

Jul 15 20:04:25 NanoPi openvpn[3506]: UDPv4 link remote: [AF_INET]84.17.39.215:1194

Jul 15 20:04:46 NanoPi openvpn[3506]: event_wait : Interrupted system call (fd=-1,code=4)

Jul 15 20:04:46 NanoPi systemd[1]: Stopping dietpi-vpn.service - VPN Client (DietPi)...

Jul 15 20:04:46 NanoPi openvpn[3506]: SIGTERM[hard,] received, process exiting

Jul 15 20:04:46 NanoPi systemd[1]: dietpi-vpn.service: Deactivated successfully.

Jul 15 20:04:46 NanoPi systemd[1]: Stopped dietpi-vpn.service - VPN Client (DietPi).


[flexget]root:/mnt/dietpi_userdata/scripts# journalctl -u dietpi-vpn
Jul 15 20:01:16 NanoPi systemd[1]: Starting dietpi-vpn.service - VPN Client (DietPi)...
Jul 15 20:01:17 NanoPi openvpn[705]: DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
Jul 15 20:01:17 NanoPi openvpn[705]: Note: '--allow-compression' is not set to 'no', disabling data channel offload.
Jul 15 20:01:17 NanoPi openvpn[705]: OpenVPN 2.6.14 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
Jul 15 20:01:17 NanoPi openvpn[705]: library versions: OpenSSL 3.5.6 7 Apr 2026, LZO 2.10
Jul 15 20:01:17 NanoPi openvpn[705]: DCO version: N/A
Jul 15 20:01:17 NanoPi openvpn[705]: WARNING: --ping should normally be used with --ping-restart or --ping-exit
Jul 15 20:01:17 NanoPi openvpn[705]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jul 15 20:01:17 NanoPi systemd[1]: Started dietpi-vpn.service - VPN Client (DietPi).
Jul 15 20:01:17 NanoPi openvpn[705]: TCP/UDP: Preserving recently used remote address: [AF_INET]84.17.39.215:1194
Jul 15 20:01:17 NanoPi openvpn[705]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Jul 15 20:01:17 NanoPi openvpn[705]: UDPv4 link local: (not bound)
Jul 15 20:01:17 NanoPi openvpn[705]: UDPv4 link remote: [AF_INET]84.17.39.215:1194
Jul 15 20:02:18 NanoPi openvpn[705]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Jul 15 20:02:18 NanoPi openvpn[705]: TLS Error: TLS handshake failed
Jul 15 20:02:18 NanoPi openvpn[705]: SIGUSR1[soft,tls-error] received, process restarting
Jul 15 20:02:18 NanoPi openvpn[705]: Restart pause, 1 second(s)
Jul 15 20:02:19 NanoPi openvpn[705]: WARNING: --ping should normally be used with --ping-restart or --ping-exit
Jul 15 20:02:19 NanoPi openvpn[705]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jul 15 20:02:19 NanoPi openvpn[705]: TCP/UDP: Preserving recently used remote address: [AF_INET]84.17.39.215:1194
Jul 15 20:02:19 NanoPi openvpn[705]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Jul 15 20:02:19 NanoPi openvpn[705]: UDPv4 link local: (not bound)
Jul 15 20:02:19 NanoPi openvpn[705]: UDPv4 link remote: [AF_INET]84.17.39.215:1194
Jul 15 20:02:43 NanoPi systemd[1]: Stopping dietpi-vpn.service - VPN Client (DietPi)...
Jul 15 20:02:43 NanoPi openvpn[705]: event_wait : Interrupted system call (fd=-1,code=4)
Jul 15 20:02:43 NanoPi openvpn[705]: SIGTERM[hard,] received, process exiting
Jul 15 20:02:43 NanoPi systemd[1]: dietpi-vpn.service: Deactivated successfully.
Jul 15 20:02:43 NanoPi systemd[1]: Stopped dietpi-vpn.service - VPN Client (DietPi).
Jul 15 20:02:43 NanoPi systemd[1]: Starting dietpi-vpn.service - VPN Client (DietPi)...
Jul 15 20:02:43 NanoPi openvpn[2533]: DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
Jul 15 20:02:43 NanoPi openvpn[2533]: Note: '--allow-compression' is not set to 'no', disabling data channel offload.
Jul 15 20:02:43 NanoPi openvpn[2533]: OpenVPN 2.6.14 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
Jul 15 20:02:43 NanoPi openvpn[2533]: library versions: OpenSSL 3.5.6 7 Apr 2026, LZO 2.10
Jul 15 20:02:43 NanoPi openvpn[2533]: DCO version: N/A
Jul 15 20:02:43 NanoPi openvpn[2533]: WARNING: --ping should normally be used with --ping-restart or --ping-exit
Jul 15 20:02:43 NanoPi openvpn[2533]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jul 15 20:02:43 NanoPi systemd[1]: Started dietpi-vpn.service - VPN Client (DietPi).
Jul 15 20:02:43 NanoPi openvpn[2533]: TCP/UDP: Preserving recently used remote address: [AF_INET]84.17.39.215:1194
Jul 15 20:02:43 NanoPi openvpn[2533]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Jul 15 20:02:43 NanoPi openvpn[2533]: UDPv4 link local: (not bound)
Jul 15 20:02:43 NanoPi openvpn[2533]: UDPv4 link remote: [AF_INET]84.17.39.215:1194
Jul 15 20:03:04 NanoPi openvpn[2533]: event_wait : Interrupted system call (fd=-1,code=4)
Jul 15 20:03:04 NanoPi openvpn[2533]: SIGTERM[hard,] received, process exiting
Jul 15 20:03:04 NanoPi systemd[1]: Stopping dietpi-vpn.service - VPN Client (DietPi)...
Jul 15 20:03:04 NanoPi systemd[1]: dietpi-vpn.service: Deactivated successfully.
Jul 15 20:03:04 NanoPi systemd[1]: Stopped dietpi-vpn.service - VPN Client (DietPi).
Jul 15 20:03:57 NanoPi systemd[1]: Starting dietpi-vpn.service - VPN Client (DietPi)...
Jul 15 20:03:57 NanoPi openvpn[3153]: DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
Jul 15 20:03:57 NanoPi openvpn[3153]: Note: '--allow-compression' is not set to 'no', disabling data channel offload.
Jul 15 20:03:57 NanoPi openvpn[3153]: OpenVPN 2.6.14 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
Jul 15 20:03:57 NanoPi openvpn[3153]: library versions: OpenSSL 3.5.6 7 Apr 2026, LZO 2.10
Jul 15 20:03:57 NanoPi openvpn[3153]: DCO version: N/A
Jul 15 20:03:57 NanoPi openvpn[3153]: WARNING: --ping should normally be used with --ping-restart or --ping-exit
Jul 15 20:03:57 NanoPi openvpn[3153]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jul 15 20:03:57 NanoPi systemd[1]: Started dietpi-vpn.service - VPN Client (DietPi).
Jul 15 20:03:57 NanoPi openvpn[3153]: TCP/UDP: Preserving recently used remote address: [AF_INET]84.17.39.215:1194
Jul 15 20:03:57 NanoPi openvpn[3153]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Jul 15 20:03:57 NanoPi openvpn[3153]: UDPv4 link local: (not bound)
Jul 15 20:03:57 NanoPi openvpn[3153]: UDPv4 link remote: [AF_INET]84.17.39.215:1194
Jul 15 20:04:18 NanoPi openvpn[3153]: event_wait : Interrupted system call (fd=-1,code=4)
Jul 15 20:04:18 NanoPi systemd[1]: Stopping dietpi-vpn.service - VPN Client (DietPi)...
Jul 15 20:04:18 NanoPi openvpn[3153]: SIGTERM[hard,] received, process exiting
Jul 15 20:04:18 NanoPi systemd[1]: dietpi-vpn.service: Deactivated successfully.
Jul 15 20:04:18 NanoPi systemd[1]: Stopped dietpi-vpn.service - VPN Client (DietPi).
Jul 15 20:04:25 NanoPi systemd[1]: Starting dietpi-vpn.service - VPN Client (DietPi)...
Jul 15 20:04:25 NanoPi openvpn[3506]: DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305). OpenVPN ignores --cipher for cipher negotiations.
Jul 15 20:04:25 NanoPi openvpn[3506]: Note: '--allow-compression' is not set to 'no', disabling data channel offload.
Jul 15 20:04:25 NanoPi openvpn[3506]: OpenVPN 2.6.14 aarch64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
Jul 15 20:04:25 NanoPi openvpn[3506]: library versions: OpenSSL 3.5.6 7 Apr 2026, LZO 2.10
Jul 15 20:04:25 NanoPi openvpn[3506]: DCO version: N/A
Jul 15 20:04:25 NanoPi openvpn[3506]: WARNING: --ping should normally be used with --ping-restart or --ping-exit
Jul 15 20:04:25 NanoPi openvpn[3506]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jul 15 20:04:25 NanoPi systemd[1]: Started dietpi-vpn.service - VPN Client (DietPi).
Jul 15 20:04:25 NanoPi openvpn[3506]: TCP/UDP: Preserving recently used remote address: [AF_INET]84.17.39.215:1194
Jul 15 20:04:25 NanoPi openvpn[3506]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Jul 15 20:04:25 NanoPi openvpn[3506]: UDPv4 link local: (not bound)
Jul 15 20:04:25 NanoPi openvpn[3506]: UDPv4 link remote: [AF_INET]84.17.39.215:1194
Jul 15 20:04:46 NanoPi openvpn[3506]: event_wait : Interrupted system call (fd=-1,code=4)
Jul 15 20:04:46 NanoPi systemd[1]: Stopping dietpi-vpn.service - VPN Client (DietPi)...
Jul 15 20:04:46 NanoPi openvpn[3506]: SIGTERM[hard,] received, process exiting
Jul 15 20:04:46 NanoPi systemd[1]: dietpi-vpn.service: Deactivated successfully.
Jul 15 20:04:46 NanoPi systemd[1]: Stopped dietpi-vpn.service - VPN Client (DietPi).

gordon.freeman87 · 15 July 2026 14:46

                   ●─ Connection Settings ----------------------------------------●                      │
              │                     Provider   : [NordVPN]                                                                           │
              │                     Username   : [wU*********************]                                                          │
              │                     Password   : [************************]                                                          │
              │                     Server     : [sg481.nordvpn.com.udp.ovpn]                                                        │
              │                                ●─ Control Options --------------------------------------------●                      │
              │                     Refresh    : Update VPN connection status                                                        │
              │                     Update     : Update VPN server list                                                              │
              │                     Reset      : Remove and reset ALL configs and settings                                           │
              │                                ●─ Advanced Options -------------------------------------------●                      │
              │                     Autostart  : [On] Connect to VPN at boot                                                         │
              │                     Killswitch : [Off] Block traffic on connection loss via iptables                                 │
              │                     Edit Up    : This script gets executed right after the VPN is connected                          │
              │                     Edit Down  : This script gets executed right before the VPN is disconnected                      │
              │                                ●─ Save Settings ----------------------------------------------●                      │
              │                     Apply      : Save settings and restart VPN connection

MichaIng · 15 July 2026 16:16

Verify that the particular token you use with dietpi-vpn is still valid.

And please paste the service logs:

journalctl -u dietpi-vpn

It is probably a (temporary) issue with the particular server rather than with the credentials.

gordon.freeman87 · 15 July 2026 17:19

@MichaIng thanks a lot. I figured it out.

I have a daily script which runs via crontab to update VPN config files as follows-

#-#NordVPN OPVN Configuration Update

cd /etc/openpvn

apt-get install ca-certificates
wget https://downloads.nordcdn.com/configs/archives/servers/ovpn.zip
unzip -uv ovpn.zip -d /etc/openvpn
rm -vf ovpn.zip

However this is pulling old configs.

I updated the config files via dietpi-vpn command option as follows-

Update : Update VPN server list

This pulled fresh server list and old server names are now deprecated.

I was able to connect to “sg655.nordvpn.com.udp_2.6.ovpn” via dietpi-vpn after that with same credentials.

It throws an error on dietpi-vpn screen as follows but still works.All internet accessing applications are working as expected.

              │ [FAILED] Setting could not be added after desired line                                                               │
              │                                                                                                                      │
              │ The pattern $4                                                                                                       │
              │         auth[[:blank:]]                                                                                              │
              │ could not be found in file $3                                                                                        │
              │         /etc/openvpn/client.ovpn                                                                                     │
              │                                                                                                                      │
              │ Please retry with valid parameter $4 or apply the setting manually:                                                  │
              │         script-security 2

MichaIng · 16 July 2026 09:29

Thanks for the info. Looks like we attempt to add the up/down command support after a line that does not exist anymore in new configs. I’ll fix that for next release.