---
type: concept
title: VPN Access
created: 2026-06-30
updated: 2026-06-30
tags: [network, security, remote-access, network-security, encryption]
related: [openvpn, nutzerzertifikate, shibboleth, nas.rz.uni-greifswald.de, hpc-brain-cluster, openvpn-connect, zentraler-nutzeraccount, p12-file]
sources: ["output/rz_uni_greifswald_de_dienste_technische-infrastruktur-vpn.md", "output/rz_uni_greifswald_de_dienste_technische_infrastruktur_vpn.md", "output/rz_uni_greifswald_de_dienste_technische-infrastruktur_vpn_ios.md", "output/rz_uni_greifswald_de_dienste_technische_infrastruktur_vpn_ios.md", "output/rz_uni_greifswald_de_dienste_technische-infrastruktur-vpn-linux.md", "output/rz_uni_greifswald_de_dienste_technische_infrastruktur_vpn_linux.md", "output/rz_uni_greifswald_de_dienste_technische_infrastruktur_vpn_windows.md"]
---

# VPN Access

**VPN (Virtual Private Networking)** at the Universität Greifswald is a secure, encrypted tunnel provided by the [[universitatsrechenzentrum-urz]] that allows remote devices to connect to the internal university network as if they were physically connected to the campus infrastructure.

## Purpose and Use Cases
The primary goal of the VPN is to extend the university's internal network to remote users. Key resources accessed via VPN include:
- The central file server ([[nas.rz.uni-greifswald.de]]).
- High Performance Computing (HPC) clusters ([[hpc-brain-cluster]]).
- Other internal-only web services and applications.

**Restriction**: VPN usage is only intended for users who are physically outside the university network or those connected to the open "UniHGW" WLAN.

## Prerequisites and Authentication
To establish a VPN connection, the university requires a multi-factor approach to identity verification.

### Authentication Mechanism
The university employs a dual-authentication method to ensure high security:
- **User Identity/Credentials**: Verified via the [[zentraler-nutzeraccount]] (username and password).
- **Device/User Authorization**: Verified via [[nutzerzertifikate]] (specifically an `ovpn12` key file) and its associated password.

### Required Components
Users must obtain and import the following components into their client software:
1. **VPN Client**: Software (such as [[openvpn-connect]]) that initiates the tunnel.
2. **X.509 User Certificate**: A PKI-based identity file (imported as a [[p12-file]]) created via the [[ums]]. This security file proves the user's identity to the VPN server during the initial handshake.
3. **VPN Profile**: A configuration file (`.ovpn`) containing the server addresses and technical parameters of the university's VPN gateway. This file must be downloaded based on the user's role.

## Technical Implementation
The university utilizes the **OpenVPN** protocol.

### Platform Support
VPN access is supported across various operating systems:
- **Mobile**: [[ios]] / iPadOS and Android.
- **Desktop**: Windows, macOS, and Ubuntu/Linux.
- **Other**: ChromeOS.

### Linux-Specific Implementation
For Linux users (specifically Ubuntu/Xubuntu), the URZ recommends using the **Network Manager** with OpenVPN plugins. The authentication type is configured as **Password with Certificates (TLS)**.

### Routing and Split-Tunneling
To maintain optimal performance and privacy, the VPN is configured for **split-tunneling**. This is achieved by enabling the setting *"Use this connection only for resources on its network"* in the IPv4 routing configuration. This ensures that:
- Traffic destined for university internal resources is routed through the encrypted VPN tunnel.
- General internet traffic continues to use the user's local internet connection.

### Profile Types
| Profile | Target Audience | Capabilities |
|---|---|---|
| **Member** | Students and Staff | Full internal access + Proxy access for publications. |
| **Mobile** | Students and Staff | Full internal access; optimized for mobile OS. |
| **Technical** | Other users | Internal resource access only; no proxy/publication access. |

## Relationship with Academic Publications
Historically, VPN was the primary method for accessing licensed journals via the [[universitatsbibliothek-ub]]. However, there is a transition toward [[shibboleth]]-based authentication, which does not require a VPN. 

Despite this, a combination of **VPN and a Proxy-Server** remains mandatory for certain publishers, such as **BeckOnline** and **Juris**, provided the license supports VPN access.