Skip to content

Windows: connect to TrueServe through OpenVPN

Last reviewed: 2026-09-21

This guide assumes your city owner has started its OpenVPN relay and given you your personal ZIP. It supports Dev and QA together, including UDP voice traffic. Each laptop needs its own certificate. Your pilot certificate expires 30 days after it was issued; request a replacement bundle before then.

For automatic startup, route updates and a 30-minute connection check, use the AUTOMATIC-SETUP.md guide included in updated bundles, or the handbook's Automatic laptop access maintenance. Your city owner must enable discovery first. The steps below are the manual GUI option.

1. Install OpenVPN Community 2.7 or later

Download OpenVPN Community for Windows x64 from https://openvpn.net/community-downloads/ using your approved installation process. Choose the installer that includes OpenVPN GUI, the OpenVPN Interactive Service, and the DCO network driver. This guide uses Community GUI, not OpenVPN Connect. Ask IT to approve/install the components if device policy blocks them. Installing another VPN does not override corporate device restrictions.

What this does: installs a network adapter and a service that lets the GUI apply the connection's routes and scoped DNS settings. Version 2.7 is required for the DNS setup in this bundle. Do not substitute an older client.

2. Keep your normal core VPC VPN connected

Connect the VPN you normally use to reach your city. Leave it connected. Disconnect any old TrueServe WireGuard tunnel before continuing. If you enabled DNS with the old WireGuard helper, open administrator PowerShell in that old bundle and run .\windows.ps1 down for the CLI setup, or .\windows.ps1 dns-off for the GUI setup and deactivate the TrueServe tunnel. If cleanup reports an error, ask the city owner to inspect the saved state. Do not remove another application's WireGuard services or DNS rules.

What this does: keeps the path to the city's private address available and avoids two TrueServe tunnels competing for the same routes and DNS names. You do not need to uninstall WireGuard.

3. Extract your ZIP and import the both profile

Right-click the ZIP → Extract All into a private folder under your user directory, for example C:\Users\YOUR_NAME\TrueServeAccess\OpenVPN. Start OpenVPN GUI from the Start menu. Its icon appears in the notification area by the clock; use the small arrow to reveal hidden icons if needed. Right-click the icon → Import → Import file, then select TrueServe-shimla-both.ovpn (or the matching city name).

What this does: installs your private device identity and the list of TrueServe destinations. The profile contains credentials: do not email it to a group, paste its contents into chat, commit it, or share it with a colleague. Use the private delivery method agreed with your city owner.

4. Connect

Right-click the GUI icon → select your imported profile → Connect. Wait for the connected notification. No VPN username/password is needed: your personal certificate authenticates this tunnel. Studio still uses its normal sign-in page.

What this does: sends TrueServe traffic through the city. The both profile supports Dev and QA simultaneously. It adds specific destination routes and DNS rules for the listed TrueServe hostnames, rather than changing your default internet route or all of your DNS.

Do not run windows.ps1 dns-on for this OpenVPN connection. OpenVPN's Interactive Service installs and removes its own DNS rules.

5. Open Studio and test a call

  • Dev: https://studio.dev.trueserve.deloitte.com/
  • QA: https://studio.qa.trueserve.deloitte.com/

Use your normal browser and sign in. Try a voice call: verify you can hear the agent and the agent responds to your microphone. The city probe checks network transport; this call confirms browser permissions and media work on your laptop.

If a page cannot be found, open PowerShell and run:

Resolve-DnsName studio.qa.trueserve.deloitte.com
Test-NetConnection studio.qa.trueserve.deloitte.com -Port 443
Get-Service OpenVPNServiceInteractive

Send the results and the GUI connection log (right-click profile → View Log) to the city owner. Do not send the .ovpn file. nslookup may bypass Windows' scoped DNS policy, so use Resolve-DnsName for this check. If the browser uses its own secure DNS resolver, have IT configure it to use system DNS for these internal sites; do not change a managed browser policy yourself.

If the log says the DCO driver is unavailable, or falls back to TAP, have IT repair the DCO/Interactive Service installation. The profile's scoped DNS relies on the supported Windows 2.7 path; do not add global DNS or disable the core VPN. If the relay connects but a site returns 503, report which environment and hostname: a working tunnel cannot repair an unhealthy upstream application.

6. Disconnect or switch

Right-click the active OpenVPN profile → Disconnect. Its routes and DNS rules are removed; your core VPC VPN can stay connected.

Normally keep using both. To limit the destination list to one environment, disconnect first, import the -dev.ovpn or -qa.ovpn profile, then connect it. Only activate one of these TrueServe profiles at a time. They use the same device certificate; these choices limit client routing, not application access permissions. Shared SSO and any reviewed extra media routes remain included.

If Windows restarts, connect the core VPN first, then connect OpenVPN again.