MeduzaVPN configurations for third-party clients: v2rayN, Karing, OpenVPN Connect, the .mobileconfig profile for iPhone

Where to get a configuration

Every configuration lives in your account, on your VPN’s card. There’s a list of protocols, a QR code button and a file download button. An important detail: these aren’t different plans or different VPNs — the same personal server hands out every protocol at once, so you can keep WireGuard on your phone, a vless:// link in v2rayN on your work laptop, and an IKEv2 profile on an iPad, without switching anything on our side.

The port and address are already built into the file or link — you don’t need to enter them by hand. If a client asks for “server”, “port” and “password” separately, that means you’ve picked a protocol it can’t import as a whole — it’s easier to pick a different protocol from the list.

What fits which client

Karing and Surge are listed here based on those clients’ own documentation: they accept the same formats, but we haven’t tested them ourselves and can’t promise every last setting will match. If it doesn’t work, contact support — on Windows the tested path is v2rayN.

The Meduza and MeduzaVPN ULTRA protocols are our own — third-party clients don’t understand them: for those you need our apps or the package for Linux and OpenWrt. But they’re also the ones that hold up best where a network filters traffic especially hard.

v2rayN: core, link and local port

Two fields in v2rayN cause the most confusion, and both have a clear answer.

Core type. Choose Xray. Our vless:// links use REALITY, and that technology is implemented in the Xray core; on the v2fly core the connection simply won’t come up. Any core works for vmess://, but there’s no point keeping two — Xray understands both.

Local SOCKS port. Leave it at the default: v2rayN listens for SOCKS on 10808 and HTTP on 10809 on the local address only, and sets the system proxy itself. You only need this number when entering a proxy manually into a browser or another program; in that case use what’s shown in v2rayN’s settings, not an arbitrary number. Change the port only if it conflicts with another program.

The order is: copy the link from your account, choose import from clipboard in v2rayN, then turn on the system proxy. If the connection doesn’t come up, first check that the core is Xray and that your computer’s clock is accurate: a gap of more than a couple of minutes breaks the TLS handshake.

Karing and sing-box

Karing accepts our link as is: copy the vless:// link (or ss:// for Shadowsocks) and add the profile from the clipboard. There is no separate “file for Karing” — it’s the same protocol and the same link as for v2rayN, so you can set up the same link on both your phone and your computer at once. We haven’t tested the client itself: it accepts our format, but the path we’ve tested on Windows is v2rayN.

The honest answer for plain sing-box is: we don’t issue a ready-made JSON configuration. If you specifically need that engine, use Karing — it’s built on sing-box and assembles the configuration from the link itself. If you need JSON specifically, you’ll have to transfer the link’s fields into a configuration by hand; we don’t publish such a template because we don’t want to present as tested something we haven’t verified against every sing-box update.

Shadowsocks, Outline and Surge

Outline and Shadowsocks in your account give you an ss:// key. The official Outline app accepts it straight from the clipboard, and so does any Shadowsocks client. Surge on macOS and iOS understands Shadowsocks and WireGuard, so for it take the ss:// key or the WireGuard .conf file and add it as a new proxy or tunnel.

Worth remembering separately: Shadowsocks and SOCKS5 are proxies, not a full VPN. Only traffic from programs that know how to use a proxy goes through them, not all of the system’s traffic. If you need to cover the whole device, choose WireGuard, OpenVPN, IKEv2 or our apps instead.

OpenVPN Connect and import errors

OpenVPN Connect needs a single .ovpn file — it already contains the certificates and key, no separate files or password needed. To import: “OVPN Profile” → pick the file → connect.

Two errors during import get mixed up constantly, and they’re fixed differently:

• “Incorrect response from server” — the account URL was entered into “Import from URL”. That field is meant for an OpenVPN Access Server and expects its response from the address, but gets an ordinary web page instead. The file isn’t the issue: download the .ovpn to the device and import it via “Import Profile → FILE”.
• “[inline]: cannot open for read” — this one is about the file: the client sees a reference to an embedded certificate block, but the block itself isn’t in the file. The cause on our side has been fixed; download the file again, remove the old profile, and import the fresh one without editing it.

A correct file has <ca>, <cert> and <key> blocks, and it opens in a text editor without cutting off mid-line.

There are two OpenVPN files in your account, both made from the same certificate. The regular client.ovpn works for both OpenVPN Connect and a computer: it has both transports written in — UDP first, then TCP as a fallback — so on a network where UDP doesn’t get through, the client switches to TCP on its own. The second file, TCP only, is for routers — more on that below.

IKEv2: the .mobileconfig profile for iPhone and Mac

Apple can connect IKEv2 on its own, without third-party programs, but you don’t need to and shouldn’t enter the parameters by hand — that’s what the .mobileconfig configuration profile is for. It already contains your VPN’s address, the client certificate and all the encryption parameters, so there’s no way to get the “Remote ID” field wrong.

On the VPN card, select the IKEv2/IPsec protocol — a profile button for iPhone, iPad and Mac appears next to the regular download button. Then:

• iPhone and iPad: open your account in Safari, download the profile, then “Settings” → “Profile Downloaded” → “Install”. Afterwards the profile is visible under “Settings” → “General” → “VPN & Device Management”.
• Mac: the downloaded file opens in “System Settings” → “General” → “Device Management”, where the profile is also confirmed or removed.

Alongside the profile there’s also a credentials.json file — it’s for clients that don’t understand .mobileconfig: Windows’ built-in IKEv2, strongSwan on Android and Linux. The profile and the file describe the same VPN, just in different formats.

One limitation worth knowing in advance: our IKEv2 doesn’t carry IPv6 traffic, and it’s marked with the corresponding icon both in the app and in your account. If you need IPv6, use WireGuard, Meduza or OpenVPN instead.

Routers and OpenVPN over TCP

Standard router firmware — including TP-Link Archer — accepts either an .ovpn file or manual WireGuard parameters. If the ISP doesn’t allow UDP through, WireGuard and our own protocols won’t come up on such a router at all: they run over UDP. That’s the case OpenVPN over TCP is for.

On the VPN card in your account, under the OpenVPN protocol, there are two files, both made from the same certificate:

• client.ovpn — the regular download button. The file has two remote lines: UDP first, then TCP. OpenVPN tries them in the file’s order, so one profile carries both transports and switches to TCP on its own on a network without UDP. This is the file for OpenVPN Connect on a phone and computer.
• client_tcp.ovpn — the “OpenVPN TCP profile for router” button. TCP only, oneremote line. It exists because a fair number of router OpenVPN clients only read the first remote line and silently stay UDP-only on the regular profile — exactly the state you were trying to get out of.

TCP listens on port 1194 — the same number as UDP. OpenVPN specifically does not listen on 443, and promising that would be inaccurate: 443/tcp is taken by VLESS Reality, which lives on that port. If your network only allows 443 through, OpenVPN won’t help — use VLESS Reality or our protocols on a device that has the app.

Both files are regenerated on every VPN update, so for a service that’s been running for a while they’ll appear after the next update. If only one download button is visible in your account, tap “Reinstall” on the card and download the files again.

Other options worth considering on a network without UDP:

• OpenWrt with the MeduzaVPN package — a full solution for a router on a heavily filtered network: our own protocols are available there. For details, see VPN on a router.
• Apps instead of a router — the fastest option: leave the router without a VPN, and connect phones, computers and streaming boxes with apps that pick the protocol automatically.

Conclusion

A third-party client isn’t a “workaround” for using MeduzaVPN — it’s one of the intended ways: the same personal VPN issues a link for v2rayN or Karing, a file for OpenVPN Connect, and a .mobileconfig profile for iPhone. Just take the format your client expects from your account, rather than inventing values for fields that are already filled in for you.

MeduzaVPN subscriptions come with 7 days free and a 15-day refund, and there’s no limit on the number of devices on an account — you can test both the app and a manual setup without worry. Choose a plan.

FAQ