Drıftstack docs
Docs

.ovpn refused or ‘Proxy config was rejected’: unsupported lines / script-security

You might be here because: “Driftstack does not run scripts from VPN configs” · “remove this line and try again” · “ovpn won’t save” · “Proxy config was rejected when the session ended” · “remove unsupported lines button” · “script-security 2 in my config” · “needs a client line” · “my ovpn file is rejected” · “can’t upload ovpn”

Short answer

Driftstack never runs scripts from a VPN config, so a .ovpn with a script line (up, down, route-up, plugin…) is refused and the message names the line. Press Remove unsupported lines in the editor, or delete that line and paste again. A plain script-security 2 line is lowered to 1 automatically, not refused.

Check first

  • Signed in and online? Proxies save to your account.
  • Read the exact refusal under the form — it names the line or field.

Likely causes and fixes

  1. A script line from your provider’s file (commonly up /etc/openvpn/update-resolv-conf). Press the repair button, or delete the numbered line(s) the message names and paste again. The note says exactly what was changed.
  2. A line OpenVPN itself no longer accepts, or Windows-only (keysize, tls-remote, block-outside-dns, register-dns, …). These make the tunnel fail at start with “the session didn’t start”; the app removes them for you and says which.
  3. Missing client line. The file must be a client configuration with a client line and a remote line; the app offers Add the missing client line.
  4. The session ended with “Proxy config was rejected”. The VPN software refused the stored config. Open the proxy and re-paste it — the app will offer to remove what it no longer accepts.
  5. “Line N: your OpenVPN config contains a NUL (zero) byte”. The file is corrupted; re-download it from the provider.

If it still fails

Press Talk to a person in this chat (or open Help) and include the exact refusal sentence and the line number — never the config file, certificates or keys. If a config with no script lines and inline certificates is still refused, a person should look.