diff --git a/package/network/services/openvpn/Makefile b/package/network/services/openvpn/Makefile
index f1170bbd37..9482e9ce39 100644
--- a/package/network/services/openvpn/Makefile
+++ b/package/network/services/openvpn/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=openvpn
 
 PKG_VERSION:=2.4.9
-PKG_RELEASE:=2
+PKG_RELEASE:=4
 
 PKG_SOURCE_URL:=\
 	https://build.openvpn.net/downloads/releases/ \
@@ -112,6 +112,7 @@ define Package/openvpn-$(BUILD_VARIANT)/install
 		$(1)/etc/init.d \
 		$(1)/etc/config \
 		$(1)/etc/openvpn \
+		$(1)/lib/functions \
 		$(1)/lib/upgrade/keep.d \
 		$(1)/usr/libexec \
 		$(1)/etc/hotplug.d/openvpn
@@ -128,6 +129,10 @@ define Package/openvpn-$(BUILD_VARIANT)/install
 		files/usr/libexec/openvpn-hotplug \
 		$(1)/usr/libexec/openvpn-hotplug
 
+	$(INSTALL_DATA) \
+		files/lib/functions/openvpn.sh \
+		$(1)/lib/functions/openvpn.sh
+
 	$(INSTALL_DATA) \
 		files/etc/hotplug.d/openvpn/01-user \
 		$(1)/etc/hotplug.d/openvpn/01-user
diff --git a/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user b/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user
index 6d45f0b7c6..f93823e5c5 100644
--- a/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user
+++ b/package/network/services/openvpn/files/etc/hotplug.d/openvpn/01-user
@@ -1,17 +1,6 @@
 #!/bin/sh
 
-get_option() {
-	local variable="$1"
-	local option="$2"
-
-	local value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+(([^ \t\\]|\\.)+)[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
-	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+'"'([^']+)'"'[ \t]*$/\1/p' "$config" | tail -n1)"
-	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+"(([^"\\]|\\.)+)"[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
-	[ -n "$value" ] || return 1
-
-	export -n "$variable=$value"
-	return 0
-}
+. /lib/functions/openvpn.sh
 
 [ -e "/etc/openvpn.user" ] && {
 	env -i ACTION="$ACTION" INSTANCE="$INSTANCE" \
@@ -23,8 +12,9 @@ get_option() {
 # Wrap user defined scripts on up/down events
 case "$ACTION" in
 	up|down)
-		if get_option command "$ACTION"; then
-			exec /bin/sh -c "$command $ACTION $INSTANCE $*"
+		if get_openvpn_option "$config" command "$ACTION"; then
+			shift
+			exec /bin/sh -c "$command $*"
 		fi
 	;;
 esac
diff --git a/package/network/services/openvpn/files/lib/functions/openvpn.sh b/package/network/services/openvpn/files/lib/functions/openvpn.sh
new file mode 100644
index 0000000000..83fb1bb453
--- /dev/null
+++ b/package/network/services/openvpn/files/lib/functions/openvpn.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+get_openvpn_option() {
+	local config="$1"
+	local variable="$2"
+	local option="$3"
+
+	local value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+(([^ \t\\]|\\.)+)[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
+	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+'"'([^']+)'"'[ \t]*$/\1/p' "$config" | tail -n1)"
+	[ -n "$value" ] || value="$(sed -rne 's/^[ \t]*'"$option"'[ \t]+"(([^"\\]|\\.)+)"[ \t]*$/\1/p' "$config" | tail -n1 | sed -re 's/\\(.)/\1/g')"
+	[ -n "$value" ] || return 1
+
+	export -n "$variable=$value"
+	return 0
+}
+
diff --git a/package/network/services/openvpn/files/openvpn.config b/package/network/services/openvpn/files/openvpn.config
index 1fd846f558..3de1881e35 100644
--- a/package/network/services/openvpn/files/openvpn.config
+++ b/package/network/services/openvpn/files/openvpn.config
@@ -77,10 +77,10 @@ config openvpn sample_server
 
 	# Diffie hellman parameters.
 	# Generate your own with:
-	#   openssl dhparam -out dh1024.pem 1024
+	#   openssl dhparam -out dh2048.pem 2048
 	# Substitute 2048 for 1024 if you are using
-	# 2048 bit keys.
-	option dh /etc/openvpn/dh1024.pem
+	# 1024 bit keys.
+	option dh /etc/openvpn/dh2048.pem
 
 	# Configure server mode and supply a VPN subnet
 	# for OpenVPN to draw client addresses from.
@@ -228,10 +228,52 @@ config openvpn sample_server
 	# This file is secret:
 #	option tls_auth "/etc/openvpn/ta.key 0"
 
+	# For additional privacy, a shared secret key
+	# can be used for both authentication (as in tls_auth)
+	# and encryption of the TLS control channel.
+	#
+	# Generate a shared secret with:
+	# openvpn --genkey --secret ta.key
+	#
+	# The server and each client must have
+	# a copy of this key.
+	#
+	# tls_auth and tls_crypt should NOT
+	# be combined, as tls_crypt implies tls_auth.
+	# Use EITHER tls_crypt, tls_auth, or neither option.
+#	option tls_crypt "/etc/openvpn/ta.key"
+
+	# Set the minimum required TLS protocol version
+	# for all connections.
+	#
+	# Require at least TLS 1.1
+#	option tls_version_min "1.1"
+	# Require at least TLS 1.2
+#	option tls_version_min "1.2"
+	# Require TLS 1.2, or the highest version supported
+	# on the system
+#	option tls_version_min "1.2 'or-highest'"
+
+	# OpenVPN versions 2.4 and later will attempt to
+	# automatically negotiate the most secure cipher
+	# between the client and server, regardless of a
+	# configured "option cipher" (see below).
+	# Automatic negotiation is recommended.
+	#
+	# Uncomment this option to disable this behavior,
+	# and force all OpenVPN peers to use the configured
+	# cipher option instead (not recommended).
+#	option ncp_disable
+
 	# Select a cryptographic cipher.
 	# This config item must be copied to
 	# the client config file as well.
-	# Blowfish (default):
+	#
+	# To see all supported ciphers, run:
+	# openvpn --show-ciphers
+	#
+	# Blowfish (default for backwards compatibility,
+	# but not recommended due to weaknesses):
 #	option cipher BF-CBC
 	# AES:
 #	option cipher AES-128-CBC
@@ -241,11 +283,16 @@ config openvpn sample_server
 	# Enable compression on the VPN link.
 	# If you enable it here, you must also
 	# enable it in the client config file.
+	#
+	# Compression is not recommended, as compression and
+	# encryption in combination can weaken the security
+	# of the connection.
+	#
 	# LZ4 requires OpenVPN 2.4+ client and server
 #	option compress lz4
 	# LZO is compatible with most OpenVPN versions
 	# (set "compress lzo" on 2.4+ clients, and "comp-lzo yes" on older clients)
-	option compress lzo
+#	option compress lzo
 
 	# The maximum number of concurrently connected
 	# clients we want to allow.
@@ -371,7 +418,7 @@ config openvpn sample_client
 	option key /etc/openvpn/client.key
 
 	# Verify server certificate by checking
-	# that the certicate has the nsCertType
+	# that the certicate has the key usage
 	# field set to "server".  This is an
 	# important precaution to protect against
 	# a potential attack discussed here:
@@ -381,12 +428,27 @@ config openvpn sample_client
 	# your server certificates with the nsCertType
 	# field set to "server".  The build_key_server
 	# script in the easy_rsa folder will do this.
-#	option ns_cert_type server
+#	option remote_cert_tls server
 
 	# If a tls_auth key is used on the server
 	# then every client must also have the key.
 #	option tls_auth "/etc/openvpn/ta.key 1"
 
+	# If a tls_crypt key is used on the server
+	# every client must also have the key.
+#	option tls_crypt "/etc/openvpn/ta.key"
+
+	# Set the minimum required TLS protocol version
+	# for all connections.
+	#
+	# Require at least TLS 1.1
+#	option tls_version_min "1.1"
+	# Require at least TLS 1.2
+#	option tls_version_min "1.2"
+	# Require TLS 1.2, or the highest version supported
+	# on the system
+#	option tls_version_min "1.2 'or-highest'"
+
 	# Select a cryptographic cipher.
 	# If the cipher option is used on the server
 	# then you must also specify it here.
@@ -395,10 +457,15 @@ config openvpn sample_client
 	# Enable compression on the VPN link.
 	# Don't enable this unless it is also
 	# enabled in the server config file.
+	#
+	# Compression is not recommended, as compression and
+	# encryption in combination can weaken the security
+	# of the connection.
+	#
 	# LZ4 requires OpenVPN 2.4+ on server and client
 #	option compress lz4
 	# LZO is compatible with most OpenVPN versions
-	option compress lzo
+#	option compress lzo
 
 	# Set log file verbosity.
 	option verb 3
diff --git a/package/network/services/openvpn/files/openvpn.init b/package/network/services/openvpn/files/openvpn.init
index a560b89ff2..a454eb4ba0 100644
--- a/package/network/services/openvpn/files/openvpn.init
+++ b/package/network/services/openvpn/files/openvpn.init
@@ -69,6 +69,40 @@ section_enabled() {
 	[ $enable -gt 0 ] || [ $enabled -gt 0 ]
 }
 
+openvpn_get_dev() {
+	local dev dev_type
+	local name="$1"
+	local conf="$2"
+
+	# Do override only for configurations with config_file
+	config_get config_file "$name" config
+	[ -n "$config_file" ] || return
+
+	# Check there is someething to override
+	config_get dev "$name" dev
+	config_get dev_type "$name" dev_type
+	[ -n "$dev" ] || return
+
+	# If there is a no dev_type, try to guess it
+	if [ -z "$dev_type" ]; then
+		. /lib/functions/openvpn.sh
+
+		local odev odev_type
+		get_openvpn_option "$conf" odev dev
+		get_openvpn_option "$conf" odev_type dev-type
+		[ -n "$odev_type" ] || odev_type="$odev"
+
+		case "$odev_type" in
+			tun*) dev_type="tun" ;;
+			tap*) dev_type="tap" ;;
+			*) return;;
+		esac
+	fi
+
+	# Return overrides
+	echo "--dev-type $dev_type --dev $dev"
+}
+
 openvpn_add_instance() {
 	local name="$1"
 	local dir="$2"
@@ -83,7 +117,8 @@ openvpn_add_instance() {
 		--config "$conf" \
 		--up "/usr/libexec/openvpn-hotplug up $name" \
 		--down "/usr/libexec/openvpn-hotplug down $name" \
-		--script-security "${security:-2}"
+		--script-security "${security:-2}" \
+		$(openvpn_get_dev "$name" "$conf")
 	procd_set_param file "$dir/$conf"
 	procd_set_param term_timeout 15
 	procd_set_param respawn