I suppose that will work but it's not the recommended method. Look at /etc/init.d/vpn and in turn /usr/sbin/vpnctl. IIRC:
- store everything in /etc/natinst/share/openvpn
- make sure the directory and all files are owned by openvpn:openvpn and are not world-readable
- set up the server for TAP mode
The upshot is that, unlike using /etc/openvpn, all of this should work in safemode as well as runmode: /etc/natinst/share is on a separate partition that is read by both runmode and safemode, and safemode has /etc/init.d/vpn and /usr/sbin/vpnctl baked into it. In fact, it's even persisted across reformats, if you specify preserving the network settings.
