Setting up an OpenVPN server allows external users to securely access your private network from anywhere. By configuring a Linux server with the OpenVPN software, generating cryptographic keys, and adjusting firewall rules, you create a robust tunnel that encrypts all traffic between the client and your internal resources.
Prerequisites and Server Setup
The foundation of any secure VPN relies on a stable operating system and the correct software packages. Most guides recommend using a Debian-based Linux distribution, such as Ubuntu or Debian, due to the extensive community support for OpenVPN. You will need root or sudo privileges to install necessary components and modify system configurations.
Begin by updating your package lists to ensure you are installing the latest stable versions. Run the standard update command followed by the installation of the openvpn package. On some systems, you may also need the easy-rsa suite to manage certificate authority tasks easily. This suite simplifies the generation of certificates and keys required for mutual authentication between the server and clients.
sudo apt-get update
sudo apt-get install openvpn easy-rsaOnce installed, verify the installation by checking the version of OpenVPN. This confirms that the binaries are accessible in your system path. Ensure that your server has a static IP address or a dynamic DNS service configured, as external users need a consistent endpoint to connect to.
Generating Certificates and Keys
Security in OpenVPN is driven by Public Key Infrastructure (PKI). You must generate a Certificate Authority (CA), server certificate, server key, and Diffie-Hellman parameters. These files prove the identity of both the server and the client, preventing unauthorized connections.
Navigate to the easy-rsa directory provided by your package manager. Initialize the PKI environment by running the initialization script. This creates the necessary directory structure for storing certificates and keys. Copy the sample variables file to a local configuration file so you can customize details like country, organization, and email addresses without modifying the source code.
cd /usr/share/easy-rsa
./easyrsa init-pki
cp vars.example vars
nano varsAfter editing the variables, build the CA first. This step prompts you for a password which protects the CA key. Next, build the server certificate and key. When prompted, confirm the server name matches your server's hostname. Finally, generate the Diffie-Hellman parameters. This process can take several minutes depending on your server's speed, but it is critical for establishing secure key exchanges.
./easyrsa build-ca
./easyrsa build-server-full server nopass
./easyrsa gen-dhYou should also generate a client certificate and key pair. In a production environment, each user would have their own unique certificate. For this guide, we generate one generic client cert named client1. Remember to keep the ta.key secret; it provides additional TLS layer security against DDoS attacks.
./easyrsa build-client-full client1 tlsopenvpn --genkey --secret ta.key
Configuring the OpenVPN Server
With all cryptographic materials ready, the next step is configuring the server daemon. Copy the sample server configuration file from the /usr/share/doc/openvpn/examples/sample-config-files/ directory to your active configuration directory, typically /etc/openvpn/. Rename it to server.conf.
Edit server.conf to point to the generated certificates. Set the ca, cert, and key directives to the paths of your CA, server certificate, and server key respectively. Include the dh directive for the Diffie-Hellman file and the tls-auth directive for the ta.key. Uncomment the push "redirect-gateway def1 bypass-dhcp" line if you want all client traffic to route through the VPN, providing full privacy. However, note that this requires careful routing configuration as discussed in our article on routing traffic in VPN tunnels.
Ensure the port and proto settings match your network requirements. UDP is generally preferred for performance, while TCP offers better reliability over unstable connections. If you choose TCP, consider how it interacts with TLS encryption as noted in OpenVPN traffic through TLS-enabled TCP connection.
Firewall and Network Configuration
Your server's firewall must allow incoming connections on the OpenVPN port. If you are using UFW (Uncomplicated Firewall) on Ubuntu, enable OpenVPN by running ufw allow 1194/udp (or tcp if configured). It is crucial to also enable IP forwarding in the kernel. Edit /etc/sysctl.conf and uncomment the line net.ipv4.ip_forward=1. Apply the changes with sysctl -p.
If you are behind a NAT router, you must configure port forwarding on your router to direct traffic from the public IP on port 1194 to your internal server IP. Without this step, external users cannot reach your VPN server. Additionally, ensure that your ISP does not block VPN ports, as some providers restrict this traffic.
Starting the Service and Client Connection
Enable and start the OpenVPN service to make it persistent across reboots. Use systemctl enable openvpn@server and systemctl start openvpn@server. Check the status with systemctl status openvpn@server to ensure there are no errors during startup.
For the client, you need to bundle the client certificate, key, CA certificate, and ta.key into a single configuration file. Create a client.conf file that mirrors the server settings but points to the client-specific keys. Set the remote directive to your server's public IP or domain name. Transfer this file to your device and connect using the OpenVPN Connect application.
If you encounter connectivity issues where applications fail to connect through the tunnel, review your routing tables and DNS settings. Issues often stem from misconfigured push routes or local firewall rules blocking specific protocols. Refer to guides on programs failing to connect through OpenVPN for troubleshooting common client-side errors.
Frequently Asked Questions
Is an open port for VPN protected from hackers?
An open port itself is a potential entry point, but OpenVPN uses strong encryption and mutual authentication to secure the connection. Hackers cannot easily decrypt the traffic without the valid certificates and keys. However, exposing any service to the internet increases your attack surface, so keeping software updated and using strong passwords for the CA is essential. See our analysis on whether an open port for VPN is protected from hackers for more details.
Can I use the same certificate for multiple clients?
While technically possible, it is highly discouraged for security reasons. Each client should have a unique certificate to ensure non-repudiation and easier revocation if a device is lost. If one client's key is compromised, you only need to revoke that specific certificate rather than rebuilding the entire PKI infrastructure.
How do I prevent all traffic from going through the VPN?
To avoid routing all client traffic through the tunnel, remove or comment out the push "redirect-gateway def1 bypass-dhcp" line in the server configuration. Instead, use the push "route" directive to specify only the subnets you want clients to access via the VPN. This setup is ideal for remote access to specific internal resources without masking general internet activity.
What happens if my server restarts?
If you have enabled the systemd service as described, OpenVPN will automatically start when the server boots. Ensure that your firewall rules and IP forwarding settings are also set to persist across reboots. On Ubuntu, UFW rules persist by default, but sysctl changes require the configuration file modification shown earlier.
Why is my connection slow?
VPNs add overhead due to encryption and encapsulation. Using UDP instead of TCP usually results in lower latency and higher throughput. Additionally, the distance to the server and the bandwidth of the underlying internet connection play significant roles. If you are using a weak cipher or large key sizes, ensure your hardware can handle the cryptographic load efficiently.