Set Up a Secure OpenVPN Server on Linux: A Step‑by‑Step Guide

In a world where remote work, privacy, and secure connections are paramount, owning your own VPN server is a game‑changer. Unlike consumer VPN services that route traffic through unknown servers, a self‑hosted OpenVPN server gives you full control over who can access your network, how traffic is routed, and what logs are kept. This guide walks you through installing, configuring, and hardening OpenVPN on a fresh Ubuntu 22.04 LTS server. By the end, you’ll have a fully functional, secure VPN that you can connect from any device.

What You’ll Need

• Ubuntu 22.04 LTS server (or any Debian‑based distro)
• Root or sudo access
• Static public IP or dynamic DNS service
• Basic knowledge of Linux command line
• Firewall configured to allow TCP/UDP 1194 (default OpenVPN port)

Step 1: Prepare the Server

Before installing OpenVPN, make sure your system is up‑to‑date and that the firewall is ready to accept VPN traffic. Open a terminal and run:

sudo apt update && sudo apt upgrade -y
sudo apt install ufw -y
sudo ufw allow OpenSSH
sudo ufw allow 1194/udp
sudo ufw enable

Check the firewall status:

sudo ufw status verbose

Ensure the output shows 1194/udp ALLOW. If you’re using a cloud provider, also open the port in the provider’s security group.

Step 2: Install OpenVPN and EasyRSA

OpenVPN is available directly from Ubuntu’s repositories, and EasyRSA will help us generate a public key infrastructure (PKI).

sudo apt install openvpn easy-rsa -y

Copy EasyRSA into a dedicated directory:

make-cadir ~/openvpn-ca
cd ~/openvpn-ca

Step 3: Build the Certificate Authority

Configure EasyRSA variables to match your environment. Edit vars with your preferred text editor and set the following:

set_var EASYRSA_REQ_COUNTRY    "US"
set_var EASYRSA_REQ_PROVINCE   "California"
set_var EASYRSA_REQ_CITY       "San Francisco"
set_var EASYRSA_REQ_ORG        "Teknozof"
set_var EASYRSA_REQ_EMAIL      "admin@example.com"
set_var EASYRSA_REQ_OU         "IT"

Initialize the PKI and build the CA:

./easyrsa init-pki
./easyrsa build-ca nopass

When prompted, enter a strong Common Name (CN) for the CA, e.g., Teknozof-CA. The CA key will be stored in ~/openvpn-ca/pki/ca.key.

Step 4: Generate Server Certificate, Key, and Encryption Files

Generate the server’s certificate and key:

./easyrsa gen-req server nopass
./easyrsa sign-req server server

Create the Diffie‑Hellman parameters (takes a few minutes):

./easyrsa gen-dh

For added security, generate an HMAC signature to protect against DDoS attacks on the TLS handshake:

openvpn --genkey --secret ta.key

Move all generated files to the OpenVPN directory:

sudo cp pki/ca.crt pki/private/server.key pki/issued/server.crt dh.pem ta.key /etc/openvpn

Step 5: Configure the Server

Copy the sample server configuration and edit it:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn
sudo gzip -d /etc/openvpn/server.conf.gz
sudo nano /etc/openvpn/server.conf

Modify the following lines:

• ca ca.crt – points to the CA certificate.
• cert server.crt – server certificate.
• key server.key – server private key.
• dh dh.pem – Diffie‑Hellman parameters.
• tls-auth ta.key 0 – HMAC key for authentication.
• Uncomment user nobody and group nogroup for security.
• Set server 10.8.0.0 255.255.255.0 to define the VPN subnet.
• Enable client‑to‑client communication if desired: client-to-client.
• Set push "redirect-gateway def1 bypass-dhcp" to route all client traffic through the VPN.
• Configure DNS by adding: push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4".

Save and exit.

Step 6: Enable IP Forwarding and Adjust Routing

Allow the server to forward packets by editing /etc/sysctl.conf:

sudo nano /etc/sysctl.conf
# Add or uncomment the following line
net.ipv4.ip_forward=1

Apply the change immediately:

sudo sysctl -p

Set up NAT for the VPN subnet using iptables (or ufw if you prefer). With ufw, add a rule:

sudo ufw route allow in on tun0 out on eth0

Alternatively, with iptables:

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
sudo iptables-save | sudo tee /etc/iptables.rules

Persist iptables rules across reboots by creating a systemd service or adding the commands to /etc/rc.local (if present).

Step 7: Start and Enable OpenVPN

Enable the OpenVPN service and start it:

sudo systemctl enable openvpn@server
sudo systemctl start openvpn@server

Check status:

sudo systemctl status openvpn@server

Verify that the tun0 interface is up:

ip a show tun0

Step 8: Create Client Profiles

Generate a client certificate:

cd ~/openvpn-ca
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Create a client configuration file (client.ovpn) with the following content, replacing SERVER_IP with your server’s public IP:

client
dev tun
proto udp
remote SERVER_IP 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
tls-auth ta.key 1
key-direction 1
verb 3

# Paste ca.crt contents here


# Paste client1.crt contents here


# Paste client1.key contents here


# Paste ta.key contents here

Transfer the client.ovpn file to the device you’ll connect from (e.g., via SCP, email, or USB). Import it into the OpenVPN client app on Windows, macOS, iOS, Android, or any other platform.

Common Mistakes to Avoid

1. Leaving the CA key unprotected – If the ca.key is compromised, an attacker can forge certificates. Store it securely and consider using a passphrase.

2. Forgetting to enable IP forwarding – Without net.ipv4.ip_forward=1, clients can’t reach the internet through the VPN.

3. Misconfiguring firewall rules – A mis‑set firewall may block tun0 traffic. Always double‑check that NAT is applied to the VPN subnet.

4. Using weak ciphers – OpenVPN defaults to AES‑128‑CBC on some systems. Explicitly set cipher AES-256-GCM and auth SHA256 for stronger security.

5. Not renewing certificates – Certificates expire after a set period. Automate renewal or manually issue new certificates before expiration.

Tips and Tricks

• Use systemctl restart openvpn@server to apply configuration changes without a full reboot.
• For multiple clients, create a script that automates certificate generation and client profile creation.
• Consider using systemd-networkd or NetworkManager to manage VPN routes for client devices.
• Enable status /var/log/openvpn-status.log in server.conf to monitor connected clients.
• Set up fail2ban to block repeated failed authentication attempts.

Frequently Asked Questions

What ports does OpenVPN use by default?

OpenVPN typically listens on UDP port 1194. If you need to use TCP for environments that block UDP, change proto udp to proto tcp in both the server and client configs.

Can I use a different public key infrastructure (PKI) system?

Yes. While EasyRSA is the most common choice for OpenVPN, you can integrate with commercial PKI solutions or use openssl directly. The key files must match the server.conf directives.

How do I add a new client after the server is running?

Generate a new certificate with EasyRSA, sign it, then create a new client.ovpn file using the same template. Transfer the file to the client device and import it. No server restart is required.

Conclusion

Setting up an OpenVPN server on Linux may seem daunting at first, but by following these structured steps you’ll have a robust, encrypted tunnel that protects your data and gives you full control over who connects. Remember to keep your server updated, renew certificates regularly, and monitor logs for any suspicious activity. With OpenVPN, you’re no longer at the mercy of third‑party providers – you’re in the driver’s seat of your own secure network.

Photo by Cong Long Vu on Unsplash