Skip to main content
To set up an OpenVPN server on Linux, install openvpn and easy-rsa, build a certificate authority and server and client certificates, put server.conf in /etc/openvpn/server/, enable IP forwarding and NAT, open port 1194/UDP, then start it with sudo systemctl enable --now openvpn-server@server. Each device connects with its own .ovpn file.

​
Before you start

  • A VPN (virtual private network) sends a device’s traffic through an encrypted tunnel to your server. OpenVPN does this with TLS certificates.
  • Commands use sudo; root users can leave it out. Examples use the server IP 203.0.113.10 and a client called alex.
  • Keep a second SSH session open while you change the firewall. If you lose access, use the VNC console.
  • Find your public network interface. Run ip route show default. The name after dev (for example eth0 or ens3) is used in the NAT rules below.

​
OpenVPN or WireGuard: which should I use?

For a simpler setup, see WireGuard VPN server or wg-easy with a web UI.

​
Step 1: Install OpenVPN and Easy-RSA

​
Step 2: Build the certificates

Easy-RSA manages a small certificate authority (CA) that signs the server and client certificates. Run these in ~/openvpn-ca:
build-ca asks for a CA passphrase and a name. Each sign-req asks you to type yes and enter the CA passphrase. tc.key is a shared key for tls-crypt, which encrypts and authenticates OpenVPN’s control channel. That hides the certificates and makes OpenVPN traffic harder to identify.
pki/private/ca.key can sign new client certificates. Keep the CA passphrase safe and never copy ca.key to a client.

​
Step 3: Write the server configuration

Copy the server files into the directory the openvpn-server@ service reads:
Create /etc/openvpn/server/server.conf:
This is the official sample server.conf with three changes: dh none uses ECDH key exchange so you don’t need a Diffie-Hellman file (OpenVPN manual), tls-crypt adds the shared key, and the two push lines send all client traffic and DNS lookups through the VPN. Replace 198.51.100.53 with the DNS resolver you want clients to use. Clients get addresses from 10.8.0.0/24. Make sure the log directory exists with sudo mkdir -p /var/log/openvpn.

​
Step 4: Turn on IP forwarding

Forwarding lets the server pass VPN traffic on to the internet:

​
Step 5: Open the port and add NAT

NAT (masquerading) rewrites VPN client addresses to the server’s public IP.
Add this block to the end of /etc/ufw/before.rules, after the COMMIT of the *filter section, with your interface name in place of eth0:
Then allow the VPN port and forwarded traffic, and reload:
This follows the masquerading example in the ufw-framework manual. See set up a firewall with UFW.
For raw iptables or nftables rules, see port forwarding and NAT with iptables.

​
Step 6: Start the OpenVPN server

The openvpn-server@ unit reads /etc/openvpn/server/<name>.conf, so @server loads server.conf. Older guides use openvpn@server with files in /etc/openvpn/. Both work, but don’t mix them.

​
Step 7: Create the client .ovpn file

A .ovpn file holds the client settings plus the certificates in one file. Run this in ~/openvpn-ca, with your server IP in remote:
Download it with scp or rsync, then delete it from the server. Import it into OpenVPN Connect or the community OpenVPN client. On a Linux client, run sudo openvpn --config alex.ovpn.
The .ovpn file contains the client’s private key. Anyone with it can connect, so send it only over SSH or another encrypted channel.

​
How to check it worked

On the server:
The service shows active (running) and tun0 has inet 10.8.0.1/24. When a client connects, its log ends with Initialization Sequence Completed, and sudo journalctl -u openvpn-server@server shows [alex] Peer Connection Initiated. Your public IP on the client now shows as 203.0.113.10.

​
Frequently asked questions

​
How do I add another client?

Run ./easyrsa gen-req name nopass and ./easyrsa sign-req client name in ~/openvpn-ca, then build a new .ovpn file with that name. Give every device its own certificate.

​
How do I revoke a client?

Run ./easyrsa revoke alex and ./easyrsa gen-crl, copy pki/crl.pem to /etc/openvpn/server/, add crl-verify crl.pem to server.conf and restart the service. Easy-RSA’s CRL is valid for 180 days by default, so re-run gen-crl and copy it again before then.

​
Why does the VPN connect but the internet doesn’t work?

Forwarding or NAT is missing. Check sysctl net.ipv4.ip_forward returns 1, that the NAT rule uses your real interface name, and that the client’s DNS server is reachable.

​
Can OpenVPN run on TCP port 443?

Yes. Set proto tcp and port 443 on the server and in the client file, open 443/TCP instead of 1194/UDP, and remove explicit-exit-notify, which is a UDP option. Port 443 must not be used by a web server on the same IP.

VPS and dedicated server guides

Every guide in this section.

WireGuard VPN server

A faster, simpler VPN.

wg-easy WireGuard VPN

WireGuard with a web UI.

Port forwarding and NAT

iptables NAT rules explained.

Set up a firewall with UFW

Open only the ports you use.

Set up a firewall with firewalld

Zones and services on AlmaLinux and Rocky.
Checked against the official OpenVPN 2.6 reference manual, the Ubuntu Server OpenVPN guide and the Rocky Linux OpenVPN guide on 5 November 2026; certificates, server and client configuration tested with OpenVPN 2.6 on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026