Installing and Configuring OpenVPN Server on VPS

What we are configuring and why

In this guide, we will be configuring an OpenVPN server on a Virtual Private Server (VPS). OpenVPN is a reliable and flexible solution for creating Virtual Private Networks (VPNs), which is widely used to provide secure remote access to corporate resources, protect traffic from interception, and bypass geo-restrictions.

The main task we are addressing is the deployment of a corporate VPN server. This will allow your employees to securely connect to the company's internal network from anywhere in the world, as if they were in the office. All traffic between the client device and the server will be encrypted, preventing unauthorized access to confidential data.

Ultimately, the reader will get a fully functional OpenVPN server, capable of accepting connections from multiple clients, with configured encryption, authentication, and routing rules. We will cover all stages: from server preparation to creating client configurations and maintenance recommendations.

Alternatives and why Self-Hosted on VPS

There are several approaches to organizing a VPN:

• Cloud-Managed VPN Services: Providers such as AWS VPN Client, Google Cloud VPN, or Azure VPN Gateway offer ready-made solutions. They are easy to manage, scalable, and do not require deep configuration knowledge. However, they can be more expensive, offer less flexibility in customization, and you depend on the policies and infrastructure of a third-party provider.
• Other Self-Hosted Solutions:
  • WireGuard: A modern, fast, and easy-to-configure VPN protocol. It has a smaller codebase, which theoretically enhances security. Excellent for simple scenarios and high performance.
  • IPsec/IKEv2: Often used in corporate networks, supported by most operating systems. More complex to configure, but offers a high degree of security and performance.
  • SoftEther VPN: A multi-protocol VPN server supporting OpenVPN, L2TP/IPsec, MS-SSTP, EtherIP, and SoftEther VPN protocols.

Why Self-Hosted OpenVPN on VPS?

The choice of OpenVPN on VPS is justified for several reasons:

• Full Control: You fully control the server, its configuration, data, and security. This is critically important for corporate data and compliance with privacy policies.
• Cost-effectiveness: The cost of renting a VPS is usually significantly lower than monthly payments for managed cloud VPN services, especially for a small or medium number of users.
• Flexibility and Customization: OpenVPN is extremely flexible. You can configure it to meet any specific requirements of your network, use various authentication methods (certificates, login/password, PAM), routing, and much more.
• Proven Reliability: OpenVPN has existed for many years, has a huge community, and is considered one of the most reliable and secure VPN protocols. Its security has been repeatedly verified and confirmed.
• Cross-Platform Compatibility: OpenVPN clients are available for almost all operating systems (Windows, macOS, Linux, Android, iOS), which simplifies connecting employees with any devices.

Configuring OpenVPN on a VPS is an ideal balance between control, security, flexibility, and cost for most small and medium-sized companies, as well as for individual users who need reliable protection.

What VPS config is needed for this task

Choosing the right VPS config is crucial for ensuring stable and performant operation of the OpenVPN server. Requirements depend on the estimated number of concurrent users, the volume of traffic transferred, and the intensity of its use.

Minimum Requirements for OpenVPN Server (up to 10-20 users)

• CPU: 1 core (x86-64). OpenVPN is not heavily CPU-dependent, but encryption requires some power. Modern processors with AES-NI instructions significantly speed up the process.
• RAM: 512 MB - 1 GB. This will be sufficient for the operating system itself and OpenVPN. With a large number of clients or intensive logging, more may be required.
• Disk: 10-20 GB SSD. SSD significantly speeds up OS operation and log reading/writing. The main space will be occupied by the OS; OpenVPN itself and its configurations take up very little space.
• Network: 100 Mbps with unlimited traffic (or a very large limit). Network bandwidth is the primary factor for VPN. Make sure your tariff plan does not have strict traffic or speed limits.

Recommended VPS Plan for Corporate Use (20-50+ users)

For more serious corporate use, where stability and high bandwidth are required for a larger number of users, the following config is recommended:

• CPU: 2 vCPU (virtual cores).
• RAM: 2 GB - 4 GB. This will provide headroom for the operating system, OpenVPN, and potential additional services (monitoring, extended logs).
• Disk: 40 GB - 80 GB SSD. Sufficient for OS, logs, backups, and other utilities.
• Network: 1 Gbps with unlimited traffic. This is critically important for ensuring high data transfer speeds for all connected clients.

For such characteristics, you can consider a VPS with the specified characteristics.

When a Dedicated Server is needed, not a VPS

A dedicated server becomes necessary when:

• Very large number of users: More than 100-200 concurrently connected clients actively using the VPN.
• Extremely high bandwidth: If the VPN is used for transferring very large volumes of data (e.g., video streaming, large file transfers) on a continuous basis, and 1 Gbps on a VPS becomes insufficient.
• Specific security or hardware requirements: If you need physical control over the equipment, special hardware security modules (HSM), or very high disk subsystem performance.
• Guaranteed performance: On a dedicated server, you do not share resources with other users, which provides predictable and stable performance.

For these scenarios, you can consider a suitable dedicated server.

VPS Location: What it affects

Choosing the VPS location is of significant importance:

• Latency: The closer the server is to most of your users, the lower the latency (ping) will be, which directly affects response speed and overall work comfort. For a corporate VPN, choose a location as close as possible to the primary location of your employees.
• Legislation: Data storage and information privacy laws vary in different countries. Ensure that the chosen location complies with your company's requirements and applicable regulations (e.g., GDPR).
• Availability and Bandwidth: Some regions have better network infrastructure and higher bandwidth to other parts of the world.

Always choose a location that optimizes performance for your users and complies with your legal requirements.

Server Preparation

Before proceeding with OpenVPN installation, it is necessary to perform initial setup of your VPS to ensure security and stability. We will use Ubuntu 24.04 LTS (Noble Numbat) as the base, as it is a current and supported version for 2026.

1. Connecting to the Server

Connect to your VPS via SSH using the credentials provided by your provider (usually root login and password or an SSH key).

ssh root@ВАШ_IP_АДРЕС_VPS

2. System Update

First, update the package list and installed packages to their latest versions. This will ensure you have all current security and stability fixes.

sudo apt update && sudo apt upgrade -y

If the kernel or other critical components have been updated, a reboot may be required:

sudo reboot

After rebooting, reconnect to the server.

3. Creating a New User with Sudo Privileges

Working as the root user is insecure. Let's create a new user and grant them sudo privileges.

# Replace 'your_username' with your desired username
sudo adduser ваш_пользователь

Follow the prompts to set a password and fill in (or skip) additional information.

Add the new user to the sudo group so they can execute commands with administrative privileges:

sudo usermod -aG sudo ваш_пользователь

Now, exit the root session and log in as the new user:

exit
ssh ваш_пользователь@ВАШ_IP_АДРЕС_VPS

4. Configuring SSH Keys (Recommended)

For enhanced security, it is recommended to use SSH keys instead of passwords. If you don't already have an SSH key pair, generate them on your local machine:

# On your local machine
ssh-keygen -t rsa -b 4096 -C "ваш[email protected]"

Copy the public key to the server:

# On your local machine
ssh-copy-id ваш_пользователь@ВАШ_IP_АДРЕС_VPS

If ssh-copy-id is not available, copy the key manually:

# On your local machine
cat ~/.ssh/id_rsa.pub

Then, on the server (as your new user):

mkdir -p ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste the copied public key into the authorized_keys file, save, and close. Set the correct permissions:

chmod 600 ~/.ssh/authorized_keys

Now you can disable password authentication for SSH (optional, but recommended). Edit the SSH daemon configuration file:

sudo nano /etc/ssh/sshd_config

Find and modify the following lines (or add them if they are missing):

# Disable root login (if you created a user)
PermitRootLogin no
# Disable password authentication (after verifying key login!)
PasswordAuthentication no
# Allow key authentication
PubkeyAuthentication yes

Restart the SSH service:

sudo systemctl restart sshd

IMPORTANT: Before exiting the current session, open a new terminal session and ensure you can log in with your SSH key as the new user. If something goes wrong, you will still have the old session open to fix errors.

5. Firewall Configuration (UFW)

UFW (Uncomplicated Firewall) is a convenient wrapper for iptables. We will configure it for basic server protection.

sudo apt install ufw -y

Allow SSH connections (default port 22). If you are using a different port for SSH, specify it:

sudo ufw allow OpenSSH
# Or, if you changed the SSH port to, for example, 2222:
# sudo ufw allow 2222/tcp

Allow connections for OpenVPN. By default, OpenVPN uses UDP port 1194. We will use this port.

sudo ufw allow 1194/udp

Enable UFW:

sudo ufw enable

Confirm the action by typing y. Check the firewall status:

sudo ufw status verbose

6. Installing Fail2ban

Fail2ban scans log files for suspicious activity (e.g., failed SSH login attempts) and blocks attacker IP addresses using firewall rules.

sudo apt install fail2ban -y

Create a copy of the default configuration file to avoid losing changes during updates:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit jail.local to configure the parameters. For most cases, the default settings for SSH ([sshd] section) are sufficient, but you can change bantime (ban time) and findtime (period for detecting attempts) as desired.

sudo nano /etc/fail2ban/jail.local

Ensure that the [sshd] section has enabled = true:

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Restart Fail2ban:

sudo systemctl restart fail2ban
sudo systemctl enable fail2ban

Check the status:

sudo systemctl status fail2ban
sudo fail2ban-client status sshd

Your server is now securely prepared for OpenVPN installation.

Software Installation — Step-by-Step

In this section, we will install OpenVPN and Easy-RSA, and then configure the Public Key Infrastructure (PKI) for secure authentication. We will use Easy-RSA version 3.x, which is current for 2026 and provides reliable certificate management.

1. Installing OpenVPN and Easy-RSA

We will install the necessary packages from the official Ubuntu 24.04 LTS repositories.

# Update package list
sudo apt update
# Install OpenVPN and Easy-RSA
sudo apt install openvpn easy-rsa -y

As of 2026, OpenVPN version 2.6.x or newer, and Easy-RSA 3.x will most likely be available.

2. PKI Preparation with Easy-RSA

Easy-RSA is a set of scripts for creating and managing a Public Key Infrastructure (PKI), which is essential for OpenVPN. All certificates and keys will be stored in a separate directory.

# Create directory for PKI
sudo make-cadir /etc/openvpn/easy-rsa
# Navigate to Easy-RSA directory
cd /etc/openvpn/easy-rsa

3. Initializing PKI

We will initialize the PKI. This will create the necessary subdirectories and files.

# Initialize PKI
sudo ./easyrsa init-pki

4. Creating a Certificate Authority (CA)

A Certificate Authority (CA) is the root certificate that will sign all other certificates (server and client). It forms the basis of trust in your VPN network.

# Create CA. When prompted for Common Name (CN), enter something meaningful, e.g., "Corporate OpenVPN CA"
sudo ./easyrsa build-ca nopass

nopass means that no password will be set for the root key. For maximum security, you can set a password, but then you will have to enter it every time you perform an action with the CA.

5. Generating Server Certificate and Key

Now we will create a certificate request for our OpenVPN server, sign it with the CA, and generate the key.

# Generate server certificate request. When prompted for Common Name (CN), enter "server"
sudo ./easyrsa gen-req server nopass
# Sign the server certificate request using the CA
sudo ./easyrsa sign-req server server

When prompted for confirmation, type yes.

6. Generating Diffie-Hellman (DH) Parameters

Diffie-Hellman parameters are used for secure key exchange between the server and clients. This process can take some time (up to several minutes depending on your VPS's power).

# Generate Diffie-Hellman parameters
sudo ./easyrsa gen-dh

7. Creating an HMAC Key (tls-auth)

The HMAC key (or tls-auth) adds an extra layer of security, protecting the TLS handshake from Denial-of-Service (DoS) attacks and port scanning. It is used for pre-authenticating packets.

# Generate HMAC key
openvpn --genkey --secret /etc/openvpn/easy-rsa/pki/ta.key

8. Copying PKI Files to the OpenVPN Server

We will move all generated files necessary for the OpenVPN server to its configuration directory.

# Create directory for OpenVPN server configs
sudo mkdir -p /etc/openvpn/server
# Copy CA certificate
sudo cp pki/ca.crt /etc/openvpn/server/
# Copy server certificate and key
sudo cp pki/issued/server.crt /etc/openvpn/server/
sudo cp pki/private/server.key /etc/openvpn/server/
# Copy Diffie-Hellman parameters
sudo cp pki/dh.pem /etc/openvpn/server/dh.pem
# Copy HMAC key
sudo cp pki/ta.key /etc/openvpn/server/ta.key

9. Generating Client Certificate and Key (Example for One Client)

For each client that will connect to the VPN, a unique certificate/key pair must be generated. Here we will show an example for one client named client1.

# Generate client certificate request. When prompted for Common Name (CN), enter "client1"
sudo ./easyrsa gen-req client1 nopass
# Sign the client certificate request using the CA
sudo ./easyrsa sign-req client client1

When prompted for confirmation, type yes. These files (client1.crt, client1.key, ca.crt, ta.key) will be needed by the client for connection. We will assemble them into a single .ovpn file later.

At this stage, the main OpenVPN components are installed, and the PKI is configured. Now let's move on to the server configuration itself.