How to Install OpenVPN on a Server: Setup from Scratch

curl -sSL https://cp.lv/scripts/openvpn-na-servere.sh | sudo bash

wget -qO- https://cp.lv/scripts/openvpn-na-servere.sh | sudo bash

#!/usr/bin/env bash
# Manual OpenVPN setup: CA, certificates, server config (Ubuntu/Debian)
set -euo pipefail

RSA_DIR=/etc/openvpn/easy-rsa
WAN_IF=$(ip route list default | awk '{print $5; exit}')
export EASYRSA_BATCH=1

# 1. Install the packages
sudo apt update && sudo apt install -y openvpn easy-rsa

# 2. Certificate authority and keys (non-interactive)
sudo make-cadir "$RSA_DIR"
cd "$RSA_DIR"
sudo -E ./easyrsa init-pki
sudo -E ./easyrsa build-ca nopass
sudo -E ./easyrsa gen-req server nopass
sudo -E ./easyrsa sign-req server server
sudo -E ./easyrsa gen-dh
sudo openvpn --genkey secret /etc/openvpn/ta.key
sudo cp pki/ca.crt pki/dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/

# 3. Server config (quoted 'EOF' writes the directives verbatim)
sudo tee /etc/openvpn/server.conf > /dev/null << 'EOF'
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
server 10.9.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
keepalive 10 120
cipher AES-256-GCM
user nobody
group nogroup
persist-key
persist-tun
verb 3
EOF

# 4. Forwarding, NAT and firewall
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-openvpn.conf
sudo sysctl -p /etc/sysctl.d/99-openvpn.conf
sudo iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o "$WAN_IF" -j MASQUERADE
sudo ufw allow 1194/udp || true

# 5. Start
sudo systemctl enable --now openvpn@server
echo "Done: OpenVPN listens on 1194/udp. Create a client with easyrsa gen-req."

The fastest way to deploy OpenVPN is a ready-made script: it installs the packages, creates a certificate authority, generates the server config and the first client .ovpn profile. Below are both the automatic route and the manual easy-rsa setup, so you can see what happens under the hood.

When to choose OpenVPN

OpenVPN is battle-tested, works over both TCP and UDP and passes through strict firewalls easily (on port 443/TCP it looks like HTTPS). If you need maximum compatibility and the ability to get through blocking, it is a solid choice. For raw speed and simplicity people usually pick WireGuard.

Requirements: a VPS with 1 vCPU and 512 MB RAM, Ubuntu/Debian, root access and a public IPv4 address.

The quick way: a script

A popular, well-tested script sets everything up interactively:

apt update && apt install -y curl
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
./openvpn-install.sh

The script asks for the IP address, the protocol (UDP is recommended), the port (1194 by default) and DNS. When it finishes, a <name>.ovpn file appears in your home directory — that is a ready client profile.

To add another client later, run the script again and it will show a menu.

Manual setup

Step 1. Installing the packages

apt update
apt install -y openvpn easy-rsa

Step 2. The certificate authority

make-cadir /etc/openvpn/easy-rsa
cd /etc/openvpn/easy-rsa
./easyrsa init-pki
./easyrsa build-ca nopass

Step 3. Server certificate and keys

./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-dh
openvpn --genkey secret /etc/openvpn/ta.key

Copy the files you need:

cp pki/ca.crt pki/dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/

Step 4. The server config

Open /etc/openvpn/server.conf in an editor (sudo nano /etc/openvpn/server.conf) and paste the contents:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
server 10.9.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
keepalive 10 120
cipher AES-256-GCM
user nobody
group nogroup
persist-key
persist-tun
verb 3

Or create the whole config with one command — copy it and paste it into the console (the quoted 'EOF' writes the directives verbatim):

sudo tee /etc/openvpn/server.conf > /dev/null << 'EOF'
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
server 10.9.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
keepalive 10 120
cipher AES-256-GCM
user nobody
group nogroup
persist-key
persist-tun
verb 3
EOF

Step 5. Forwarding and the firewall

echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/99-openvpn.conf
sysctl -p /etc/sysctl.d/99-openvpn.conf
iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o eth0 -j MASQUERADE
ufw allow 1194/udp

Replace eth0 with your external interface (ip route list default).

Step 6. Starting the service

systemctl enable --now openvpn@server
systemctl status openvpn@server

Generating a client profile

Create a client key:

cd /etc/openvpn/easy-rsa
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Build the .ovpn file by embedding the certificates between the <ca>, <cert>, <key> and <tls-auth> tags, and add:

client
dev tun
proto udp
remote <your_VPS_IP> 1194
cipher AES-256-GCM
key-direction 1

Transfer the file to the device and import it into the OpenVPN Connect client.

Comparison with WireGuard

Revoking a client

If a client key is compromised, revoke the certificate and refresh the revocation list (CRL):

cd /etc/openvpn/easy-rsa
./easyrsa revoke client1
./easyrsa gen-crl
cp pki/crl.pem /etc/openvpn/

Add a line to server.conf and restart the service:

crl-verify crl.pem

systemctl restart openvpn@server

The revoked profile can no longer connect, while the other clients keep working.

Hardening

A few practices worth applying right away:

• restrict key permissions: chmod 600 /etc/openvpn/server.key /etc/openvpn/ta.key;
• run the daemon as an unprivileged user (user nobody, group nogroup — already in the config);
• use only the modern AES-256-GCM cipher and the tls-auth parameter as protection against scanning;
• close everything in the firewall except the VPN port and SSH.

Checks and diagnostics

Make sure the service is listening on the right port:

ss -tulpn | grep 1194

Connection and error logs:

journalctl -u openvpn@server -f

Check that the tun0 interface exists:

ip a show tun0

If the client connects but has no internet access, the cause is almost always missing IP forwarding or the wrong interface in the MASQUERADE rule.

Frequently asked questions

UDP or TCP? UDP is faster and is the recommended default. Use TCP on port 443 if your provider blocks VPN traffic.

How do I revoke a client? ./easyrsa revoke client1, then ./easyrsa gen-crl and a service restart.

Why is there no internet after connecting? Check IP forwarding and the MASQUERADE rule with the correct interface.

Can I move the service to port 443? Yes. Change port and set proto tcp in the config, then open the port in the firewall — that makes the VPN harder to block.

Script or manual setup? The script is fast and safe for typical cases. Manual setup is for fine-grained control.

Need a server for your VPN? See VPS for security and VPN and our VPS plans. We can set it up for you — Server administration.