Install OpenVPN Server on VPS Ubuntu: Complete Guide

June 2026 · 10 min read

OpenVPN is the most widely used open-source VPN solution in enterprise environments. It supports clients on all platforms, offers flexible configuration, and provides full TLS encryption. This guide walks you through setting up an OpenVPN server from scratch on VPS Ubuntu 22.04, including your own Certificate Authority for maximum security.

Install OpenVPN and Easy-RSA

sudo apt update && sudo apt install openvpn easy-rsa -y

# Check version
openvpn --version | head -1

Create Certificate Authority (CA)

Easy-RSA manages the entire certificate lifecycle — creating a CA, issuing server/client certificates, and revoking them:

# Create directory for PKI
make-cadir /etc/openvpn/easy-rsa
cd /etc/openvpn/easy-rsa

# Initialize PKI
./easyrsa init-pki

# Build CA (set Common Name, e.g., "MyVPN-CA")
./easyrsa build-ca nopass

Create Server Certificate and DH Parameters

cd /etc/openvpn/easy-rsa

# Generate server certificate
./easyrsa gen-req server nopass
./easyrsa sign-req server server

# Generate Diffie-Hellman parameters (takes 1-2 minutes)
./easyrsa gen-dh

# Generate TLS auth key to protect against DoS and replay attacks
openvpn --genkey secret /etc/openvpn/easy-rsa/pki/ta.key

# Copy required files to /etc/openvpn/
cp pki/ca.crt pki/issued/server.crt pki/private/server.key \
   pki/dh.pem pki/ta.key /etc/openvpn/

Create Server Configuration

sudo nano /etc/openvpn/server.conf

# /etc/openvpn/server.conf
port 1194
proto udp
dev tun

ca   /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key  /etc/openvpn/server.key
dh   /etc/openvpn/dh.pem

# IP range for VPN clients
server 10.8.0.0 255.255.255.0

# Push routes to clients
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 8.8.8.8"

# TLS hardening
tls-auth /etc/openvpn/ta.key 0
cipher AES-256-GCM
auth SHA256
tls-version-min 1.2

keepalive 10 120
max-clients 20
user nobody
group nogroup
persist-key
persist-tun

# Logging
status /var/log/openvpn/status.log
log-append /var/log/openvpn/openvpn.log
verb 3

# Create log directory
sudo mkdir -p /var/log/openvpn

Enable IP Forwarding and Configure NAT

# Enable IP forwarding (persistent)
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Check network interface
ip route show | grep default
# Note the interface name, e.g., eth0 or ens3

# Configure iptables NAT (replace eth0 with your actual interface)
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# Make iptables rules persistent across reboot
sudo apt install iptables-persistent -y
sudo netfilter-persistent save

Start OpenVPN Server

sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server
sudo systemctl status openvpn@server

Create Client Certificate and .ovpn Profile

cd /etc/openvpn/easy-rsa

# Generate client certificate (repeat for each user)
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

#!/bin/bash
# Script to generate ready-to-use .ovpn files
CLIENT="client1"
SERVER_IP="YOUR_VPS_IP"
EASYRSA_DIR="/etc/openvpn/easy-rsa"
OUTPUT="/root/${CLIENT}.ovpn"

cat > $OUTPUT << EOF
client
dev tun
proto udp
remote $SERVER_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
key-direction 1
verb 3

$(cat $EASYRSA_DIR/pki/ca.crt)


$(openssl x509 -in $EASYRSA_DIR/pki/issued/${CLIENT}.crt)


$(cat $EASYRSA_DIR/pki/private/${CLIENT}.key)


$(cat /etc/openvpn/ta.key)

EOF

echo "Created: $OUTPUT"

Verify OpenVPN is Working Correctly

# Check service status
systemctl status openvpn@server

# View VPN tunnel interface (should show tun0)
ip addr show tun0

# View connected clients
cat /var/log/openvpn/status.log

# View recent logs
tail -30 /var/log/openvpn/openvpn.log

Common Issues & Troubleshooting

Error: "TLS handshake failed" when client connects

Usually caused by mismatched tls-auth keys or incorrect key-direction. Verify that the server uses key-direction 0 and the client uses key-direction 1:

# Check server config
grep "key-direction\|tls-auth" /etc/openvpn/server.conf

# Check client config in .ovpn file
grep "key-direction" client1.ovpn
# Should be: key-direction 1

# View additional TLS errors
grep "TLS\|VERIFY" /var/log/openvpn/openvpn.log | tail -20

Client connects but internet doesn't route through VPN

IP forwarding or NAT rules are not configured correctly. Verify:

# Check IP forwarding
cat /proc/sys/net/ipv4/ip_forward
# Should return: 1

# Check NAT rules
sudo iptables -t nat -L POSTROUTING -n
# Must have MASQUERADE rule for 10.8.0.0/24

# Check redirect-gateway on connected client
ip route show | head -5

Error: "Cannot open TUN/TAP dev /dev/net/tun"

Some VPS providers disable TUN/TAP device by default. Enable it through your provider's control panel:

# Check if TUN module is loaded
lsmod | grep tun

# Load TUN module (if not already loaded)
sudo modprobe tun

# Check device existence
ls -la /dev/net/tun

Client certificate is revoked but still can connect

You need to configure CRL (Certificate Revocation List) in the server config and update crl.pem every time you revoke:

cd /etc/openvpn/easy-rsa
./easyrsa revoke client1
./easyrsa gen-crl
cp pki/crl.pem /etc/openvpn/

# Add to server.conf
echo "crl-verify /etc/openvpn/crl.pem" >> /etc/openvpn/server.conf
systemctl restart openvpn@server

Frequently Asked Questions

How is OpenVPN different from WireGuard? Which should I use?

WireGuard is faster, easier to configure, and has lower overhead — ideal for personal VPN. OpenVPN is older but more mature, supports diverse clients, has comprehensive features (certificate revocation, logging, multi-user management), and is trusted more by enterprises due to its long track record. If you're starting fresh and want simplicity, choose WireGuard. If you need enterprise features, choose OpenVPN.

How many concurrent clients can one OpenVPN server handle?

It depends on your VPS bandwidth and CPU. Typically, a 2 vCPU / 2GB RAM VPS can handle 20-50 concurrent connections. If traffic is light (not all users active simultaneously), it can support 100+ user accounts but active connections should stay under 20-30 concurrent users.

Can I add new users without restarting the server?

Yes. OpenVPN doesn't require restart when issuing new certificates. Simply generate a new client certificate with easy-rsa, create the .ovpn profile, and send it to the user. The running server won't be affected.