Skip to main content

Linux VPN Server: OpenVPN Ubuntu Installation

Published on:
.
19 min read
.
For German Version

Securing data transmission over public and private networks has become a top priority in today's interconnected world. One of the most widely adopted solutions for creating secure communication channels is OpenVPN, an open-source VPN protocol known for its flexibility, strong encryption, and reliability. Particularly on Linux-based systems like Ubuntu, OpenVPN provides system administrators and users with a robust platform for building secure and scalable VPN infrastructures.

This article presents a comprehensive guide to installing and configuring OpenVPN on Ubuntu, making it easier for both beginners and experienced users to set up their own OpenVPN server. We will explore the critical role VPN servers play in protecting sensitive data and maintaining privacy. Furthermore, the article highlights the importance of client configuration, ensuring that devices connecting to the server are properly authenticated and secure.

As security and performance are vital for any VPN setup, we will delve into best practices for optimizing OpenVPN on Linux, including tuning encryption settings, network parameters, and system resources. Lastly, we'll address common issues through troubleshooting strategies and share expert tips to maintain a resilient VPN server in production environments.

Whether you are looking to deploy an Ubuntu VPN for personal use or manage an enterprise-level network, this guide will equip you with the essential knowledge to build a secure and reliable OpenVPN Linux server setup.

Get Started with Zenarmor Today For Free

Why is OpenVPN important for securing Ubuntu systems?​

OpenVPN is a critical tool for securing Ubuntu systems because it establishes encrypted tunnels that protect sensitive data during transmission and ensure safe access to private networks over public infrastructure.

One of the key advantages of OpenVPN is its ability to encrypt data traffic using robust cryptographic protocols like AES-256 and TLS, preventing third parties from intercepting or manipulating the data as it travels across untrusted networks such as the internet.

During transmission, OpenVPN creates a secure, authenticated channel between the client and the server, protecting information such as credentials, files, and internal resources. This is particularly crucial in enterprise environments or remote work scenarios where sensitive data frequently flows between distributed endpoints.

Additionally, OpenVPN provides encryption-based access control, allowing only authorized users and devices to connect to the private network. Encryption-based access control not only ensures confidentiality but also maintains the integrity and availability of critical services within the Ubuntu system.

Beyond security, OpenVPN offers practical benefits such as the ability to bypass geographical restrictions and enable secure remote access. OpenVPN allows for seamless and secure connectivity without exposing the network to external threats for users in restricted regions or those who need to access internal systems from external locations.

Overall, OpenVPN strengthens Ubuntu’s network security posture by offering privacy, authentication, and access control, all essential components for safeguarding modern systems.

How to Install OpenVPN on Ubuntu?​

Installing OpenVPN on Ubuntu allows users to create secure and private connections between remote clients and internal networks. This section focuses only on the installation process of OpenVPN and Easy-RSA using the command line interface. You may follow the next steps to install OpenVPN on Ubuntu.

  1. Update the System Packages: To ensure your system is fully updated and to avoid compatibility issues during installation, run the following command.

    sudo apt update && sudo apt upgrade -y

  2. Install OpenVPN and Easy-RSA: Install the core OpenVPN package along with Easy-RSA, a tool used for managing SSL certificates, with the following command.

    sudo apt install openvpn easy-rsa -y

  3. Verify the Installation: Check that OpenVPN is installed correctly with the following command.

    openvpn --version

    Optionally, you can verify that the Easy-RSA directory is present.

    ls /usr/share/easy-rsa

    Once installation is complete, you can move on to configuring the OpenVPN server.

What are the Steps to Set Up an OpenVPN Server on Ubuntu?​

Setting up an OpenVPN server on Ubuntu involves creating cryptographic infrastructure, configuring the server, and adjusting system-level networking features. This section provides a full guide to securing and running your OpenVPN server. The main steps to set up an OpenVPN server on Ubuntu are listed below.

  1. Set Up the Public Key Infrastructure (PKI): The PKI directory stores all the cryptographic files and certificates needed to secure the VPN. The following commands create a directory where you'll manage keys and certificates.

    mkdir -p ~/openvpn-ca
    cd ~/openvpn-ca
    cp -r /usr/share/easy-rsa/* ./

  2. Configure the Certificate Authority (CA): Customize the certificate metadata (such as country, organization, and email) by editing the vars file. Open the file with the following command.

    nano vars

    Locate the following lines and update them by removing the leading # symbol and replacing the default values. These values will be used in all certificates you generate later. Save and exit with Ctrl + O, then Ctrl + X.

    set_var EASYRSA_REQ_COUNTRY "US"
    set_var EASYRSA_REQ_PROVINCE "California"
    set_var EASYRSA_REQ_CITY "San Francisco"
    set_var EASYRSA_REQ_ORG "MyOrganization"
    set_var EASYRSA_REQ_EMAIL "[[email protected]](mailto:[email protected])"
    set_var EASYRSA_REQ_OU "IT"

  3. Build the Certificate Authority (CA): To establish a trusted environment for OpenVPN connections, the first step is to create a Certificate Authority (CA). This CA will be responsible for signing both server and client certificates.

    Begin by initializing the Public Key Infrastructure (PKI) directory using the Easy-RSA tool. This prepares the necessary structure for storing and managing cryptographic material.

    ./easyrsa init-pki

    Generate the CA certificate. For ease of use in test environments or automated setups, the following command creates a passwordless CA.

    ./easyrsa build-ca nopass

    You will be prompted to provide a Common Name (CN) for the CA (e.g., MyVPN CA). If you prefer to protect the CA with a passphrase, omit nopass, use the following commad.

    ./easyrsa build-ca

    This step results in the creation of a private key and self-signed root certificate located in the pki/ directory. These will be used later to issue and validate server and client certificates.

  4. Generate Server Certificate and Key: After creating the Certificate Authority (CA), the next step is to generate the server`s private key and certificate. These are used to securely authenticate the VPN server to connecting clients.

    1. Begin by creating a certificate request and signing it using the CA with the following commands.

      ./easyrsa gen-req server nopass

      This will generate two files:

      • pki/private/server.key: the server`s private key
      • pki/reqs/server.req: the certificate signing request (CSR)

    2. Sign the request with the CA to produce the actual server certificate with the following command.

      ./easyrsa sign-req server server

    3. When prompted, confirm the request and type yes to proceed.

    4. Diffie-Hellman (DH) parameters are required for key exchange. Generate them with the following command.

      ./easyrsa gen-dh

    5. For additional protection against UDP-based attacks (e.g., DoS), generate a shared secret key with the command below.

      openvpn --genkey secret ta.key

  5. Generate Client Certificates: Each client must have a unique certificate to connect securely to the VPN server. To generate a client certificate, run the following command and confirm with yes when prompted.

    ./easyrsa gen-req client1 nopass
    ./easyrsa sign-req client client1

  6. Transfer Server Files to the OpenVPN Directory: Copy all required certificates and keys to the OpenVPN directory with the following command, so that the service can access them properly.

    sudo cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem ta.key /etc/openvpn/server/

  7. Create and Edit the Server Config File: Create the main configuration file for OpenVPN with the following command.

    sudo nano /etc/openvpn/server/server.conf

    Paste the following configuration into the file.

    port 1194 # OpenVPN will listen on UDP port 1194
    proto udp # Use UDP protocol (faster and preferred for VPN)
    dev tun # Create a TUN virtual network interface
    ca ca.crt # Path to the Certificate Authority certificate
    cert server.crt # Server certificate
    key server.key # Server private key
    dh dh.pem # Diffie-Hellman parameters for key exchange
    auth SHA256 # Digest algorithm used for HMAC authentication
    tls-auth ta.key 0 # Enable HMAC packet authentication (0 = server side)
    key-direction 0 # Key direction for ta.key file (0 for server, 1 for client)
    server 10.8.0.0 255.255.255.0 # Define the virtual subnet and netmask for VPN clients
    persist-key # Avoid re-reading key across restarts
    persist-tun # Avoid re-creating the TUN device across restarts
    keepalive 10 120 # Ping every 10s, restart if no response in 120s
    cipher AES-256-CBC # Encryption algorithm
    data-ciphers AES-256-CBC:AES-256-GCM # Allow fallback for clients using new ciphers
    user nobody # Drop privileges to unprivileged user
    group nogroup # Drop to unprivileged group
    status /var/log/openvpn-status.log # Status log path
    verb 3 # Set log verbosity (3 = recommended for debugging)

  8. Enable IPv4 Packet Forwarding: This step is required to allow traffic from VPN clients to be routed through the VPN server to the outside world (or local network). Open sysctl.conf file with the command below.

    sudo nano /etc/sysctl.conf

    Enable forwarding by setting net.ipv4.ip_forward=1, which is essential for routing VPN traffic. Uncomment or add the following line.

    net.ipv4.ip_forward = 1

    Then apply the changes with the following command. Applies the sysctl changes in real-time without rebooting the server. Now the system is allowed to forward packets between network interfaces.

    sudo sysctl -p

  9. Configure Firewall with UFW: If UFW (Uncomplicated Firewall) is active, you need to allow traffic for OpenVPN and enable routing rules.

    1. To allow incoming VPN traffic on UDP port 1194 and ensure continued SSH access to the server, the following UFW rules must be added with the following commands.

      sudo ufw allow 1194/udp
      sudo ufw allow OpenSSH

    2. To enable NAT (Network Address Translation) for VPN clients, the UFW before.rules file needs to be edited. Use the following command to open the file.

      sudo nano /etc/ufw/before.rules

    3. To route VPN client traffic through the server's public network interface, a masquerading rule is added. This allows clients to access external resources using the server's IP address. Insert the following block before the *filter line.

      *nat
      :POSTROUTING ACCEPT [0:0]
      -A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
      COMMIT
      tip

      Replace eth0 with your actual network interface if it differs. You can check it using ip a.

    4. To allow forwarding of packets between interfaces (VPN ↔ internet), the default policy in UFW must be set to "ACCEPT". To modify the default policy open file with the following command.

      sudo nano /etc/default/ufw

    5. Locate and modify the line as follows.

      DEFAULT_FORWARD_POLICY="ACCEPT"

    6. After making these changes, UFW must be restarted to apply the new routing and NAT settings. Use the following command to apply changes.

      sudo ufw disable
      sudo ufw enable

  10. Start and Enable OpenVPN Service: Start the OpenVPN service and ensure it starts automatically at boot.

    sudo systemctl start openvpn-server@server
    sudo systemctl enable openvpn-server@server

  11. Verify the VPN Server Status: Check if the VPN service is running properly without errors. If everything is configured correctly, you should see Active: active (running.

    sudo systemctl status openvpn-server@server

How to Configure OpenVPN Client on Ubuntu?​

To connect securely to an OpenVPN server, the client machine must have OpenVPN installed, a valid client configuration file (usually .ovpn), and proper certificates. This section walks you through the process of installing the client, importing the configuration, and establishing a connection. You may follow the next steps to configure the OpenVPN client on Ubuntu.

  1. Install the OpenVPN Client: To install the OpenVPN client on Ubuntu, use the following command. This ensures you have the necessary tools to initiate a VPN connection.

    sudo apt update && sudo apt install openvpn -y

  2. Transfer the Following Files from Server to Client: Copy the necessary files from the OpenVPN server (Ubuntu) to the client system. You can use a shared folder like vmshare or scp. The required files are listed below.

    • ca.crt: Certificate Authority file
    • client1.crt: Client certificate
    • client1.key: Client private key
    • ta.key: TLS authentication key

    Move these files to the appropriate directory on the client system with the following command.

    sudo mkdir -p /etc/openvpn/client
    sudo cp /media/sf_vmshare/* /etc/openvpn/client/
    tip

    Make sure that file names match and are not accidentally renamed or overwritten.

  3. Prepare the Client Configuration File: To connect to an OpenVPN server, you need a .ovpn file that contains all the necessary connection settings and certificates.

    Use a text editor to create the .ovpn client configuration file with the following command.

    sudo nano /etc/openvpn/client/client1.ovpn

    Paste the following configuration into the file.

    Client
    dev tun
    proto udp
    remote 192.168.56.1 1194 # IP of OpenVPN server
    resolv-retry infinite
    Nobind
    persist-key
    persist-tun
    remote-cert-tls server # Verify the server cert against CA
    cipher AES-256-CBC
    auth SHA256
    data-ciphers AES-256-CBC:AES-256-GCM
    tls-auth /etc/openvpn/client/ta.key 1
    key-direction 1
    ca /etc/openvpn/client/ca.crt
    cert /etc/openvpn/client/client1.crt
    key /etc/openvpn/client/client1.key
    verb 3 # Logging level (3 is default and sufficient)

    You can generate this file manually or export it using tools like EasyRSA or helper scripts on the server.

  4. Fix File Permissions (Security Best Practice): OpenVPN will warn if .key files are readable by others. Restrict access to the key files with the following command.

    sudo chmod 600 /etc/openvpn/client/*.key

  5. Connect to the VPN Server: To start the OpenVPN client using your configuration file, use the following command.

    sudo openvpn --config /etc/openvpn/client/client1.ovpn

    The terminal will display logs showing the connection process. If everything is correct, youll see Initialization Sequence Completed`.

  6. (Optional) Test the VPN Connection: Once connected, you can verify that your public IP has changed with the following command.

    curl [ifconfig.me](http://ifconfig.me)

    If successful, it should return the public IP of the VPN server, not your local IP.

Where is the OpenVPN config file in Linux?​

On Linux-based systems, OpenVPN relies on a set of configuration files that define how the VPN service should operate. These files include server and client settings, encryption protocols, authentication keys, and routing directives. Understanding where these configuration files reside is essential for maintaining, modifying, or troubleshooting an OpenVPN setup.

By default, OpenVPN configuration files are stored in the following directory.

/etc/openvpn/

This path serves as the central location for both server and client configuration files on most Debian-based and Red Hat-based Linux distributions. Within this directory, .conf or .ovpn files define the parameters required to initiate and maintain a VPN connection.

Depending on the deployment structure, additional subdirectories may be used to organize configuration files more effectively:

  • /etc/openvpn/server/ is used to isolate server-specific configurations, especially in multi-instance environments.
  • /etc/openvpn/client/ is often utilized to manage multiple client profiles, particularly when each client requires unique certificates or keys.
  • User directories such as ~/Downloads/ or ~/vpn-configs/ may be temporarily used during manual testing or setup phases, though they are not persistent or secure.

For OpenVPN instances managed via SystemD, configuration files typically must be placed in /etc/openvpn/ and named accordingly (e.g., client.conf) in order to be recognized by services like openvpn@client.

To view the contents of the OpenVPN directory, the following command may be used.

ls /etc/openvpn/

This will list all available configuration files and folders. For systems with multiple configurations (e.g., site-to-site tunnels or multiple clients), organizing files into clearly named subdirectories is considered best practice.

Editing a configuration file can be accomplished using a text editor such as nano.

sudo nano /etc/openvpn/client/client1.ovpn

When editing, administrators should ensure that key fields—such as server address, port, protocol, and certificate file paths—are accurate and consistent with the corresponding server setup.

To enable persistent VPN sessions on boot, configuration files must comply with the expected naming conventions and file locations recognized by the system's init manager. For instance, under SystemD, placing a file named client.conf in /etc/openvpn/ and enabling it using the following command.

sudo systemctl enable openvpn@client

It will instruct the system to automatically start the OpenVPN client on boot using that configuration.

In summary, OpenVPN configuration files on Linux systems are primarily located in the /etc/openvpn/ directory. Depending on the use case, server, client, or multi-instance deployment, these files may be further organized into subdirectories for clarity and security. Proper management and placement of configuration files not only ensure smooth VPN operation but also facilitate easier troubleshooting and automation.

What are the Requirements for Installing OpenVPN on Ubuntu?​

Before installing and configuring OpenVPN on an Ubuntu system, it is important to ensure that the system meets the minimum version and software requirements. These prerequisites help ensure compatibility, stability, and security when deploying OpenVPN as a secure VPN solution.

OpenVPN is officially supported and actively maintained on the following Ubuntu versions.

  • Ubuntu 24.04 LTS (Noble Numbat)
  • Ubuntu 22.04 LTS (Jammy Jellyfish)
  • Ubuntu 20.04 LTS (Focal Fossa)
  • Ubuntu 18.04 LTS (Bionic Beaver) — Supported with some package version limitations
  • Ubuntu 16.04 LTS — Deprecated: not recommended due to outdated libraries and EOL status
tip

Use Ubuntu 20.04 or later to ensure full compatibility with the latest versions of OpenVPN, Easy-RSA, and OpenSSL.

Required Software Packages and Dependencies​

To install and operate OpenVPN successfully, the following packages and libraries must be available on the system.

PackagePurpose
openvpnCore VPN software is used to establish secure, encrypted connections
easy-rsaUtility for managing RSA keys, certificate authority (CA), and PKI files
opensslProvides cryptographic functions used by OpenVPN and Easy-RSA
net-tools or iproute2Useful for managing networking interfaces and routing (optional)
ufw or iptablesUsed to configure firewall and NAT rules (recommended)

OpenVPN installation and management require root (sudo) privileges on the system. Additionally, having an accurately synchronized system clock, preferably via NTP, is highly recommended to prevent TLS/SSL certificate validation errors. Lastly, internet connectivity is essential during the installation phase to retrieve necessary Linux packages and update repositories.

To install OpenVPN on Ubuntu, ensure you are using Ubuntu 22.04 or later and have installed the necessary dependencies such as openvpn, easy-rsa, and openssl. Meeting these requirements ensures a smoother installation and greater security for your VPN deployment.

What are the Best Free VPN Options for Ubuntu with OpenVPN?​

While OpenVPN is a protocol (not a VPN service itself), several VPN providers offer free OpenVPN-compatible configurations that can be used with the OpenVPN client on Ubuntu. These providers typically offer .ovpn files for manual setup, ensuring private and encrypted connections.

Below is a curated list of the most trusted free VPN services that support OpenVPN on Ubuntu, including setup flexibility, data limits, performance, and privacy considerations.

  1. ProtonVPN ProtonVPN is a Swiss-based VPN service known for its strong privacy policies and reliable infrastructure.

    ProtonVPN’s free tier offers unlimited bandwidth, which is rare among free VPN providers. While access is limited to a few countries (typically the United States, the Netherlands, and Japan), ProtonVPN maintains good stability and acceptable performance for general browsing.

    The service provides official .ovpn configuration files that can be manually used with the OpenVPN client on Ubuntu. Additionally, ProtonVPN offers optional Linux CLI tools for users who prefer integrated control over connections.

  2. Windscribe: Windscribe provides a generous 10 GB of free data per month and access to servers in approximately 10 countries. It supports OpenVPN through downloadable configuration files, which are available after account registration.

    Windscribe includes a dedicated Linux CLI tool (windscribe-cli), making it easier for users to connect and manage profiles.

    The performance is generally reliable for everyday tasks, including secure browsing and lightweight streaming, and it supports peer-to-peer traffic on selected free servers.

  3. Hide.me: Hide.me offers a free plan with a 10 GB monthly data cap and access to servers in five different locations. Hide.me is particularly well-suited for Linux users, thanks to its strong documentation and compatibility with both the OpenVPN command-line interface and NetworkManager. The .ovpn configuration files are straightforward to obtain and set up, and the service is known for its stable connections and decent speeds within the bandwidth limit. Although its server network is more limited than paid plans, it provides a secure and user-friendly experience on Ubuntu.

  4. VPNBook (Fully Free, No Account Required): VPNBook is a rare example of a truly free VPN service that requires no sign-up or payment. It offers publicly available .ovpn configuration files for several servers, including options in Europe and the United States.

    Unlike the other providers, VPNBook does not provide a custom application or client; users must manually input credentials and load configuration files using the OpenVPN CLI.

    Performance can vary depending on server load, and occasional downtime may occur, but for users seeking maximum privacy with minimal registration, VPNBook remains a lightweight and functional solution.

What are the Security Benefits of Using OpenVPN on Ubuntu?​

OpenVPN is widely regarded as one of the most secure VPN protocols available, especially when configured on open-source platforms like Ubuntu. Its layered encryption model, robust authentication features, and adaptability make it a trusted choice for both individual and enterprise-level use. Below are the primary security benefits of using OpenVPN on Ubuntu systems.

  1. Strong Encryption Standards: OpenVPN supports industry-standard encryption algorithms such as AES-256, which is considered highly secure and is widely used in military and financial applications. This level of encryption protects data in transit, ensuring confidentiality even across unsecured networks like public Wi-Fi.

  2. Mutual Authentication via Certificates: One of OpenVPN's key strengths lies in its use of SSL/TLS for authentication. Both the server and client authenticate each other using X.509 certificates, significantly reducing the risk of unauthorized access and man-in-the-middle (MITM) attacks.

  3. Perfect Forward Secrecy (PFS): When configured with ephemeral keys (e.g., using Diffie-Hellman or Elliptic Curve Diffie-Hellman), OpenVPN supports Perfect Forward Secrecy. This ensures that even if one session key is compromised, past and future sessions remain secure.

  4. Integrity Protection and Tamper Detection: OpenVPN uses HMAC (Hash-Based Message Authentication Code) to verify the integrity of each data packet. This prevents tampering and ensures that data has not been modified in transit.

  5. Port Flexibility and Obfuscation: OpenVPN can run on arbitrary ports, including TCP port 443 (commonly used for HTTPS). This makes OpenVPN traffic harder to detect or block via deep packet inspection (DPI), offering better resistance against censorship or VPN filtering.

  6. No Data Logging (when self-hosted): When OpenVPN is deployed on a self-managed Ubuntu server, it gives the administrator full control over logging policies. This allows for a truly no-logs VPN experience, enhancing privacy and limiting data exposure.

  7. Compatibility with Strong Firewall Rules: Ubuntu’s built-in firewall tools (e.g., UFW or iptables) can be tightly integrated with OpenVPN to restrict access, isolate clients, and enforce IP whitelisting or kill-switch mechanisms for added control and containment.

  8. Open Source and Community Audited: Both OpenVPN and Ubuntu are open-source projects. This transparency allows security researchers and the community to audit the code regularly, helping detect and patch vulnerabilities faster than closed-source alternatives.

In summary, using OpenVPN on Ubuntu provides a highly secure, customizable, and transparent VPN environment. Its combination of strong encryption, mutual authentication, and open-source trust makes it ideal for protecting sensitive data and communications.

How Do You Set Up a Secure OpenVPN Server on Ubuntu?​

Securing an OpenVPN server on Ubuntu requires more than a default installation. For robust protection, the server must be configured with strong encryption standards, secure authentication mechanisms, and properly managed certificates. This section provides a detailed explanation of both secure protocol configuration and certificate infrastructure setup for a hardened OpenVPN deployment.

Configuring OpenVPN with Secure Cipher Suites and Protocols​

To ensure a secure VPN tunnel, the OpenVPN server should be configured with modern cryptographic standards. These configurations are made in the OpenVPN server configuration file, typically located at /etc/openvpn/server.conf. The following directives are recommended.

cipher AES-256-GCM
auth SHA256
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
tls-auth ta.key 0
key-direction 0

  • AES-256-GCM is a modern, authenticated encryption cipher that provides both confidentiality and integrity.

  • auth SHA256 ensures packets are signed with a secure hash function.

  • tls-version-min 1.2 enforces a minimum TLS version to block legacy and insecure handshakes.

  • tls-cipher restricts TLS negotiation to strong cipher suites that support Perfect Forward Secrecy (PFS).

  • tls-auth ta.key 0` adds an extra HMAC signature to TLS handshakes, mitigating DoS and packet injection attacks.

  • key-direction 0 defines the role of the server in the TLS key exchange (client uses 1).

These settings help resist cryptographic downgrade attacks, strengthen identity validation, and enhance tunnel integrity.

Creating Strong Security Certificates and Keys for Server and Clients​

OpenVPN uses an SSL/TLS-based Public Key Infrastructure (PKI) for authentication. The process of creating secure certificates and keys is typically managed using Easy-RSA, which simplifies PKI generation on Ubuntu systems.

In earlier sections, we already covered how to initialize the PKI environment and generate necessary certificates such as CA (Certificate Authority), server certificate and key, client certificate and key, Diffie-Hellman parameters, and TLS key for HMAC verification.

All of these were generated using Easy-RSA commands, which are shared below.

./easyrsa build-ca
./easyrsa build-server-full server
./easyrsa build-client-full client2
./easyrsa gen-dh
openvpn --genkey secret ta.key

These files form the backbone of OpenVPN’s secure handshake mechanism and must be stored and distributed with care.

  • Server-side files (e.g., server.crt, server.key, ca.crt, dh.pem, ta.key) should be moved to /etc/openvpn/server/.

  • Client-side files (e.g. client1.crt, client1.key, ca.crt, ta.key) should be transferred securely to the client device.

When used together with secure protocol configurations, these certificates ensure encrypted, authenticated, and tamper-resistant communication between clients and the VPN server.

What are the Best Practices for Running OpenVPN Server on Ubuntu?​

The protocol and port OpenVPN uses directly impact its speed and reliability. By default, OpenVPN uses UDP on port 1194, which is generally the best option for most users due to its low latency and better throughput. UDP is ideal for real-time applications such as VoIP, video conferencing, and streaming.

However, in environments with strict firewall rules or deep packet inspection (DPI), TCP on port 443 is recommended. This port mimics regular HTTPS traffic, making it harder for restrictive networks to detect or block OpenVPN packets.

To apply these best practices effectively, it is recommended to configure OpenVPN to use proto udp with port 1194 in standard scenarios, as it offers optimal speed and performance. In contrast, proto TCP over port 443 should be used when the VPN must operate behind restrictive firewalls or in censorship-heavy environments.

Furthermore, while compression options like compress lz4 may improve performance for some use cases, they should be enabled cautiously, as they can introduce additional CPU overhead and potential vulnerabilities. In high-traffic deployments, administrators should also monitor resource usage and fine-tune buffer sizes (sndbuf, rcvbuf) to ensure consistent performance and minimize packet loss.

How to Troubleshoot OpenVPN Server Issues on Ubuntu Linux?​

Even with correct configuration, OpenVPN servers may occasionally fail to start or function as expected due to syntax errors, missing files, permission issues, or network misconfigurations. Below are common troubleshooting steps that can help identify and resolve typical OpenVPN problems on Ubuntu.

  1. Check OpenVPN Service Status: First, ensure the OpenVPN service is running correctly with the following command.

    sudo systemctl status openvpn@server

    If the service is inactive or failed, look for clues in the output, such as “failed to start,” “missing key,” or “TLS handshake failed.”

  2. Inspect System Logs for Errors: The primary source for runtime errors is the system log. Use the following command to check the log file.

    sudo journalctl -u openvpn@server

    Or, you can check the general log file with the command below.

    sudo less /var/log/syslog

    Look for messages related to missing certificates, port conflicts, or authentication failures.

  3. Enable Verbose Logging in Configuration: In your server.conf file, increase the verbosity to capture more detailed output. The following command will create a dedicated log file for OpenVPN, making it easier to trace issues.

    verb 4 log-append /var/log/openvpn.log

  4. Validate Certificate and Key Paths: Make sure all certificate and key file paths defined in server.conf are correct and readable. Check that the files exist in /etc/openvpn/ and have the correct permissions (typically 600 for keys).

    ca ca.crt
    cert server.crt
    key server.key

  5. Verify Port Availability and Firewall Rules: Ensure that your chosen port (e.g., 1194 UDP) is open and not being blocked by a firewall or used by another service with the commands below.

    sudo netstat -tulnp | grep 1194 sudo ufw status verbose

    If needed, adjust UFW or iptables rules to allow OpenVPN traffic.

  6. Test from the Client Side: If the server appears to be running correctly, test the connection from a client with the following command. Watch for output such as TLS Error, AUTH_FAILED, or Connection reset, which can indicate specific server-side issues.

    openvpn --config client.ovpn

    Troubleshooting OpenVPN on Ubuntu typically involves examining the service status, checking log files, verifying file paths and permissions, and ensuring that firewall rules are not blocking traffic. By following these steps methodically, most configuration or runtime issues can be quickly identified and resolved.

How to Monitor and Optimize OpenVPN Server Performance on Ubuntu?​

Ensuring high availability and responsiveness of an OpenVPN server requires continuous performance monitoring and system optimization. This process helps detect bottlenecks, manage system resources efficiently, and maintain a stable connection experience for connected clients. Below are recommended tools and methods to monitor and improve OpenVPN performance on Ubuntu.

  1. Monitor System Resource Usage: Tools like htop, top, and vmstat provide real-time information on CPU, memory, and process utilization. These tools help administrators identify if the OpenVPN process (openvpn) is consuming excessive resources or being affected by other system workloads.

    To monitor real-time CPU and memory usage on the server, use the following command.

    Htop

    Look for high CPU usage by the openvpn process and monitor memory pressure when multiple clients are connected.

  2. Inspect Network Connections and Throughput: Use netstat, ss, or iftop to monitor live network connections and traffic volume. This is useful for checking how many clients are connected and how much bandwidth is being used.

    To verify that OpenVPN is actively listening on the correct port and protocol, use the following command.

    sudo netstat -tunap | grep openvpn

    Alternatively, use the ss command to quickly check whether UDP port 1194 is open and accessible:

    sudo ss -u -a | grep 1194

    To monitor real-time bandwidth usage on the network interface used by OpenVPN, use the following command.

    sudo iftop -i eth0
    tip

    Make sure to replace eth0 with your actual network interface name (ip a to check).

  3. Review OpenVPN Logs for Performance Clues: Enable and monitor OpenVPN logs to detect issues such as dropped packets, repeated TLS handshakes, or connection failures. Use the following command to tail the log in real-time.

    tail -f /var/log/openvpn.log

    Ensure that your server.conf file includes appropriate logging directives to capture necessary runtime data. A common configuration is as follows.

    verb 3
    log-append /var/log/openvpn.log

    Increasing the verbosity level to verb 4 can provide deeper insights into handshake operations and routing behavior. However, be cautious in high-traffic environments, as this may increase disk I/O and affect performance.

  4. Optimize Configuration for Performance: To ensure efficient data transmission and maintain a responsive VPN experience, consider the following performance-focused optimizations in your OpenVPN server configuration.

    • Prefer UDP over TCP for higher throughput: UDP is typically faster than TCP because it does not require connection setup and acknowledgement packets. Use UDP unless you`re dealing with restrictive firewalls or require reliable transmission.

      proto udp

    • Tune socket buffer sizes to improve throughput, especially over high-latency networks. Add the following parameters to your server.conf to increase the send and receive buffers and push them to clients.

      sndbuf 393216
      rcvbuf 393216
      push "sndbuf 393216"
      push "rcvbuf 393216"

    • Enable fast-io for improved performance on high-bandwidth connections. This option minimizes context switching during I/O operations, which can boost speed on systems with fast network interfaces.

      fast-io

    • Limit the number of simultaneous clients if server hardware resources are limited. Setting a maximum number of clients helps preserve system stability and ensures fair usage of CPU and memory resources. Use the following command to set a maximum number of clients.

      max-clients 50

    Monitoring tools such as htop, netstat, and iftop, combined with careful configuration of OpenVPN and the underlying system, enable administrators to maintain optimal performance and responsiveness. Regular log reviews and proactive tuning help ensure that the VPN service remains efficient under varying load conditions.

How to Configure OpenVPN for Site-to-Site VPN on Ubuntu?​

A site-to-site VPN allows two or more geographically separated networks to securely communicate as if they were on the same local network. Using OpenVPN, you can bridge two internal networks via encrypted tunnels on Ubuntu systems. This setup is commonly used to link branch offices or connect cloud infrastructure with on-premises networks.

Below is a step-by-step guide to configuring a site-to-site VPN using OpenVPN.

  1. Define the Topology: Before configuring, clearly identify the IP addresses and internal networks of both sites. Assume the following setup.

    • Head Office (Server): Public IP: 203.0.113.1 and Internal Network: 10.0.0.0/24.
    • Branch Office (Client): Public IP: 198.51.100.1 and Internal Network: 10.8.0.0/24

    Goal: Enable devices from each internal network to access the other securely through an encrypted OpenVPN tunnel.

  2. Configure the OpenVPN Server (Head Office): Begin by generating certificates and keys using Easy-RSA, as done during the initial setup.

    1. Edit the OpenVPN server configuration file to define the VPN behavior with the following command.

      sudo nano /etc/openvpn/server.conf

    2. Insert or verify the following directives in the configuration file.

      port 1194
      proto udp
      dev tun
      ca ca.crt
      cert server.crt
      key server.key
      dh dh.pem
      auth SHA256
      tls-auth ta.key 0
      key-direction 0
      server 10.8.0.0 255.255.255.0
      persist-key
      persist-tun
      keepalive 10 120
      cipher AES-256-CBC
      data-ciphers AES-256-CBC:AES-256-GCM
      user nobody
      group nogroup
      status /var/log/openvpn-status.log # Status log path
      verb 3

    3. Enable IP forwarding so that the VPN server can route traffic between subnets with the following commands.

      sudo sysctl -w net.ipv4.ip_forward=1

      Alternatively, make it permanent by editing /etc/sysctl.conf with the command below.

      net.ipv4.ip_forward = 1

    4. Configure NAT using iptables to allow traffic from the internal network to pass through the VPN:

      sudo iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

  3. Configure the OpenVPN Client (Branch Office): Transfer the required client keys and certificates from the server to the client securely.

    1. Transfer the following files to the branch office machine:

      • ca.crt
      • ta.key
      • client1.crt
      • client1.key

    2. Create and edit the client configuration file on the branch office machine with the following command.

      sudo nano /etc/openvpn/client.ovpn

    3. Add the following configuration in the configuration file.

      client
      dev tun
      proto udp
      remote 203.0.113.1 1194 # IP of OpenVPN server
      resolv-retry infinite
      nobind
      persist-key
      persist-tun
      remote-cert-tls server # Verify the server cert against CA
      cipher AES-256-CBC
      auth SHA256
      data-ciphers AES-256-CBC:AES-256-GCM
      tls-auth /etc/openvpn/client/ta.key 1
      key-direction 1
      ca /etc/openvpn/client/ca.crt
      cert /etc/openvpn/client/client1.crt
      key /etc/openvpn/client/client1.key
      verb 3 # Logging level (3 is default and sufficient)

    4. Optionally, add a static route to make the head office LAN reachable with the following command. This command allows devices in the branch office network (10.8.0.0/24) to reach the head office LAN (10.0.0.0/24) via the VPN gateway (10.8.0.1).

      sudo ip route add 10.0.0.0/24 via 10.8.0.1

  4. Start and Enable OpenVPN Services: Activate the VPN service on both server and client systems with the following commands.

    sudo systemctl start openvpn@server
    sudo systemctl enable openvpn@server

    On the client side, if you are using a .ovpn configuration file, start the VPN tunnel manually with the following command.

    sudo openvpn --config /etc/openvpn/client.ovpn

    To run it in the background or enable it at boot, you may consider renaming the file to client.conf and placing it under /etc/openvpn/client/ with the following commands.

    sudo systemctl start openvpn-client@client
    sudo systemctl enable openvpn-client@client

  5. Test Site-to-Site Connectivity: Verify the VPN connection by performing the following checks.

    1. Ping from a device on one LAN to the other (e.g., ping 10.0.0.1 from a device in 10.8.0.0/24).

      ping 10.0.0.1

    2. Use traceroute to ensure packets are flowing through the tunnel.

      Setting up a site-to-site VPN with OpenVPN on Ubuntu requires configuring both ends of the tunnel with consistent routing, key management, and firewall rules. Once a site-to-site VPN is established, it allows seamless communication between two LANs over a secure, encrypted channel.

How to Use OpenVPN as a Secure VPN Server on Ubuntu for Small Businesses?​

OpenVPN offers small businesses a practical and secure way to enable remote access to their internal networks without relying on expensive enterprise-grade solutions. With its strong encryption protocols, flexible configuration, and open-source nature, OpenVPN stands out as a scalable VPN solution that can be deployed cost-effectively on Ubuntu servers.

Secure Remote Access for Distributed Teams​

For small businesses with remote employees, satellite offices, or traveling staff, OpenVPN ensures encrypted access to company resources such as file servers, internal web tools, or databases. Employees can connect securely to the business network over the internet, maintaining data confidentiality through TLS-based encryption and client authentication via certificates. This ensures that sensitive company data remains protected, even over untrusted networks.

Unlike cloud-based VPN services that may pose privacy concerns or additional licensing costs, self-hosting OpenVPN on Ubuntu allows full administrative control over security policies, access levels, and logging.

Cost-Effective Deployment with Open-Source Tools​

One of the biggest advantages for small businesses is the zero licensing cost associated with OpenVPN. It uses freely available tools like those shared below.

  • OpenVPN: Core VPN engine
  • Easy-RSA: Certificate and key management
  • UFW or iptables: Firewall configuration (UFW is recommended for beginners due to its simplicity, while iptables offers more advanced control.)
  • SystemD: Service management

Ubuntu servers can be hosted on inexpensive cloud VPS services (e.g., DigitalOcean, Linode) or run on existing local infrastructure. With basic technical knowledge, system administrators or IT consultants can deploy OpenVPN without needing expensive hardware or third-party subscriptions.

Scalable for Growth and Customization​

Thanks to its modular architecture, OpenVPN allows small businesses to perform a range of scalable and customizable operations, such as:

  • Adding more client devices easily by generating separate certificates for each user.
  • Using site-to-site configurations to link multiple branch locations.
  • Enforcing security rules such as tls-auth, strong cipher suites, and packet filtering.
  • Monitoring usage and logs via built-in logging or integration with tools like Logwatch, Nagios, or Grafana.

Additionally, OpenVPN supports scripting hooks and plugins, enabling businesses to integrate it with authentication systems like LDAP or two-factor authentication (2FA) providers.

Small businesses can benefit immensely from OpenVPN on Ubuntu by providing their teams with secure, encrypted remote access to company resources. Its open-source model eliminates licensing costs, while its robust encryption and scalability make it suitable for both current needs and future expansion. With proper configuration and minimal hardware requirements, OpenVPN empowers small businesses to implement enterprise-grade security on a budget.

Conclusion​

OpenVPN on Ubuntu offers small businesses and technical teams a powerful way to secure internal communications without the complexity or cost of commercial VPN solutions. From enabling remote access for distributed teams to establishing secure site-to-site connections, OpenVPN delivers flexibility, strong encryption, and full control over network traffic.

By following best practices such as choosing the right protocol and port, using certificate-based authentication, and configuring proper routing and firewall rules, organizations can ensure both performance and privacy. Its scalability and open-source nature make OpenVPN a future-proof investment for businesses that value security and autonomy.

With the right setup, OpenVPN transforms any Ubuntu server into a reliable, secure, and affordable VPN gateway.

Get Started with Zenarmor Today For Free
Last updated on by Zenarmor