How to Install OpenVPN Server on Ubuntu

This guide explains how to install and configure an OpenVPN server on Ubuntu using certificate-based authentication, a routed VPN network, IP forwarding, UFW, and individual client profiles.

The commands are intended for current supported Ubuntu Server releases. Package layouts can differ across Ubuntu and OpenVPN versions, so check installed sample files and systemd units before copying paths blindly.

OpenVPN server plan

The examples use:

• Public VPN address: vpn.example.com
• Protocol and port: UDP 1194
• VPN subnet: 10.8.0.0/24
• Server name: vpn-server
• First client name: laptop-ravi

Make sure the VPN subnet does not overlap the server LAN or common client networks. Overlapping routes are a frequent cause of failed access.

Before installing OpenVPN

• Use a supported, updated Ubuntu release.
• Confirm sudo access and a stable server address.
• Create DNS for the VPN hostname when clients will use one.
• Keep your existing SSH session open while changing firewall rules.
• Back up important server data and configuration.

Update installed packages:

sudo apt update
sudo apt upgrade

Schedule a reboot if the upgrade requires one before relying on the VPN for administrative access.

Step 1: Install OpenVPN and Easy-RSA

sudo apt install openvpn easy-rsa

Check the versions:

openvpn --version
dpkg-query -W openvpn easy-rsa

Step 2: Create the certificate authority workspace

For stronger separation, operate the certificate authority on a protected offline or dedicated system. A simple single-server setup can create a restricted workspace:

sudo make-cadir /etc/openvpn/easy-rsa
sudo chmod 700 /etc/openvpn/easy-rsa
cd /etc/openvpn/easy-rsa

Initialise the public key infrastructure:

sudo ./easyrsa init-pki
sudo ./easyrsa build-ca

Protect the CA private key with a strong passphrase. Anyone who obtains it can sign certificates trusted by your VPN.

Step 3: Create the server certificate and key

cd /etc/openvpn/easy-rsa
sudo ./easyrsa gen-req vpn-server nopass
sudo ./easyrsa sign-req server vpn-server
sudo ./easyrsa gen-dh

nopass allows the service to start unattended but leaves the server private key unencrypted on disk. Limit root access, file permissions, backups, and snapshots accordingly.

Step 4: Generate a TLS control-channel key

sudo openvpn --genkey tls-crypt /etc/openvpn/tls-crypt.key

tls-crypt authenticates and encrypts the TLS control channel. It is different from the client and server certificate keys.

Step 5: Copy server credentials

sudo install -m 644 pki/ca.crt /etc/openvpn/ca.crt
sudo install -m 644 pki/issued/vpn-server.crt /etc/openvpn/vpn-server.crt
sudo install -m 600 pki/private/vpn-server.key /etc/openvpn/vpn-server.key
sudo install -m 644 pki/dh.pem /etc/openvpn/dh.pem
sudo chmod 600 /etc/openvpn/tls-crypt.key

Do not copy the CA private key into a client profile or public backup.

Step 6: Create the OpenVPN server configuration

Create /etc/openvpn/server.conf:

sudo nano /etc/openvpn/server.conf

Use this starting configuration:

port 1194
proto udp
dev tun

ca /etc/openvpn/ca.crt
cert /etc/openvpn/vpn-server.crt
key /etc/openvpn/vpn-server.key
dh /etc/openvpn/dh.pem
tls-crypt /etc/openvpn/tls-crypt.key

topology subnet
server 10.8.0.0 255.255.255.0

keepalive 10 120
persist-key
persist-tun
user nobody
group nogroup

explicit-exit-notify 1
verb 3

Do not enable compression. Compression with encrypted VPN traffic has a history of security concerns and modern OpenVPN deployments should avoid it unless a documented legacy requirement has been carefully assessed.

Step 7: Decide whether to route only private networks or all traffic

For access to a private LAN such as 10.20.0.0/16, add:

push "route 10.20.0.0 255.255.0.0"

For a full-tunnel VPN, add:

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"

Use DNS resolvers approved for your organisation. A full tunnel sends client internet traffic through the VPN server and therefore requires NAT, enough bandwidth, monitoring, and a clear privacy policy.

Step 8: Enable IPv4 forwarding

echo 'net.ipv4.ip_forward = 1' | \
  sudo tee /etc/sysctl.d/50-openvpn-forwarding.conf

sudo sysctl -p /etc/sysctl.d/50-openvpn-forwarding.conf
sysctl net.ipv4.ip_forward

The final value should be 1.

Step 9: Find the public network interface

ip route show default

The example below assumes the outbound interface is ens3. Replace it with the real interface.

Step 10: Configure UFW and NAT

Allow the VPN port without removing SSH access:

sudo ufw allow 1194/udp
sudo ufw status numbered

Set forwarding policy in /etc/default/ufw:

DEFAULT_FORWARD_POLICY="ACCEPT"

Add a NAT section near the beginning of /etc/ufw/before.rules, before its filter table:

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADE
COMMIT

Reload only after confirming the existing SSH rule:

sudo ufw disable
sudo ufw enable
sudo ufw status verbose

For a stricter design, add explicit route rules instead of broadly accepting all forwarding. Our UFW guide explains firewall safety.

Also allow UDP 1194 in the hosting provider’s cloud firewall or security group.

Step 11: Start the OpenVPN service

Ubuntu package versions may expose openvpn@server or openvpn-server@server, depending on configuration layout. List units first:

systemctl list-unit-files 'openvpn*'

For /etc/openvpn/server.conf with the traditional template:

sudo systemctl enable --now openvpn@server
sudo systemctl status openvpn@server --no-pager

If your package uses /etc/openvpn/server/server.conf, the matching unit may be:

sudo systemctl enable --now openvpn-server@server

Use the unit and directory layout supplied by the installed Ubuntu package.

Step 12: Verify the VPN server

ip address show tun0
sudo ss -lunp | grep ':1194 '
sudo journalctl -u openvpn@server -n 100 --no-pager

Look for Initialization Sequence Completed. If your unit has another name, use that in the journal command.

Step 13: Create an individual client certificate

cd /etc/openvpn/easy-rsa
sudo ./easyrsa gen-req laptop-ravi nopass
sudo ./easyrsa sign-req client laptop-ravi

Create a different certificate for every person or device. Shared certificates make revocation and auditing difficult.

Step 14: Build a client profile

Create a protected working file named laptop-ravi.ovpn:

client
dev tun
proto udp
remote vpn.example.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verb 3

<ca>
# Paste the complete ca.crt content here
</ca>

<cert>
# Paste the complete laptop-ravi.crt certificate here
</cert>

<key>
# Paste the complete laptop-ravi.key content here
</key>

<tls-crypt>
# Paste the complete tls-crypt.key content here
</tls-crypt>

The profile contains a private key and must be transferred through a secure channel. Do not email it in plain text, publish it, or leave copies in a web-accessible directory.

Step 15: Connect from an Ubuntu client

sudo apt install openvpn
sudo openvpn --config laptop-ravi.ovpn

In another terminal, check:

ip address
ip route
ping -c 3 10.8.0.1

Test only destinations and traffic that the VPN is intended to carry. A full tunnel should also be checked for DNS leaks and correct public egress.

Revoke a lost client certificate

cd /etc/openvpn/easy-rsa
sudo ./easyrsa revoke laptop-ravi
sudo ./easyrsa gen-crl
sudo install -m 644 pki/crl.pem /etc/openvpn/crl.pem

Add this server directive:

crl-verify /etc/openvpn/crl.pem

Restart the correct OpenVPN unit and confirm the revoked profile can no longer connect. Regenerate and publish the CRL whenever another certificate is revoked.

Common OpenVPN problems

TLS key negotiation failed

Check DNS, UDP 1194 in both firewalls, protocol and port agreement, time synchronisation, and matching tls-crypt material.

The VPN connects but there is no internet

Check IPv4 forwarding, the NAT interface name, UFW forwarding, pushed routes, and client routing. The outbound interface often changes between hosting platforms.

Private LAN hosts do not respond

The LAN needs a return route to 10.8.0.0/24, or the VPN server must apply appropriate NAT. Also check host firewalls and overlapping client networks.

The OpenVPN service unit is not found

List installed units and inspect package paths. Ubuntu supports more than one template layout across releases; the filename and directory determine the instance name.

Certificate verification fails

Confirm that the client certificate has client extensions, the server certificate has server extensions, both are signed by the expected CA, system clocks are correct, and certificates are within their validity period.

OpenVPN security checklist

• Protect the CA and private keys.
• Create one certificate per person or device.
• Use tls-crypt and do not enable compression.
• Expose only the VPN port and required SSH access.
• Use narrow routes and forwarding rules.
• Maintain and enforce a certificate revocation list.
• Patch Ubuntu and OpenVPN regularly.
• Monitor connection logs and remove unused profiles.

Include the VPN host in your broader Linux server hardening plan.

Frequently asked questions

Which port does OpenVPN use?

UDP 1194 is the official default, but it can be changed. The server, client, host firewall, cloud firewall, and any router must agree.

Should OpenVPN use UDP or TCP?

UDP is normally preferred for VPN tunnels. TCP can help in specific restricted networks but running TCP inside TCP may reduce performance.

Should I share one client certificate?

No. Issue a separate certificate for each user or device so it can be revoked without disabling everyone.

Is an OpenVPN profile secret?

Yes when it embeds a private client key and control-channel key. Store and transfer it like a credential.

Official references

• Ubuntu Server: Install and use OpenVPN
• OpenVPN 2.6 manual
• Easy-RSA documentation

You now have a complete OpenVPN server path from package installation and PKI creation to firewall routing, client profiles, live verification, and certificate revocation. Test the design from an external client before depending on it for production access.