Install OpenVPN Community Edition on an Ubuntu VPS with openvpn and easy-rsa, create a certificate authority (CA), issue server and client credentials, configure a named systemd instance, open the VPN port in every firewall, and enable forwarding plus NAT for the traffic you want to carry. A client can show “connected” while still having no internet access if forwarding, NAT, or return routes are missing.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This guide assumes an Ubuntu Server VPS with sudo access, a public IPv4 address or DNS name, and a provider firewall/security group separate from Ubuntu’s own firewall. It presents the repository-based Community Edition first, then explains when OpenVPN Access Server’s web administration and profile distribution are a better fit.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat you are installing
OpenVPN is an SSL/TLS VPN stack. On Ubuntu, the Community Edition is installed from the distribution repositories and administered with configuration files, certificates, and systemd. Easy-RSA supplies the public-key infrastructure (PKI) used to authenticate the server and each client.
A working deployment has several independent parts:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- OpenVPN process: listens on the configured UDP or TCP port and creates a virtual tunnel interface such as
tun0. - PKI: a CA signs the server and client certificates. The server also needs its private key, Diffie-Hellman parameters, and a TLS control-channel key.
- Cloud firewall: the VPS provider’s security group or network firewall must permit the selected protocol and port.
- Ubuntu firewall: UFW, nftables, iptables, or another host firewall must allow the same traffic and the desired forwarding.
- Routing and NAT: IPv4 forwarding and packet-filter/NAT rules determine whether tunnel traffic can reach the internet or a private network and whether replies can return.
These controls are not interchangeable. Opening a provider firewall does not change Ubuntu’s firewall, and enabling forwarding does not create a NAT rule.
Community Edition or Access Server?
Choose the repository-based Community Edition when you are comfortable maintaining text configuration, certificates, firewall rules, and client files. Choose Access Server when a browser-based administrator interface and self-service client profile downloads are more valuable than a command-line workflow.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Area | Community Edition | OpenVPN Access Server |
|---|---|---|
| Administration | Files, certificates, shell commands, and systemd | Web Admin UI backed by the vendor’s installer/package workflow |
| Client onboarding | Assemble and securely distribute a CA certificate, client certificate, private key, TLS key, and configuration | Client UI can provide OpenVPN Connect and a preconfigured connection profile |
| Licensing | Ubuntu repository packages; no Access Server product license is involved | An unlicensed server permits two connections by default; licensing changes that limit |
| VPN subnet detail | You choose the tunnel network in the server configuration | The internal VPN subnet defaults to 172.27.224.0/20 and can be changed |
| Network prerequisites | Both require a reachable public address, matching firewall rules, and correct routing | |
Access Server is a separate product, not a graphical switch for Community Edition. Its installation and upgrades follow the vendor’s Ubuntu instructions, while the Community Edition steps below use Ubuntu packages and files.
Prerequisites and planning
Confirm the VPS and Ubuntu assumptions
- You need an Ubuntu Server release using
aptand systemd, a non-root administrative account withsudo, and enough storage for package files, logs, and the PKI. - Record the VPS public IPv4 address or a DNS hostname that resolves to it. Clients use this value in their
remotedirective. - Identify the VPS egress interface and public route with
ip route. You will need that interface when creating a NAT rule. - Pick a private tunnel subnet that does not overlap with the networks clients already use. The example below uses
10.8.0.0/24; replace it if that range conflicts with a home, office, or cloud network. - Decide whether the VPN will carry only selected private routes (split tunnel) or all client internet traffic (full tunnel). The latter requires forwarding, NAT, and a DNS plan.
Plan the port and protocol
Port 1194 is the official OpenVPN port, but the configuration may use another port. UDP is the usual choice for a VPN; TCP can be selected when the surrounding network only permits TCP. Whichever combination you choose must match the server configuration, the client profile, the provider firewall, and Ubuntu’s firewall.
Install OpenVPN and Easy-RSA
Refresh package metadata and install both packages:
sudo apt update
sudo apt install openvpn easy-rsaUbuntu’s package version depends on the Ubuntu release and its updates. For example, the Jammy manpage lists an OpenVPN package build as 2.5.11-0ubuntu0.22.04.5; do not assume that build number on another release. Check the installed version with:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →openvpn --versionKeep the package-managed files in place. Put your site-specific server configuration under /etc/openvpn and your protected key material in a root-owned directory.
Create a certificate authority and issue credentials
Easy-RSA creates a CA and signs certificates for the VPN server and each client. The CA private key is the most sensitive item in this deployment: after issuing the required certificates, remove the signing copy from the VPS and keep an encrypted offline backup. A client certificate alone is not enough to connect; the client also needs its matching private key and the CA certificate.
Initialize the PKI
Work in a private directory owned by your administrative account. The exact Easy-RSA directory supplied by Ubuntu can vary, so use the package’s easyrsa script and follow its displayed path. A typical sequence is:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
mkdir -p ~/openvpn-ca
cd ~/openvpn-ca
# Place or copy the Easy-RSA scripts here, then:
./easyrsa init-pki
./easyrsa build-cabuild-ca prompts for a CA passphrase and common name. Use a distinct CA name and a strong passphrase. Do not copy pki/private/ca.key into a client bundle or expose it through a web directory.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Issue the server certificate
Generate a server key and request, then sign it as a server certificate:
./easyrsa gen-req server nopass
./easyrsa sign-req server serverUsing nopass leaves the server key unencrypted so systemd can start unattended. Protect that file with root-only permissions instead; if you require an encrypted key, arrange a separate secret-unlock mechanism before enabling automatic boot.
Generate Diffie-Hellman material
./easyrsa gen-dhThe server configuration will reference the resulting dh.pem. This file is not a user credential, but it is required by configurations that use Diffie-Hellman parameters.
Issue one certificate per client
Give every device its own certificate and private key so that you can revoke one device without replacing every other profile:
./easyrsa gen-req game-laptop nopass
./easyrsa sign-req client game-laptopRepeat with a different name for every phone, laptop, or console-compatible client. Never reuse one client private key across people or devices.
Install server-side material
Create a directory readable only by root and copy the CA certificate, server certificate, server key, Diffie-Hellman file, and TLS key there:
sudo install -d -m 700 /etc/openvpn/pki
sudo install -m 644 pki/ca.crt /etc/openvpn/pki/ca.crt
sudo install -m 644 pki/issued/server.crt /etc/openvpn/pki/server.crt
sudo install -m 600 pki/private/server.key /etc/openvpn/pki/server.key
sudo install -m 644 pki/dh.pem /etc/openvpn/pki/dh.pemAdjust the source paths to your Easy-RSA directory. The server private key and any TLS key should not be world-readable.
Create a named server configuration
Ubuntu provides a sample configuration. Copy it to a name that will become the systemd instance name:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/myserver.confSome older Ubuntu releases ship the sample as a compressed .gz file. In that case, decompress it into /etc/openvpn/myserver.conf rather than copying the compressed file unchanged.
Edit the file and set the certificate paths, transport, port, tunnel network, and control-channel protection. A minimal set of directives looks like this:
port 1194
proto udp
dev tun
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/server.crt
key /etc/openvpn/pki/server.key
dh /etc/openvpn/pki/dh.pem
tls-crypt /etc/openvpn/pki/ta.key
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
keepalive 10 120
Retain the sample’s authentication and logging directives unless you have a reason to change them. If you select TCP, change proto udp to the TCP form and open the corresponding TCP port everywhere. If you choose a different tunnel subnet, use that same subnet in the server directive, client routes, and NAT rules.
Generate the TLS control-channel key
Generate the key on the VPS or another protected administration host:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemssudo openvpn --genkey secret ta.key
sudo install -m 600 ta.key /etc/openvpn/pki/ta.keyReference it with tls-crypt ta.key on the server and in every client profile. Ubuntu notes that releases older than 18.04 may require tls-auth ta.key 0 instead. Do not silently mix the two directives: the client and server must use compatible settings, and the client needs the same TLS key.
Open the port at every firewall layer
Provider security group or VPS firewall
In the VPS provider’s control panel, add an inbound rule for the selected protocol and port, restricted to appropriate source addresses when your users have stable addresses. For the default example, that is UDP port 1194. This rule is outside Ubuntu and must be checked separately.
Ubuntu host firewall
If UFW is enabled, allow SSH before changing anything else so you do not lock yourself out, then allow the VPN transport:
sudo ufw allow OpenSSH
sudo ufw allow 1194/udp
sudo ufw status verboseUse 1194/tcp if the server uses TCP. If you are using nftables, iptables, or a provider-specific firewall agent instead of UFW, create equivalent input and forwarding rules in that system. Do not enable a second firewall manager without understanding which one owns the rules.
Enable IPv4 forwarding and configure NAT
Enable forwarding persistently
Create the file specified by Ubuntu’s workflow:
sudo sh -c 'printf "net.ipv4.ip_forward = 1n" > /etc/sysctl.d/50-enable-ipv4-forwarding.conf'
sudo sysctl -p /etc/sysctl.d/50-enable-ipv4-forwarding.confConfirm the result:
sysctl net.ipv4.ip_forwardThe value should be 1. Forwarding only permits the kernel to route packets; it does not grant them permission through the firewall and does not rewrite private tunnel addresses for internet access.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Add a NAT rule for a full-tunnel internet VPN
For the example tunnel network, add masquerading on the VPS’s actual internet-facing interface. Replace eth0 with the interface shown by ip route:
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADEYou also need forwarding rules that allow traffic from the tunnel interface to the egress interface and established replies back to the tunnel. Express those rules in the firewall system you actually use, then persist them according to that system’s method; a command entered interactively may disappear at reboot. If your provider or host firewall has a default-deny forwarding policy, an allow rule is required even when the NAT rule is correct.
Recommended Free Tools
Route only a private network when full tunnel is not wanted
A split-tunnel server can push a route for a private destination instead of redirecting all client traffic. For example, a server configuration may contain:
push "route 192.168.1.0 255.255.255.0"The private network must have a return route to the VPN tunnel subnet, either through the VPN server or through an upstream router. If you do not control that router, NAT on the VPN server can hide the tunnel source, but it changes how the private network sees clients. Choose deliberately rather than adding a broad NAT rule by default.
Optional full-tunnel directive
To send client internet traffic through the VPS, a configuration commonly pushes:
push "redirect-gateway def1"That setting increases the importance of working NAT and DNS. Without them, the VPN may connect successfully while web traffic fails. A DNS resolver reachable through the tunnel must also be selected and pushed or configured on the client; the correct resolver depends on your network and is not supplied automatically by OpenVPN.
Start and enable the named OpenVPN instance
Because the file is named myserver.conf, the systemd instance is myserver. Start exactly that instance:
sudo systemctl start openvpn@myserver
sudo systemctl enable openvpn@myserver
sudo systemctl status openvpn@myserverUbuntu warns that systemctl start openvpn does not start the named configuration. The service name must match the filename without its .conf suffix. If the status is not active, inspect the journal:
sudo journalctl -u openvpn@myserver --no-pagerAfter a successful start, check that the tunnel interface exists:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
ip addr show tun0
ip routeThe exact interface name can differ if multiple OpenVPN instances are running. Look for the interface and route associated with 10.8.0.0/24.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build and distribute a client profile
Collect the required files
Each client needs:
- the CA certificate (
ca.crt); - that device’s client certificate;
- the matching client private key;
- the same TLS control-channel key used by the server; and
- a client configuration that names the VPS endpoint, port, protocol, and tunnel settings.
Transfer these files over an encrypted administrative channel, protect the client private key and TLS key with restrictive permissions, and remove temporary copies from shared folders and shell-history-friendly locations. Treat a client bundle as a credential: anyone who obtains the private key and required keys may be able to authenticate as that client until you revoke it.
Use a compatible OpenVPN client
On a Linux client, install the OpenVPN package or use a compatible graphical client. A basic profile has the following shape:
client
dev tun
proto udp
remote vpn.example.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
ca ca.crt
cert game-laptop.crt
key game-laptop.key
tls-crypt ta.key
Replace vpn.example.net, the protocol, and filenames with your deployment values. The remote-cert-tls server check helps ensure the peer presents a server certificate rather than a client certificate. Do not publish a profile containing a private key.
Connect and verify the client
Start the profile using the client’s normal import or command-line workflow. Confirm that the client receives an address from the tunnel subnet, that the route table contains the intended private or default routes, and that the public address changes only when full-tunnel routing and NAT are configured. A successful TLS handshake proves authentication and transport; it does not prove that every destination is reachable.
Troubleshoot by symptom
The client cannot contact the VPS
- Confirm the
remotehostname resolves to the VPS public address. - Check that the provider firewall allows the selected UDP or TCP port.
- Check Ubuntu’s firewall for the same protocol and port.
- Verify that the server is listening and that the named unit is active with
systemctl status openvpn@myserver. - Read
journalctl -u openvpn@myserverfor bind, certificate, or protocol errors.
The client connects, but there is no internet access
- Confirm
net.ipv4.ip_forwardis1. - Confirm the firewall permits forwarding from the tunnel interface to the VPS egress interface and permits established return traffic.
- Confirm a MASQUERADE or equivalent NAT rule covers the actual tunnel subnet and actual egress interface.
- Check whether the profile pushes
redirect-gateway def1and whether the client has a working DNS resolver through the tunnel.
The client reaches the VPS but not another private network
- Verify the client has a route for the destination network.
- Check that the VPN server can reach that network itself.
- Add a return route on the private network’s router pointing the tunnel subnet to the VPN server, or use narrowly scoped NAT if you cannot add a route.
- Check forwarding rules on both interfaces and ensure the destination network does not overlap the client’s local LAN.
The service fails immediately
- Check every certificate and key path in
myserver.conf. - Confirm that the server certificate, CA, Diffie-Hellman file, and TLS key exist and are readable by the OpenVPN service.
- Check for a protocol or port conflict with another service.
- On older Ubuntu releases, verify whether the configuration expects
tls-auth ta.key 0rather thantls-crypt ta.key.
The TLS handshake reports certificate errors
Make sure the client certificate was signed by the CA named in the server configuration, the client is using its matching private key, and the server certificate has the expected server usage. Do not solve a mismatch by deleting certificate verification directives; issue a correctly signed certificate instead.
Operating the VPN safely
Protect and back up the CA
Keep the CA private key offline after issuing credentials. Back up the CA, configuration choices, and revocation information in encrypted storage. The server’s private key, client private keys, and TLS key should have the narrowest practical permissions. If a device is lost, revoke its certificate and issue a replacement rather than sharing another device’s key.
Keep the exposure narrow
Expose only the selected VPN port and administration access you actually need. Restrict the provider firewall’s source ranges when feasible, keep Ubuntu packages updated, and review logs for repeated failed handshakes. Changing the port is not a security substitute for certificate validation and firewall policy; it simply changes where clients connect.
When Access Server is the better workflow
Access Server follows a vendor package or installer workflow rather than the Ubuntu Community Edition file layout. After installation, you configure a public IP address or DNS hostname and use its browser-based Admin UI. The Client UI lets users download OpenVPN Connect and a preconfigured profile, avoiding manual assembly of certificate files for every user.
An unlicensed Access Server allows two connections by default. Additional capacity requires the applicable product licensing, so check the current terms before deploying it for a larger group. Access Server’s internal VPN subnet starts at 172.27.224.0/20 and can be changed when it conflicts with an existing network.
The same network fundamentals still apply: the VPS provider must expose the listening port, Ubuntu must permit it, and forwarding, NAT, and return routes must match the access policy. A web UI simplifies administration; it does not repair an incorrect cloud firewall or an overlapping route.
Quick Recap
Final checklist
openvpnandeasy-rsaare installed from Ubuntu repositories.- A CA has issued separate server and client certificates, and the CA private key is stored offline.
myserver.confreferences the CA, server certificate, server key, Diffie-Hellman file, and compatible TLS key.- The provider firewall and Ubuntu firewall allow the selected protocol and port.
- IPv4 forwarding is enabled persistently.
- Forwarding and NAT or return routes match your split-tunnel or full-tunnel design.
openvpn@myserveris active and enabled at boot.- The client profile uses the correct endpoint, port, certificates, private key, and TLS-key directive.
- You have checked the service journal, tunnel interface, routes, and destination reachability rather than relying only on a “connected” message.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
