Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsUse a routed, site-to-site OpenVPN tunnel: run OpenVPN on one VPS or gateway, enroll the other VPS with its own client certificate, assign a dedicated non-overlapping tunnel subnet, and install reciprocal routes for the private networks that must communicate. Enable forwarding, allow only the VPN listener and required application flows in every firewall, then test both directions from the actual service hosts.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
What this design does
A site-to-site VPN joins separate private networks across an encrypted tunnel. OpenVPN describes it as connecting two or more private networks over a secure, encrypted tunnel. In a two-VPS deployment, one machine is the OpenVPN server and gateway; the other is an OpenVPN client. Traffic destined for the peer’s private address or service network enters the tunnel instead of traversing the public internet in clear text.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
The tunnel protects traffic in transit, but it does not automatically make every service reachable. Routing, cloud security groups, host firewalls, application bind addresses, and return paths must all agree. A successful TLS handshake proves only that the OpenVPN peers authenticated; it does not prove that a database, game service, or administrative port can pass through the tunnel.
Choose the topology before installing anything
Direct VPS-to-VPS endpoint
Install the server on VPS A and the client on VPS B when only those machines need to communicate. Add host routes for the required private addresses, or route a small private subnet if each VPS hosts several services. This is the simplest arrangement and gives you control over both endpoints.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Gateway for an entire private segment
Place OpenVPN on a router or gateway when several hosts behind either side must communicate. The gateway must forward packets between its LAN interface and the VPN interface, and every participating LAN needs a route back to the remote network. This avoids installing OpenVPN on every host but introduces another device, another firewall policy, and potentially a failover requirement.
| Endpoint choice | Best fit | Operational consequence |
|---|---|---|
| VPS as endpoint | Only the two VPSs, or a few explicitly routed hosts | Fewer moving parts; routes and firewall rules are maintained on the servers. |
| Router or gateway | An entire private subnet on one or both sides | Centralized policy and broader coverage, but forwarding, LAN return routes, and gateway availability become critical. |
Plan addresses and trust boundaries
Write down the public address of each VPS, each private or service subnet, the default gateway, and the exact ports that must cross the tunnel. Select a tunnel CIDR that overlaps none of those networks and none of the networks reachable from either side. Overlap causes the kernel to choose the wrong interface and is one of the most common reasons a tunnel appears up while applications fail.
| Purpose | Illustrative network | How to use it |
|---|---|---|
| VPN tunnel | 172.16.0.0/20 | OpenVPN assigns addresses to the tunnel interfaces. This is an example, not a default. |
| Site A private network | 192.168.70.0/24 | Replace with the real network behind the OpenVPN server or gateway. |
| Site B private network | 10.0.60.0/24 | Replace with the real network behind the client or its gateway. |
The example ranges are taken from OpenVPN’s site-to-site material and are illustrative only. If a provider already uses one of them internally, choose different ranges before deploying. For a single host, a /32 route to that host is safer than advertising an unnecessarily large subnet.
Define the trust boundary explicitly. Decide whether the client may reach every address on the server side or only selected service IPs, and list each TCP or UDP port. Treat the VPN interface as a new network zone rather than as a trusted extension of the public interface.
Routed mode versus NAT mode
| Decision point | Routed mode | NAT mode |
|---|---|---|
| Return-route control | Requires a route back to the remote tunnel or private subnet on each side, either on the host or its upstream router. | Rewrites the source address so the destination can reply through the translating gateway when a return route cannot be added. |
| Source-address visibility | Preserves the original host address, which improves logging, auditing, and per-host firewall rules. | Destination sees the gateway’s translated address; original source identity is hidden unless it is carried separately. |
| Session initiation | Both sides can initiate connections when reciprocal routes and firewall rules exist. | Works well for traffic initiated from the translated side, but policy and return behavior become less transparent. |
| When to choose it | Use this as the normal site-to-site design when you control both routing domains. | Use it as a fallback when an upstream router cannot accept a route or when a temporary one-way reachability solution is required. |
Routed mode is usually preferable for server-to-server traffic because logs retain the real peer address. NAT is not a security substitute: you still need restrictive forwarding rules, and the tunnel itself still requires certificate authentication and firewall protection.
UDP or TCP transport
OpenVPN supports both UDP and TCP. Start with UDP when the network permits it; it avoids adding a second reliable-transport layer around the application and normally has less overhead. Select TCP when a provider firewall or an intermediate network blocks the chosen UDP port and permits a reachable TCP listener instead. TCP can be easier to pass through restrictive networks, but nested retransmission and congestion control can increase latency and make loss recovery less predictable for latency-sensitive services.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
The transport choice does not change the routing design. Whichever protocol you use, permit the selected listener port in the VPS provider’s security group and on the host firewall, and set the same protocol and port in both OpenVPN configurations. Do not expose administrative services merely because the VPN listener is public.
Prerequisites and certificate identity
- Administrative access to both VPSs or to the gateways that will route their private networks.
- A current OpenVPN package for the operating systems you run, with its service manager and sample configuration available.
- A certificate authority (CA), one server certificate and private key, and one distinct client certificate and private key.
- A dedicated tunnel subnet that does not overlap any local, remote, or provider-managed network.
- Permission to edit provider security-group rules and host firewall rules.
Use TLS mode with mutual certificate authentication. The CA signs separate server and client certificates; the server verifies the client certificate and the client verifies the server certificate. Keep the CA private key off the public VPS whenever your operating procedure allows it. Protect each private key, restrict file permissions, and define a process for certificate rotation and revocation before you issue additional clients.
Example PKI workflow
Easy-RSA is one common way to create the PKI. Package paths and command names can differ, so use the version supplied by your distribution and keep the CA key in a protected administration environment.
./easyrsa init-pki
./easyrsa build-ca
./easyrsa gen-req vpn-server
./easyrsa sign-req server vpn-server
./easyrsa gen-req vps-peer
./easyrsa sign-req client vps-peer
openvpn --genkey tls-crypt ta.keyThe request commands prompt for key protection according to the Easy-RSA version. A service that must start unattended needs a deliberate private-key handling policy; an unencrypted key reduces startup friction but increases the impact of file theft. Copy only the certificates, the relevant private key, the CA certificate, and the TLS protection key to the machine that needs them. Never copy the CA’s signing key to both VPSs.
Install and configure the OpenVPN server
1. Install the package and create the service identity
Install OpenVPN and your chosen PKI tools from the operating system’s signed repositories. Place the server certificate, server key, CA certificate, and TLS protection key in the directory expected by the service. Set ownership and permissions so the OpenVPN service account can read only what it needs; the private key should not be world-readable.
2. Create a routed server configuration
The following is a deliberately small template. Replace paths, the listener port, and the tunnel range with your values, and merge it with the current sample configuration shipped by your package.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
port 1194
proto udp
dev tun
topology subnet
server 172.16.0.0 255.255.240.0
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/vpn-server.crt
key /etc/openvpn/pki/vpn-server.key
tls-crypt /etc/openvpn/pki/ta.key
keepalive 10 60
persist-key
persist-tun
user nobody
group nogroup
verb 3The server directive allocates tunnel addresses; it does not advertise your private service networks by itself. Add a route for the client-side network on the server and push a route for the server-side network to the client, or install equivalent static routes in the operating system. For the illustrative networks, the relevant directives would be:
route 10.0.60.0 255.255.255.0
push "route 192.168.70.0 255.255.255.0"If only one remote host is needed, use its host route instead of a whole /24. Confirm the route is appropriate for your topology; a route directive cannot repair a missing route on a separate LAN router.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Start the service and inspect its log
Enable and start the OpenVPN instance using your distribution’s service manager. Check the journal or service log for certificate errors, permission failures, an occupied port, and the assigned tunnel address. Do not treat a process that is merely listening as proof that the peer can route traffic.
Configure the peer VPS as an OpenVPN client
Install the client package and copy only the peer’s certificate and key, the CA certificate, and the TLS protection key. A client template can look like this:
client
dev tun
proto udp
remote PUBLIC_ADDRESS_OF_SERVER 1194
nobind
persist-key
persist-tun
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/vps-peer.crt
key /etc/openvpn/pki/vps-peer.key
tls-crypt /etc/openvpn/pki/ta.key
remote-cert-tls server
verb 3Replace the public address and port, and use the current package’s recommended data-channel settings rather than copying obsolete cipher directives from an old blog post. The client should receive a route to the server-side private network from the server configuration. If you do not push routes, add explicit operating-system routes on the client.
Start the client and verify that its tunnel interface receives an address from the dedicated VPN range. The server log should identify the client certificate subject, not just an anonymous connection. If certificate authentication fails, check the CA chain, certificate usage type, system time, file permissions, and whether the client certificate has been revoked.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Enable forwarding and install reciprocal routes
Enable IPv4 forwarding on every gateway
On a Linux gateway, enable forwarding immediately for testing and persist it for reboots:
sudo sysctl -w net.ipv4.ip_forward=1
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-openvpn-forward.conf
sudo sysctl --systemApply the equivalent forwarding setting on a non-Linux router. If the VPN endpoint is also the destination host, forwarding may not be needed for traffic terminating locally, but it is still required when the endpoint routes for another machine.
Add the route on both sides
In routed mode, Site A needs a route to Site B’s network through the VPN interface, and Site B needs a route back to Site A’s network. The route can live on each VPS, on an internal router, or be delivered through OpenVPN where appropriate. Confirm the route’s next hop and interface with your operating system’s route tools; never assume that an address on the public interface can reach the peer’s private subnet.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →For a direct two-host design, route only the peer’s service address or a narrowly scoped subnet. For a gateway design, place the route on the LAN’s upstream router as well as on the VPN gateway, otherwise replies may leave through the ordinary default gateway and never return through the tunnel.
Apply least-privilege firewall rules
Provider security group and host firewall
Allow the selected OpenVPN UDP or TCP listener from the peer’s public address, or from a tightly controlled set of administration addresses if the peer’s address changes. Permit forwarding between the VPN interface and only the listed private destinations and application ports. Keep SSH and other management services limited to trusted source addresses; do not open them to the entire tunnel subnet by default.
Forwarding policy example
On a Linux gateway using iptables, the policy can be expressed with rules like these. Replace the addresses and ports, and add equivalent rules in nftables or your firewall manager if that is what your distribution uses:
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
iptables -A FORWARD -i tun0 -s 172.16.0.0/20 -d 192.168.70.0/24 -p tcp --dport 5432 -j ACCEPT
iptables -A FORWARD -i eth0 -s 192.168.70.0/24 -d 172.16.0.0/20 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -s 172.16.0.0/20 -d 192.168.70.0/24 -j DROPThe final drop illustrates a deny-by-default approach; order matters, and your existing policy may already provide a default drop. Permit the exact service ports required by your application rather than allowing all protocols between the subnets. Also allow the return direction for established connections.
When NAT is unavoidable
If an upstream network cannot accept a route back to the tunnel, translate traffic on the gateway as a fallback:
iptables -t nat -A POSTROUTING -s 10.0.60.0/24 -d 192.168.70.0/24 -o tun0 -j MASQUERADEUse NAT only for the traffic that needs it. Document that the destination will see the gateway’s translated address, which affects audit logs, host-based access rules, and troubleshooting. A later routing change can let you remove NAT and restore end-to-end source visibility.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validate the tunnel and the real service
- Check the interface: inspect the tunnel interface and confirm both peers have addresses in the dedicated VPN subnet.
- Check the route: use your operating system’s route lookup for the peer’s tunnel address and for the actual service address. The result should select the VPN interface, not the public default route.
- Test the endpoint in both directions: ping the remote tunnel address from each VPS if ICMP is permitted. If ICMP is blocked, use a controlled TCP or UDP test that matches the application.
- Test the service from the real source host: connect to the database, game backend, web API, or other required port using its private address. A test from the VPN gateway itself can miss a missing LAN route.
- Confirm return traffic: inspect connection counters and logs on both firewalls. A packet arriving at the destination with no reply usually indicates a missing return route or a destination firewall rule.
- Capture packets when needed: run
tcpdump -ni tun0on the VPN endpoint and a second capture on the destination interface at the same time. Compare source and destination addresses, SYN/SYN-ACK or request/reply pairs, and whether packets disappear between interfaces.
ICMP must be allowed for ping to be meaningful. A failed ping does not prove that every TCP or UDP service is unavailable, and a successful ping does not prove that the application port is allowed.
Troubleshoot by following the packet path
| Symptom | Most likely boundary | What to check |
|---|---|---|
| The client cannot establish TLS | Public reachability or identity | Provider security group, host firewall listener rule, matching protocol and port, certificate chain, key permissions, system time, and revoked or expired certificates. |
| Tunnel is up, but peer tunnel address does not answer | VPN interface or local firewall | Assigned addresses, tunnel-interface rules, ICMP policy, and whether a local firewall blocks the VPN subnet. |
| Tunnel addresses work, private service does not | Routing or forwarding | Route lookup on both hosts, IP forwarding on gateways, OpenVPN route or push directives, and the destination’s bind address. |
| Packets arrive but replies never return | Return path | Static route on the destination or upstream router, NAT decision, and egress firewall counters. |
| Only one application port fails | Least-privilege filtering | Provider security group, host firewall, service listener, protocol (TCP versus UDP), and the application’s own allowlist. |
| Connections work intermittently | Overlapping or asymmetric networks | Duplicate CIDRs, multiple default routes, changing provider addresses, MTU symptoms, and whether both directions use the same tunnel. |
Capture simultaneously at the OpenVPN endpoint, the gateway’s LAN interface, and the destination host. If a packet appears on the tunnel but not on the LAN interface, inspect forwarding and firewall rules. If it reaches the destination but no reply appears, inspect the destination firewall and its route back to the source. If the reply takes the public default route, add a reciprocal route or use narrowly scoped NAT.
Harden the deployment after it works
- Keep the CA signing key offline or in a restricted administration system; store only the necessary certificates and keys on each VPS.
- Use a distinct client certificate for each VPS or gateway so one compromised key can be revoked without replacing every peer.
- Rotate certificates and revoke lost or retired identities through your PKI process. Removing a client configuration file alone does not invalidate its certificate.
- Restrict the public listener to the required protocol and port, and restrict management access separately from tunnel access.
- Use explicit source, destination, and port rules on the VPN interface. Avoid an unrestricted allow rule for the entire tunnel subnet.
- Keep OpenVPN and the operating system patched, and review the package’s current TLS and data-channel recommendations instead of pinning deprecated algorithms.
- Record the address plan, route ownership, firewall intent, certificate subjects, and recovery steps. A second administrator should be able to revoke a client and restore the tunnel without guessing.
- Monitor connection logs and route changes. A tunnel that reconnects successfully can still fail application traffic if a provider firewall or upstream route changed.
Operational choices that affect reliability
Changing public addresses
If the server VPS public address can change, use a stable name where your OpenVPN client configuration supports it and ensure the provider firewall is updated. Keep the tunnel listener restricted; a name that resolves broadly is not a reason to open the port to the world.
Failover
A single VPS-hosted endpoint is a single point of failure. If the private service is critical, design a second gateway, a certificate and route strategy for failover, and a way to move or advertise the tunnel endpoint. Do not add a second tunnel without planning route metrics and firewall state; otherwise both paths may create asymmetric traffic.
MTU and fragmentation
OpenVPN adds encapsulation overhead. If the tunnel connects but larger requests stall while small probes work, inspect path-MTU behavior and the provider’s interface limits. Adjust tunnel or TCP settings only after capturing packets and confirming fragmentation or packet-size symptoms; changing values blindly can hide the real routing or firewall error.
Deployment checklist
- Every tunnel, private, and provider-managed subnet is distinct and non-overlapping.
- The server and client use separate certificates signed by the same protected CA.
- The provider security group and host firewall allow only the selected listener and required flows.
- IP forwarding is enabled on every gateway that carries traffic between interfaces.
- Both sides have reciprocal routes, or the chosen NAT rule is narrowly scoped and documented.
- Firewall rules allow the exact application ports and their established return traffic.
- Tests cover tunnel addresses and the real service from both directions.
- Packet captures and logs identify the first hop where a failed flow disappears.
- Certificate revocation, key protection, patching, monitoring, and endpoint recovery are assigned to an owner.
Conclusion
A secure VPS-to-VPS OpenVPN deployment is a combination of four controls: mutually authenticated TLS certificates, a non-overlapping tunnel network, correct forwarding and reciprocal routes, and least-privilege filtering at the provider, host, and application layers. Routed mode should be the default when you control both return paths because it preserves source addresses and lets either side initiate sessions. Choose NAT only when route control is genuinely unavailable, and validate every change by tracing packets from the originating service to the destination and back.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
