To run your own OpenVPN server, provision a Linux VPS with a reachable public address, install OpenVPN and Easy-RSA, create a certificate authority (CA), issue separate certificates for the server and every client device, then enable the forwarding and firewall rules that match your traffic policy. A TLS connection alone is not enough: routing, NAT, DNS and both layers of firewalling must also be correct.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
What you need before installing anything
This guide describes a routed OpenVPN deployment on a Linux VPS. It is suitable for securely reaching private services, connecting to a game server network, or sending all client traffic through the VPS. Commands use Debian/Ubuntu-style packaging and systemd names as examples; package names, service-unit names and firewall syntax vary by distribution.
As an Amazon Associate I earn from qualifying purchases.
- A supported Linux VPS with a public IPv4 or IPv6 address. If the VPS is behind another gateway, that gateway must forward the OpenVPN listener port to the VPS.
- Administrative access through a trusted SSH key and, where possible, an allowlist of trusted source addresses.
- Permission to change the VPS provider’s cloud firewall and the operating system firewall.
- A plan for the traffic you actually want: full-tunnel internet access, selected private subnets, or VPN-only access to services.
- A secure place to create and back up the CA private key. The CA key is more sensitive than any individual client key.
Record the VPS public address, its main outbound interface and the Linux distribution version. Synchronize time with the distribution’s time service before creating certificates; certificate validity checks depend on sensible clocks.
Choose the OpenVPN operating model
| Option | Administration | Identity and lifecycle | Routing and firewall control | Cost and footprint |
|---|---|---|---|---|
| OpenVPN Community packages | Manual configuration, service files and command-line tools | You build the CA workflow, issue certificates and publish revocation data | Direct control of server configuration, routes, NAT and host firewall | Uses the distribution’s packages; no separate management appliance is required |
| OpenVPN Access Server | Supported management interface and guided administration | Management UI assists with users and profiles | Still requires deliberate network and firewall design; some low-level choices are abstracted | Separate server product with its own licensing terms and installation footprint |
Use the Community packages when you want transparent, scriptable control and are comfortable maintaining the PKI. Choose Access Server when a supported administrative interface and centralized user workflow matter more than hand-editing every setting. Either model still needs a reachable listener, correct cloud and host firewall rules, and a clear routing policy.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Build the public network and firewall path
1. Confirm reachability
The client must be able to reach the VPS address and selected OpenVPN port from the networks where it will connect. A conventional routed profile uses UDP port 1194. If you select another port or TCP instead, use that choice consistently in the provider firewall, host firewall, server configuration and every client profile.
Permit inbound traffic to the listener in the VPS provider’s security group or cloud firewall. Restrict the source range when you know where clients originate; otherwise, the listener cannot be reached from roaming networks. Also allow the established and related return traffic required by your provider’s firewall model.
Recommended Free Tools
2. Open the operating-system firewall
Allow the same transport and port in the VPS firewall. With a UFW-managed host, an example rule is:
sudo ufw allow 1194/udp
sudo ufw enable
sudo ufw status verboseFor nftables, firewalld or another firewall, create the equivalent rule. Do not lock yourself out of SSH while enabling a firewall: add the SSH rule first, test a second administrative session, and only then apply the remaining policy.
3. Identify the outbound interface
NAT rules must name the interface that carries internet-bound traffic. Ask the kernel which interface it would use:
ip route get 1.1.1.1Use the interface shown by that command (for example, ens3) instead of assuming that it is eth0. If your provider uses a different topology for IPv6, configure and test IPv6 forwarding separately rather than assuming an IPv4 NAT rule covers it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsInstall OpenVPN and Easy-RSA
Update the operating system before installing VPN software:
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
sudo apt update
sudo apt full-upgrade
sudo apt install openvpn easy-rsaOn another distribution, use its supported OpenVPN and Easy-RSA packages. Avoid downloading an unrelated third-party installer when the distribution supplies maintained packages; package paths and service integration are then easier to audit and update.
Create a certificate authority and issue credentials
OpenVPN’s trust model is certificate based. One CA signs the server certificate and each client certificate. During connection setup, the server authenticates the client certificate and the client authenticates the server certificate. The CA certificate may be distributed to clients; the CA private key must not be.
Use a separate CA environment when practical
Easy-RSA 3 separates CA operations from the running VPN host. The safest arrangement is to initialize and use the CA on an offline or tightly protected administration system, then copy only the signed material needed by the server and each client. If you temporarily create the CA on the VPS, move the CA private key off the server and remove it from the live host after signing.
Initialize the PKI
On the protected CA system, create a working directory and initialize Easy-RSA:
mkdir -p ~/easy-rsa
cp -r /usr/share/easy-rsa/* ~/easy-rsa/
cd ~/easy-rsa
./easyrsa init-pki
./easyrsa build-cabuild-ca prompts for a CA name and a password for the private key. Keep the resulting pki/private/ca.key offline and encrypted in your backup process. Anyone who can use that key can issue a credential trusted by this deployment.
Generate and sign the server certificate
cd ~/easy-rsa
./easyrsa gen-req server
./easyrsa sign-req server server
./easyrsa gen-dhThe first command creates the server key and request; the second signs it with the CA. The third creates Diffie-Hellman parameters for configurations that require them. Newer OpenVPN versions may use a current equivalent instead, so follow the parameter requirements of the installed version.
Issue one client identity per device
Give every phone, laptop, console-side gateway or other device its own certificate and private key:
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
./easyrsa gen-req laptop-01
./easyrsa sign-req client laptop-01
./easyrsa gen-req laptop-02
./easyrsa sign-req client laptop-02Do not reuse a client key among family members, teammates or devices. A unique identity lets you revoke one lost or offboarded device without disrupting the rest of the deployment.
Move only the required files
Copy the following to the VPS’s protected OpenVPN directory:
- The CA certificate, commonly
ca.crt. - The signed server certificate, commonly
server.crt. - The server private key, commonly
server.key. - DH parameters or the equivalent cryptographic parameter file required by your OpenVPN version.
- The server configuration file.
Keep ca.key, client private keys and unused signing material off the running server whenever possible. Set ownership and permissions so only the account that starts OpenVPN can read server private-key files.
Write the routed server configuration
Start from the sample configuration installed by your distribution. A conventional IPv4 routed profile looks like this:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
port 1194
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh /etc/openvpn/server/dh.pem
server 10.8.0.0 255.255.255.0
keepalive 10 120
persist-key
persist-tun
user nobody
group nobody
verb 3The dev tun directive creates a routed layer-3 tunnel. The server 10.8.0.0 255.255.255.0 line allocates virtual addresses from a private tunnel subnet. Every client profile must use the same dev and proto choices and point to the server’s public address and port.
The exact unprivileged group name differs by operating system; some systems provide nobody, while others use a separate group such as nogroup. Use an account and group that exist on your VPS and are supported by the installed OpenVPN version. After dropping privileges, verify that OpenVPN can still read its key files and write any configured log or status files.
Full-tunnel versus split-tunnel routing
For full-tunnel internet access, add a redirect route and DNS settings appropriate to your clients:
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
push "redirect-gateway def1 bypass-dhcp"
# Add a reachable DNS server or your own VPN DNS service here.This sends client internet traffic through the VPS. It does not, by itself, provide internet access: forwarding, NAT and egress firewall rules must also be enabled.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →For a split tunnel, omit the redirect and push only the private networks that should traverse the VPN. A private game-server LAN, for example, can be routed without forcing ordinary web traffic through the VPS. Use routes that do not overlap the client’s local network; overlapping address spaces cause ambiguous routing.
Enable forwarding and NAT
Turn on IPv4 forwarding
Enable forwarding immediately for the current boot and persist it:
sudo sysctl -w net.ipv4.ip_forward=1
printf 'net.ipv4.ip_forward=1n' | sudo tee /etc/sysctl.d/99-openvpn-forward.conf
sudo sysctl --systemIf you deliberately deploy IPv6 through the VPN, configure IPv6 forwarding and firewall policy as a separate, tested design. Do not advertise IPv6 routes to clients until the VPS can forward and protect them correctly.
Free tools Windows power users keep installed
One-click scans. No signup required.
Add forwarding and masquerading rules
For a full-tunnel IPv4 deployment, permit traffic from the tunnel interface to the outbound interface and masquerade the tunnel subnet. With iptables, a representative policy is:
sudo iptables -A FORWARD -i tun0 -o ens3 -s 10.8.0.0/24 -j ACCEPT
sudo iptables -A FORWARD -i ens3 -o tun0 -d 10.8.0.0/24 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens3 -j MASQUERADEReplace ens3 with the interface discovered earlier. Persist these rules using the firewall system supported by your distribution; rules entered interactively may disappear at reboot. If your policy is VPN-only access to private networks, use narrowly scoped forwarding rules and do not add a broad internet masquerade rule.
Cloud firewalls can still block forwarded or egress traffic even when host rules look correct. Check both layers whenever a client receives a VPN address but cannot reach its destination.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Start the service and validate it in layers
Start through the service manager
On distributions using the common templated systemd unit, the configuration server.conf is started as follows:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutesudo systemctl enable --now openvpn-server@server
sudo systemctl status openvpn-server@server
sudo journalctl -u openvpn-server@server -eIf your distribution uses a different unit name, list the installed OpenVPN units and use the one that corresponds to your configuration. A failed start is usually explained by a certificate path, key permission, unsupported directive or missing parameter file in the journal.
Test from the outside inward
- Listener: verify that the VPS is listening on the selected UDP or TCP port and that the cloud and host firewalls allow it.
- TLS handshake: import one client profile and confirm that the server accepts the certificate chain. A successful handshake proves identity exchange, not internet forwarding.
- Tunnel address: check that the client receives an address from
10.8.0.0/24(or your chosen subnet) and that the server has a correspondingtun0interface. - Private routes: test the specific private subnet or service you intended to expose.
- Internet egress: only for a full-tunnel design, test an external address and DNS resolution. Failure here points to forwarding, NAT, pushed routes, DNS or egress policy rather than certificate trust.
Keep the client and server clocks synchronized. A clock that is far in the past or future can make otherwise correct certificates appear not yet valid or expired.
Build a client profile safely
Each device receives a profile matching the server’s transport and tunnel mode. A minimal profile has this shape:
client
dev tun
proto udp
remote vpn.example.net 1194
nobind
persist-key
persist-tun
<ca>
...contents of ca.crt...
</ca>
<cert>
...contents of this device's certificate...
</cert>
<key>
...private key for this device...
</key>Replace the hostname with the VPS public DNS name or address. The remote port and proto must exactly match the server. Embedding certificates is convenient for a single-file profile, but treat the resulting file as a secret because it contains the device’s private key. Transfer it through a protected channel and remove it when no longer needed.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The CA certificate is shared across profiles; the client certificate and private key are not. Label files by device rather than by person alone so you can identify and revoke a lost laptop without guessing which credential was used.
Revoke a client and offboard a device
Deleting a profile from a device does not invalidate its certificate. Revoke the certificate in the CA environment, generate an updated certificate-revocation list (CRL), and configure the server to use the current CRL according to your installed OpenVPN version.
cd ~/easy-rsa
./easyrsa revoke laptop-01
./easyrsa gen-crlPublish the resulting CRL to the server’s protected configuration directory, set the server’s CRL directive as required by your version, and restart or reload the service. Then remove the old profile from the device and any backup locations. Keep the CA database and revocation records protected so future issuance and audits remain reliable.
Troubleshoot the failures that look alike
| Symptom | Likely causes | Checks and fixes |
|---|---|---|
| No connection attempt reaches the server | Wrong public address, blocked cloud firewall, blocked host firewall, incorrect port or protocol, missing upstream port forward | Confirm the listener address, port and protocol in every layer; inspect provider rules and, if applicable, forward the port on the upstream gateway. |
| TLS or certificate error | Wrong file path, mismatched CA, wrong client certificate, expired or revoked credential, incorrect system clock | Read the service journal, compare the CA and certificate files, verify validity dates and synchronize clocks. Issue a new client identity when appropriate. |
| Client connects but has no private-subnet access | Missing pushed route, overlapping local subnet, forwarding rule absent, destination firewall blocks the VPN subnet | Inspect the client’s route table, confirm the server’s tunnel subnet, add the intended route and permit traffic on the destination network. |
| Client connects but internet access fails | Redirect route not pushed, IP forwarding disabled, NAT uses the wrong interface, egress firewall blocks traffic, DNS not provided | Check the pushed routes, net.ipv4.ip_forward, the actual outbound interface, masquerade rule and DNS settings. Test an IP address before testing a hostname. |
| Service fails after adding privilege reduction | The selected user/group cannot read keys or write logs and status files | Use an existing unprivileged account supported by the OS, adjust ownership and permissions, then restart and inspect the journal. |
Change one layer at a time. Replacing client settings after a failed handshake will not repair a missing NAT rule, and adding NAT will not repair an invalid certificate.
Operational security checklist
- Keep the VPS operating system and OpenVPN packages updated through the distribution’s supported mechanism.
- Restrict SSH to trusted keys and source addresses; do not expose password-only administration.
- Store the CA private key offline, encrypted and with protected backups. Never leave it on the running VPN host when an offline workflow is practical.
- Issue one client certificate/key pair per device, maintain an inventory, and revoke credentials during offboarding.
- Use the least-privilege OpenVPN account supported by your operating system and verify file permissions after every configuration change.
- Document the tunnel subnet, listener port, cloud firewall rules, host firewall policy, forwarding rules and intended private routes.
- Test certificate handshake, tunnel addressing, private services and full-tunnel egress separately after upgrades or firewall changes.
What a successful deployment looks like
A working installation has a reachable listener, a server certificate signed by the protected CA, a unique signed certificate for every device, and a tun interface assigning addresses from the configured virtual subnet. The cloud firewall and host firewall permit the selected transport, Linux forwarding is enabled, and NAT exists only when your policy requires internet egress. Clients can then reach exactly the private networks or external destinations you intentionally route, while revoked profiles no longer authenticate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
