Run the OpenVPN server in a Docker container on your Linux VPS, persist its configuration in /etc/openvpn, and publish UDP port 1194 to the host. The setup has three separate initialization phases: generate the server configuration, create the certificate authority (CA), and issue individual client certificates. Every client then receives its own exported .ovpn profile.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This guide follows the documented workflow for the kylemanna/openvpn image, using current docker compose syntax. Confirm the image’s current release tag and documentation immediately before deployment; tags, repository behavior and Compose conventions can change.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What you need before starting
Use a Linux VPS with a publicly reachable IPv4 address, or a DNS name that resolves to that address. You also need Docker Engine and the Docker Compose plugin installed. The VPS firewall and any upstream firewall must allow inbound UDP traffic on port 1194, which is the port used by the example configuration.
- Root or equivalent administrative access to the VPS.
- A public IP address or DNS name for clients to connect to.
- Docker Engine with the
docker composesubcommand. - Permission to create files and directories in your working directory.
- A secure place to store the CA passphrase and the generated client profiles.
The project documentation does not establish a universal minimum RAM or CPU requirement. Do not treat unverified small-VPS figures as a supported baseline; size the server for the number of concurrent users, encryption workload and other services you intend to run.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
How the containerized layout works
Docker runs the OpenVPN process, while a bind-mounted directory on the VPS stores the server configuration, CA, certificates and keys. The container needs the Linux NET_ADMIN capability because OpenVPN creates and manages tunnel networking. Port 1194/UDP is mapped from the VPS into the container.
| Compose setting | Purpose |
|---|---|
image |
Defines the OpenVPN container image. Pin this to a specific release tag that you have verified in the project’s current documentation. |
cap_add: NET_ADMIN |
Allows the process to perform the network-administration operations required for a VPN tunnel. |
ports: 1194:1194/udp |
Publishes the host’s UDP 1194 to the container’s UDP 1194. |
volumes |
Keeps /etc/openvpn outside the container lifecycle so recreating the container does not erase the PKI and server configuration. |
1. Prepare the VPS and firewall
Install Docker
Install Docker Engine and the Compose plugin using the procedure for your Linux distribution. Verify both commands before continuing:
Free tools Windows power users keep installed
One-click scans. No signup required.
docker --version
docker compose versionThe commands in this article use the modern form, docker compose. Older examples may use the separate legacy executable, docker-compose, and a top-level version: '2' field. Current Compose does not require that version field.
Open UDP 1194
Allow inbound UDP 1194 in the VPS provider’s network firewall and in the operating system firewall. Firewall syntax differs by distribution, so use the commands documented for your system. For a UFW-based host, a rule such as ufw allow 1194/udp is an example, not a universal requirement. Confirm that the rule is applied to the correct network interface and that no provider-level security group blocks the packet.
Choose the endpoint name
Use the VPS public IP when you do not have DNS, or use a DNS name whose A record points to that IP. The value passed to ovpn_genconfig becomes the server endpoint embedded in client profiles. If the address changes later, existing profiles will still contain the old endpoint and must be regenerated or edited.
2. Create the Compose project
Create a dedicated directory and a persistent configuration directory:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
mkdir -p ~/openvpn-compose/openvpn-data/conf
cd ~/openvpn-composeCreate docker-compose.yml with this service:
services:
openvpn:
image: "${OPENVPN_IMAGE:?Set OPENVPN_IMAGE to a verified kylemanna/openvpn release tag}"
cap_add:
- NET_ADMIN
ports:
- "1194:1194/udp"
volumes:
- ./openvpn-data/conf:/etc/openvpnBefore running Compose, set OPENVPN_IMAGE in your shell or project environment to kylemanna/openvpn: followed by a concrete release tag confirmed in the current project documentation. The variable form prevents this guide from silently prescribing a tag that may be obsolete. Pinning the tag makes upgrades deliberate and reproducible; leaving an image at a moving latest tag can change the server when you next pull or recreate it.
Check that Compose can parse the file:
docker compose configIf Compose reports that OPENVPN_IMAGE is unset, define it and run the validation again. The command should print the resolved service configuration without a YAML or variable error.
3. Generate the OpenVPN server configuration
Run the image’s configuration generator once, replacing the endpoint with your actual public address or DNS name:
docker compose run --rm openvpn ovpn_genconfig -u udp://YOUR_SERVER_OR_DOMAINFor example, a DNS endpoint would use the form udp://vpn.example.com; do not add a URL scheme other than the UDP form shown by the documented command. The generator writes the resulting files into the mounted openvpn-data/conf directory, so the configuration remains available to the long-running service.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesInspect the directory after the command completes. You should see generated OpenVPN configuration material beneath openvpn-data/conf. If the command fails, correct the endpoint, image variable, Docker permissions or volume path before proceeding; do not initialize the CA on a partially configured project.
4. Build the certificate authority
Initialize the PKI with:
docker compose run --rm openvpn ovpn_initpkiThe command prompts you to create and confirm a CA passphrase. Record it in an offline password manager or another protected location. The CA passphrase protects the authority that signs client certificates; losing it can prevent you from performing future certificate-management operations. Do not put it in a public repository, a shared chat or an unencrypted ticket.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
This is a one-time initialization for the persistent volume. If you delete openvpn-data/conf, replace the volume with an empty one, or mount a different directory, Compose will see a new server and you will have to build a new PKI. Treat the directory as sensitive key material, not as disposable cache data.
5. Start the VPN service and read its logs
Start the container in the background:
docker compose up -d openvpnFollow the service log while it starts:
docker compose logs -f openvpnUse Ctrl+C to stop following the output; that does not stop the container. Check its state separately:
Recommended Free Tools
docker compose psThe service should remain running and show the UDP port mapping. A container that exits immediately usually indicates a malformed generated configuration, a missing capability, an inaccessible mounted directory, an image problem or a host-port conflict. Resolve the first error in the log rather than repeatedly restarting the service.
6. Create a certificate for each client
Do not share one client certificate among phones, computers or other users. Create a distinct certificate and key for every device or person so that access can be managed separately.
Issue the client certificate
Run the Easy-RSA command through the container, replacing CLIENTNAME with a stable name such as laptop-alex:
docker compose run --rm openvpn easyrsa build-client-full CLIENTNAMEThe command asks for a passphrase for the client private key. The documented workflow recommends protecting each client key with a passphrase and advises against the nopass option. A protected key means that possession of the exported profile alone is not enough to use the key; the user must also supply the key passphrase when the VPN application requests it.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Use names containing letters, numbers, hyphens or underscores that you can recognize later. Avoid reusing an existing name: a second issuance with the same identity can create confusion about which profile is current.
Repeat for additional devices
Run easyrsa build-client-full once per client identity. Keep a private record mapping each identity to its device. Because every profile contains key material, send it only to the intended user over a secure channel.
7. Export the client profile
After issuing a certificate, export a self-contained OpenVPN profile:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchdocker compose run --rm openvpn ovpn_getclient CLIENTNAME > CLIENTNAME.ovpnThe generated file bundles the CA certificate, the client certificate, the client private key and the connection settings. The output redirection writes it on the VPS in your current directory, not inside the container. Replace both occurrences of CLIENTNAME with the identity you issued.
Protect the resulting .ovpn file like a password. It contains credentials that can authenticate to the VPN. Use an encrypted transfer method, remove temporary copies from shell history or shared directories where appropriate, and do not commit profiles to source control. Import the file into an OpenVPN-compatible client on the target device, then enter the client-key passphrase created in the previous step when prompted.
8. Verify a complete connection
Perform these checks in order:
- Confirm the container is running with
docker compose ps. - Confirm the host firewall and provider firewall allow UDP 1194.
- Import the correct
.ovpnfile into the client application. - Enter the client private-key passphrase when requested.
- Connect and inspect the client log for a completed TLS handshake and an assigned tunnel address.
- From the connected device, verify that traffic reaches the VPS and that the apparent public address is the VPS address if full-tunnel routing was generated.
If the client cannot reach the server at all, focus first on DNS resolution, the endpoint embedded in the profile, UDP filtering and the host port mapping. If the handshake succeeds but traffic does not pass, inspect the generated routing and the VPS forwarding or firewall policy rather than issuing another certificate.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Troubleshooting common failures
| Symptom | Likely area | What to check |
|---|---|---|
Compose says OPENVPN_IMAGE is missing |
Environment variable | Set the variable to a verified kylemanna/openvpn release tag in the same shell or environment used by Compose, then run docker compose config again. |
| The container exits on startup | Configuration or permissions | Run docker compose logs openvpn; check the first error, confirm NET_ADMIN, verify the bind-mounted directory exists and ensure the generated files are readable by the container. |
| Port 1194 cannot be published | Host conflict | Check whether another process or container already owns UDP 1194. Stop the conflicting service or deliberately choose a different published port and regenerate client configuration to match. |
| Client times out before TLS | Network path | Confirm the profile uses the current public IP or DNS name, the DNS record resolves correctly, and both provider and OS firewalls allow UDP 1194. |
| Client reaches the server but cannot pass traffic | Routing or forwarding | Review the generated server configuration, VPS forwarding policy and firewall rules. A successful TLS handshake does not by itself prove that routed traffic is permitted. |
| Profile import asks for an unexpected key password | Client key protection | Enter the passphrase chosen during easyrsa build-client-full. If the wrong identity was exported, create or export the intended client profile again. |
| Initialization behaves as if this is a new server | Volume path | Verify that Compose is running from the project directory and that ./openvpn-data/conf is the same persistent directory used during every command. |
Enable diagnostic output for a failing run
The documented image workflow supports setting DEBUG=1 for a run. Apply it to the specific Compose command that is failing:
docker compose run --rm -e DEBUG=1 openvpn <the-failing-command>For example, repeat the affected generation or initialization command with the environment flag, then read the expanded output. Do not treat debug logs as harmless: they can reveal paths and configuration details, so store and share them carefully.
Operational practices after deployment
Back up the persistent directory
The bind mount contains the server configuration, CA, server keys and client PKI. Back up openvpn-data/conf using an encrypted method and restrict access to the backup. A container image can be downloaded again; your CA and issued identities cannot be recreated from the image alone.
Plan image upgrades
Keep the image tag pinned. When you choose to upgrade, read the current project documentation and change the tag deliberately, back up the persistent directory, pull the new image and recreate the service during a maintenance window. Do not combine an unreviewed image change with a firewall or routing change, because isolating failures becomes harder.
Protect administrative secrets
- Store the CA passphrase separately from the VPS and from client profile files.
- Use a unique, protected passphrase for each client key.
- Limit shell, filesystem and backup permissions around
openvpn-data/conf. - Remove profiles from temporary transfer locations after the recipient confirms import.
- Review who still needs access before issuing additional profiles.
Keep endpoint information current
If the VPS public address changes, the endpoint embedded in existing profiles may no longer resolve to the server. Update DNS or regenerate profiles from the corrected server configuration, then distribute the replacements securely.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Compose syntax and compatibility notes
Many guides show a file beginning with version: '2' and commands beginning with docker-compose. Those examples describe older Compose conventions. The current plugin uses docker compose, and the top-level version key is not required. If you inherit an older file, preserve its service settings only after checking that your installed Compose accepts them; do not assume the legacy command is present.
The documented sequence remains the important part: run ovpn_genconfig, run ovpn_initpki, start the service, issue each certificate with Easy-RSA and export each profile with ovpn_getclient. These one-off docker compose run --rm operations use the same persistent mount as the long-running service, which is why running them from a different directory or with a different volume silently creates a separate VPN instance.
Quick Recap
Deployment checklist
- Docker Engine and the Compose plugin report valid versions.
- The VPS has a reachable public IP or a DNS name resolving to it.
- UDP 1194 is allowed by every firewall between the client and VPS.
- The Compose service includes
NET_ADMIN, UDP port mapping and a persistent/etc/openvpnmount. - The image is pinned to a release tag verified in the current project documentation.
ovpn_genconfigwas run with the correct UDP endpoint.ovpn_initpkicompleted and the CA passphrase is stored safely.- The service starts with
docker compose up -d openvpnand remains running. - Each device has its own passphrase-protected certificate and exported
.ovpnfile. - Profiles are transferred and backed up as sensitive credentials.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
