A virtual private network (VPN) is a logical network built over an existing public network, usually the Internet, using tunneling and encryption. Your device sends traffic into an encrypted tunnel to a VPN gateway; that gateway authenticates you, decrypts the packets and forwards them according to its routes and firewall rules.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
You can run that gateway yourself with OpenVPN on a maintained Linux, BSD or Windows host, either at home or on a cloud VPS. The job is more than installing a package: you need a reachable address, a certificate authority, a tunnel subnet, forwarding and NAT, DNS policy, firewall rules, client profiles and an ongoing patching and credential-revocation process.
As an Amazon Associate I earn from qualifying purchases.
What is a VPN?
NIST’s CNSSI 4009-2022 glossary defines a VPN as “a restricted-use, logical (i.e., artificial or simulated) computer network that is constructed from the system resources of a relatively public, physical (i.e., real) network (such as the Internet), often by using encryption (located at hosts or gateways), and often by tunneling links of the virtual network across the real network.” NIST SP 800-77 Rev. 1 (2020) similarly describes a VPN as a virtual network over existing physical networks that provides a secure communications mechanism for data and IP information between networks or nodes.
In practical terms, the VPN creates an overlay. A client wraps an ordinary IP packet inside a VPN packet, encrypts the protected portion and sends it across the untrusted network. The server verifies the peer, removes the tunnel wrapper and forwards the original packet toward a private service or the public Internet. Return traffic follows the reverse path.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
What protection a VPN can provide
- Confidentiality: encryption helps prevent an observer on the local network or transit path from reading tunnel contents.
- Integrity: authenticated encryption can detect packets that were altered in transit.
- Data-origin authentication: certificates or other credentials let the server distinguish an authorized peer from an unknown one.
- Replay protection: the protocol can reject captured packets that are resent later.
- Access control: routes and firewall policy can limit which private networks or services a connected client may reach.
These properties depend on correct configuration and sound software. NIST warns that implementation flaws, vulnerable hosts and insecure settings remain exploitable even when encryption is enabled.
What a VPN does not guarantee
- A VPN does not make a malware-infected laptop or phone trustworthy. Malware can read data before encryption or after decryption.
- The VPN gateway can observe connection metadata and, depending on routing and logging, traffic that exits to the Internet. Destination services can still log your account, IP address and activity.
- A VPN does not repair vulnerable game servers, browsers or other applications.
- It does not automatically provide anonymity. A self-hosted server normally has an address associated with you or your hosting account.
How OpenVPN works
OpenVPN is an open-source SSL/TLS daemon. The OpenVPN 2.5 manual describes it as a robust and highly flexible VPN daemon. It supports routed TUN tunnels, bridged TAP tunnels, UDP or TCP transport, NAT and proxy traversal, dynamic addressing and several authentication methods.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesControl channel and data channel
In TLS mode, OpenVPN establishes a control channel for negotiation, authentication and configuration, then carries encrypted tunnel packets over a data channel. The OpenVPN manual notes that the channels are multiplexed over one TCP or UDP port. In normal certificate mode, each peer has a certificate and private key signed by a common certificate authority (CA). TLS authenticates the peers and derives session keys; the data channel then transports routed or bridged traffic.
TLS Auth or TLS Crypt adds an additional layer of protection to the control channel. Use the option supported by your installed release and client software, and keep the related key material private.
TUN and TAP
| Mode | What it carries | Best starting use | Important limitation |
|---|---|---|---|
| TUN | Layer-3 IP packets | Remote access to private networks and routed Internet traffic | It does not carry arbitrary Ethernet broadcasts or non-IP frames. |
| TAP | Layer-2 Ethernet frames | A design that genuinely requires bridging an Ethernet segment | Bridging is more complex and can expand broadcast traffic; do not choose it merely because it is available. |
A routed TUN design is the normal remote-access starting point. TAP is justified only when a specific layer-2 requirement has been identified and tested.
UDP and TCP
| Transport | Advantages | Trade-offs |
|---|---|---|
| UDP | Usually the performance-oriented choice and avoids TCP-over-TCP behavior. | May be blocked by a restrictive network or captive firewall. |
| TCP | Can work where only outbound TCP is permitted and can traverse some restrictive proxies. | Reliability mechanisms can add latency; TCP-over-TCP commonly performs poorly under packet loss. |
Choose based on the networks your players and administrators must use, not on a universal claim that one transport is always faster. The official sample routed configuration uses UDP port 1194, but that is a starting value rather than a requirement.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Can you run your own OpenVPN server?
Yes. A home server works when your Internet connection accepts inbound traffic and you can configure its edge router. A cloud VPS is often simpler because it normally supplies a stable public address and a directly managed firewall, but you remain responsible for the operating system, OpenVPN configuration and credentials. Check the provider’s current policy before running VPN workloads.
Requirements checklist
- A maintained Linux, BSD or Windows host with administrative access.
- A stable public IP address, or an FQDN that resolves to the server. OpenVPN Access Server documentation explicitly recommends an FQDN and requires a reachable server address.
- A listening interface and selected transport port.
- A private tunnel address pool that does not overlap common client networks.
- IP forwarding, routes, firewall rules and NAT or masquerading where traffic must leave through the server.
- A DNS plan: which resolver clients use, which search domains they receive and whether DNS queries should traverse the tunnel.
- A protected CA key, distinct server and client certificates, and a way to revoke credentials.
- A backup and patching process for the host and VPN configuration.
Home-host complications
At home, the server may sit behind a router using private addressing. You must forward the chosen OpenVPN port from the router to the server, permit it in the host firewall and confirm that your ISP does not place you behind carrier-grade NAT. If the public address changes, use an FQDN with a reliable update mechanism. Never expose the router’s administration interface merely to make the VPN reachable; restrict management to a trusted network or a separate secured access path.
Step-by-step: run an OpenVPN server
The exact package names, service units and configuration paths differ by operating-system release. Use the current instructions for your distribution and OpenVPN version rather than copying an old command sequence unchanged.
1. Choose the host and name
Select a maintained machine with enough CPU, memory and network capacity for your expected number of clients. Assign a stable public IP or an FQDN and confirm that the name resolves correctly from an external network. Record the host’s private interface and default gateway before changing routes.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →2. Install a supported OpenVPN build
Install OpenVPN and its current cryptographic and service dependencies from your operating system’s supported repositories or the OpenVPN project’s version-specific documentation. Enable automatic security updates where appropriate, but schedule reboots and service restarts so you can verify that clients reconnect.
3. Create a private PKI
Use a CA to sign one server certificate and a separate client certificate for each device or user. Keep the CA private key offline or in a tightly restricted system; compromise of that key can undermine every certificate it has issued. Do not share one client certificate among several people because you lose individual accountability and cannot revoke one device without disrupting the others.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
When a phone, laptop or gaming device is lost, or a user leaves, revoke its certificate and distribute a replacement profile only after checking the revocation mechanism. Treat client private keys and exported profiles as credentials: possession may grant network access.
4. Select the tunnel network
Start with a routed TUN network. The official sample uses 10.8.0.0/24 and UDP port 1194. Choose a different private range if that network overlaps a player’s home LAN, a hotel network or the private subnet behind the server. Overlap causes ambiguous routes and is one of the most common reasons a connected client cannot reach a local game server.
An illustrative starting fragment is:
dev tun
proto udp
port 1194
server 10.8.0.0 255.255.255.0This is not a complete production configuration. Add certificates, authenticated control-channel protection, routes, DNS policy and cipher settings appropriate to your installed release, then verify the defaults against current documentation.
5. Configure routes and forwarding
Decide what the client should reach. For a private game server or home media host, advertise only the required private subnet. For a full tunnel, advertise a default route so general Internet traffic exits through the VPN gateway. Enable IP forwarding on the server and add firewall rules that permit only intended source, destination and port combinations.
If the private network cannot route replies back to the VPN address pool, configure NAT or masquerading on the appropriate interface. NAT can simplify return routing, but it also hides individual tunnel addresses from the destination; use explicit routes instead when you need per-client visibility or policy.
6. Define DNS behavior
Split-tunnel clients can continue using their local resolver for ordinary Internet names while sending private names to an internal resolver. Full-tunnel clients generally need VPN-provided DNS servers and search domains so that DNS requests follow the same policy as other traffic. Test both IPv4 and IPv6 behavior; a policy that covers only IPv4 can leave unintended DNS or application traffic outside the tunnel.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
7. Open the edge firewall narrowly
Permit only the selected OpenVPN transport on the public interface, plus a separately controlled administration path. Do not publish dashboards, SSH or remote-desktop services to the whole Internet just because the VPN is present. On the host, allow forwarding from the tunnel interface only to the private networks and ports that clients require. Log rejected connection attempts and review them during initial testing.
8. Build and distribute client profiles
A profile needs the server address, transport, CA certificate, client certificate and private key, along with any TLS Auth or TLS Crypt material. Embed only the routes and DNS settings the client should receive. Transfer profiles through a protected channel, store them with device-level access controls and delete unused copies. Test one client at a time so you can identify whether a failure is in certificate validation, routing, DNS or firewall policy.
9. Validate before wider rollout
- Connect from an external network and confirm that the server certificate validates and the client receives an address from the tunnel pool.
- Inspect the client’s route table and confirm that only intended private prefixes, or the default route for a full tunnel, are present.
- Resolve a private name and an ordinary public name to verify DNS behavior.
- Reach an authorized private service, such as a game server, and confirm that unauthorized subnets remain blocked.
- For a full tunnel, check that public traffic exits at the server and that IPv6 is governed by an explicit policy.
- Disconnect, revoke the test certificate and verify that the revoked profile cannot reconnect.
Write rollback steps before changing firewall or routing rules. A mistaken route can cut off your administrative connection.
Full-tunnel versus split-tunnel VPN
| Design | What travels through the VPN | Benefits | Costs and risks |
|---|---|---|---|
| Full tunnel | Private traffic and general Internet traffic, normally through a default route. | Centralizes egress filtering and DNS policy; useful when a remote device must appear on the server’s network. | Consumes server bandwidth, makes the host an Internet gateway and requires complete DNS and IPv6 policy to prevent bypass. |
| Split tunnel | Only selected private prefixes or services. | Preserves local Internet breakout and reduces server load. | Requires careful route design; traffic not listed in the VPN policy remains outside it. |
For remote access to a home game server, split tunneling is often sufficient: advertise the game server’s LAN prefix and any internal DNS zone, while leaving ordinary web traffic local. Use a full tunnel when centralized Internet controls are an explicit requirement and you are prepared to operate the server as an egress gateway.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Self-hosted VPN privacy and security boundaries
Self-hosting changes who controls the gateway; it does not erase trust. You control the OpenVPN process, firewall and logs, but your hosting provider can control the underlying infrastructure and your destination services still receive traffic from the gateway. Keep only the logs you need, protect them from unauthorized access and state clearly who can administer the server.
Security depends on the entire chain:
- Patch the operating system, OpenVPN and cryptographic libraries.
- Require modern TLS and authenticated modern data ciphers; disable obsolete algorithms instead of retaining them indefinitely for compatibility.
- Use TLS Crypt or TLS Auth where supported to protect the control channel.
- Restrict management interfaces to trusted networks or a separate access channel.
- Issue one client credential per device or user and revoke it promptly when its status changes.
- Back up configuration and key material securely, but keep the CA key separate from routine server backups when possible.
- Monitor authentication failures, certificate events, route changes and unusual forwarding activity.
OpenVPN Access Server documentation cites TLS 1.2 as its default minimum in the referenced configuration. Verify the effective minimum and cipher defaults against the release you install; defaults can change.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Common failures and fixes
The client cannot connect
- No packets reach the server: check the public address, FQDN resolution, home-router forwarding, cloud firewall and whether the ISP blocks inbound traffic.
- TLS negotiation fails: verify the server name, clock on both devices, CA certificate, client certificate, private key and TLS Auth or TLS Crypt material.
- The port is wrong: confirm that the profile’s protocol and port match the listening service. The sample’s UDP 1194 is not universal.
The client connects but cannot reach a private service
- Check that the client received the route to the private subnet.
- Confirm IP forwarding is enabled on the server.
- Inspect both directions of the host and LAN firewall rules.
- Ensure the private network has a return route to the tunnel pool, or apply deliberate NAT.
- Look for overlapping subnets on the client’s current network.
Internet access works, but DNS or some applications bypass the VPN
Review pushed DNS servers and search domains, default-route settings, split-tunnel exceptions and IPv6 routes. A full-tunnel design is incomplete if an ungoverned resolver or IPv6 path remains active. Test by hostname and by address; a successful address connection does not prove that DNS policy is correct.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Performance is poor
First measure latency, packet loss, CPU use and the physical uplink at both ends. Try UDP when the network permits it, because TCP-over-TCP behavior can amplify loss-related delays. Confirm that the server is not routing more traffic than intended. OpenVPN Access Server documents Data Channel Offload (DCO), which moves data-channel encryption and decryption into kernel space and may improve performance when a compatible kernel module is installed. Treat DCO as an optional optimization: establish correct routing and secure settings first, then measure before and after.
Using a self-hosted OpenVPN server for gaming
A VPN can give an authorized player a route to a private game server without exposing that game server directly to the public Internet. It can also connect players on different networks to services that are intentionally bound to a home LAN. The VPN does not guarantee lower ping: traffic may take a longer path through the gateway, and encryption adds processing work. Test from each player’s actual ISP and region.
Prefer a routed TUN design for ordinary IP-based game services. Advertise only the game-server subnet, restrict forwarding to the game ports and administration endpoints that are needed, and keep the game server itself patched. If a title genuinely depends on layer-2 discovery or broadcast behavior, evaluate TAP bridging carefully; adding a bridge solely to make discovery convenient increases complexity and broadcast exposure.
Ongoing maintenance checklist
- Apply operating-system, OpenVPN and kernel updates on a defined schedule.
- Review effective TLS minimums and cipher settings after upgrades.
- Rotate certificates and keys according to your organization’s risk policy.
- Revoke lost devices and departed users immediately, then test revocation.
- Review authentication, forwarding and firewall logs for anomalies.
- Verify backups by restoring configuration to a test host.
- Re-test routes, DNS, IPv6 behavior and private services after network changes.
- Document the public endpoint, tunnel subnet, advertised routes, DNS servers, firewall policy and rollback procedure.
A VPN is a network service, not a one-time installer. Its security comes from the combination of authenticated peers, current cryptography, narrow routing and firewall policy, a maintained host and disciplined credential management.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
