知識庫

OpenVPN is a mature, widely-supported VPN protocol offering broad client compatibility. While WireGuard (see How to Set Up a WireGuard VPN Server on a Linux VPS) is faster and simpler, OpenVPN remains preferred in environments requiring maximum compatibility with older or restrictive networks.

Prerequisites

• Ubuntu 22.04/24.04 or Debian 11/12 VPS
• Root or sudo access

Step 1 — Install OpenVPN and Easy-RSA

sudo apt update
sudo apt install openvpn easy-rsa -y

Step 2 — Set Up the Certificate Authority

make-cadir ~/easy-rsa
cd ~/easy-rsa
./easyrsa init-pki
./easyrsa build-ca nopass

Step 3 — Generate the Server Certificate and Key

./easyrsa gen-req server nopass
./easyrsa sign-req server server

Step 4 — Generate Diffie-Hellman Parameters

./easyrsa gen-dh

Step 5 — Copy Files to the OpenVPN Directory

sudo cp pki/ca.crt pki/private/server.key pki/issued/server.crt pki/dh.pem /etc/openvpn/server/

Step 6 — Create the Server Configuration

sudo nano /etc/openvpn/server/server.conf

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
keepalive 10 120
cipher AES-256-GCM
persist-key
persist-tun

Step 7 — Enable IP Forwarding

echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Step 8 — Configure NAT

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Adjust eth0 to your actual public network interface.

Step 9 — Allow OpenVPN Through the Firewall

sudo ufw allow 1194/udp

Step 10 — Start OpenVPN

sudo systemctl enable --now openvpn-server@server

Step 11 — Generate a Client Certificate

cd ~/easy-rsa
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Step 12 — Create a Client Configuration File

client
dev tun
proto udp
remote YOUR_SERVER_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
cipher AES-256-GCM
<ca>
[paste ca.crt content]
</ca>
<cert>
[paste client1.crt content]
</cert>
<key>
[paste client1.key content]
</key>

Step 13 — Connect from a Client

Import the .ovpn file into an OpenVPN client app (available for Windows, macOS, Linux, iOS, Android).

Common Errors

"TLS handshake failed" — certificate mismatch between client and server; regenerate and re-distribute if certificates were recreated.

No internet through the VPN — verify IP forwarding and the NAT/MASQUERADE rule are correctly configured.

Connection times out — confirm UDP 1194 is open in both the VPS firewall and any upstream network firewall.

Best Practices

• Use a unique client certificate per device
• Revoke certificates for lost/compromised devices promptly via easy-rsa
• Consider WireGuard instead if maximum simplicity and performance matter more than legacy client compatibility

Related Articles

• How to Set Up a WireGuard VPN Server on a Linux VPS
• How to Configure UFW Firewall on a Linux VPS
• Understanding iptables and nftables (Advanced Firewall Rules)