OpenVPN is a mature, widely-supported VPN protocol — a solid choice when you need broad client compatibility or specific features not available in newer alternatives like WireGuard.
OpenVPN vs WireGuard
| Factor | OpenVPN | WireGuard |
|---|---|---|
| Setup complexity | More involved (PKI, certificates) | Simpler (key pairs only) |
| Performance | Good | Generally faster |
| Client compatibility | Extremely broad, mature ecosystem | Growing, native in most modern OSes now |
Prerequisites
- Ubuntu 22.04/24.04 VPS
- Root or sudo access
Step 1 — Use the Official Installation Script (Simplest Approach)
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
sudo ./openvpn-install.shThis well-maintained community script automates the otherwise complex manual PKI setup process, walking through an interactive configuration wizard.
Step 2 — Follow the Interactive Prompts
Configure: the public IP/hostname clients will connect to, the protocol (UDP recommended for performance), the port, and DNS resolver preference for clients.
Step 3 — Create Your First Client
The script prompts for a client name and generates a .ovpn configuration file containing all necessary certificates and settings.
Step 4 — Transfer the Client Config Securely
scp deploy@YOUR_SERVER_IP:~/client.ovpn ./Step 5 — Connect from a Client
Import the .ovpn file into the OpenVPN Connect app (available for all major platforms) and connect.
Adding Additional Clients Later
sudo ./openvpn-install.shRe-run the script and select the "Add a new user" option from its menu.
Revoking Client Access
sudo ./openvpn-install.shSelect the "Revoke existing user" option — important for immediately cutting off access for a lost device or departed team member.
Verifying the Server Is Running
sudo systemctl status openvpn@serverChecking Connected Clients
sudo cat /var/log/openvpn/status.logManual Setup Considerations (If Not Using the Script)
A manual OpenVPN setup involves generating a Certificate Authority, server certificate, and per-client certificates using Easy-RSA — considerably more involved than the WireGuard equivalent, which is why most administrators use an automation script like the one above rather than configuring OpenVPN's PKI by hand.
Common Errors
Client can't connect — verify the configured port (default UDP 1194, or whatever was chosen during setup) is allowed through the firewall.
Slow VPN throughput — try switching from TCP to UDP if not already using it; TCP-over-TCP tunneling situations can cause significant performance degradation.
Best Practices
- Use a unique client certificate per device, never share one certificate across multiple devices
- Revoke certificates immediately for lost devices or departed team members
- Prefer UDP over TCP for better performance unless you have a specific reason requiring TCP
Continue Reading
- How to Set Up a VPN Server with WireGuard
- How to Harden a Fresh Linux VPS in 15 Minutes
- How to Configure UFW (Uncomplicated Firewall) on Ubuntu & Debian
Browse more articles in Advanced Networking & VPN.
