How to Install OpenVPN: Complete Setup and Configuration Guide

  • 14/01/2026
  • 15 minute read

Establishing secure remote access to your network infrastructure remains a critical requirement for organizations and individuals alike. Whether you’re enabling remote work capabilities, securing communications between distributed offices, or protecting privacy while accessing public networks, a robust VPN solution provides essential security and connectivity.

OpenVPN has served as the industry standard for VPN technology for over two decades, offering enterprise-grade security, extensive platform support, and flexible configuration options that accommodate virtually any networking scenario.

This comprehensive guide walks you through installing OpenVPN on Linux servers and configuring your first secure VPN connection, from certificate generation to client connectivity testing.

Quick Summary: OpenVPN is a mature, feature-rich VPN protocol using SSL/TLS for secure communication. Installation involves setting up the server, configuring PKI infrastructure with Easy-RSA, generating certificates, and creating client configurations.

What is OpenVPN?

OpenVPN is an open-source VPN protocol and software application that implements virtual private network techniques for creating secure point-to-point or site-to-site connections. First released in 2001, OpenVPN has become the most widely deployed VPN technology across enterprises, hosting providers, and privacy-conscious users.

Key Advantages of OpenVPN

Security:

  • Uses SSL/TLS protocols for encryption and authentication
  • Supports multiple cipher options (AES-256, ChaCha20, etc.)
  • PKI (Public Key Infrastructure) based authentication
  • Optional username/password authentication
  • Perfect forward secrecy capabilities

Compatibility:

  • Works on virtually all operating systems (Windows, macOS, Linux, iOS, Android)
  • Runs over TCP or UDP protocols
  • Traverses NAT and firewalls effectively
  • Works with nearly all network configurations

Flexibility:

  • Highly configurable for specific use cases
  • Supports complex routing scenarios
  • Can operate in routed or bridged mode
  • Extensive logging and monitoring capabilities

Reliability:

  • Mature codebase with 20+ years of development
  • Extensive real-world testing and deployment
  • Large community support and documentation
  • Regular security audits and updates

Common Use Cases

  • Remote Access VPN – Connect remote workers to corporate networks
  • Site-to-Site VPN – Link multiple office locations securely
  • Privacy Protection – Encrypt internet traffic for privacy
  • Bypassing Restrictions – Access geo-restricted content
  • Secure WiFi – Protect communications on public networks
  • Cloud Infrastructure – Secure connections between cloud resources
Industry Standard: OpenVPN powers an estimated 60+ million VPN connections daily across commercial VPN services, enterprise networks, and personal deployments worldwide.

Prerequisites and Planning

Before beginning installation, ensure your environment meets requirements and plan your network architecture.

System Requirements

  • Operating System – Ubuntu 20.04/22.04/24.04, Debian 10/11/12, CentOS 7/8, RHEL 8/9, AlmaLinux 8/9, Rocky Linux 8/9
  • Root Access – Required for installation and configuration
  • RAM – Minimum 512MB, 1GB+ recommended
  • CPU – Any modern CPU (encryption operations can be CPU-intensive)
  • Network – Static IP or DDNS for server accessibility
  • Ports – UDP 1194 (default) or custom port of your choice

Network Planning

Decide on these parameters before installation:

ParameterRecommendationExample
VPN SubnetPrivate range not used locally10.8.0.0/24
ProtocolUDP for performance, TCP for reliabilityUDP
Port1194 (standard) or custom1194
DNS ServersPublic or internal DNS1.1.1.1, 8.8.8.8
CipherAES-256-GCM (modern)AES-256-GCM

Security Considerations

  • Use strong certificate encryption (RSA 4096-bit minimum)
  • Enable TLS authentication for additional security layer
  • Implement certificate revocation capabilities
  • Plan for secure certificate storage and distribution
  • Consider implementing two-factor authentication

Installing OpenVPN Server

Installation methods vary by distribution but follow similar patterns.

Ubuntu and Debian Installation

# Update package lists
sudo apt update

# Install OpenVPN and Easy-RSA
sudo apt install openvpn easy-rsa -y

# Verify installation
openvpn --version

CentOS, AlmaLinux, and Rocky Linux Installation

# Enable EPEL repository
sudo dnf install epel-release -y

# Install OpenVPN and Easy-RSA
sudo dnf install openvpn easy-rsa -y

# Verify installation
openvpn --version

For CentOS 7:

# Enable EPEL
sudo yum install epel-release -y

# Install packages
sudo yum install openvpn easy-rsa -y

Verifying Installation

# Check OpenVPN version
openvpn --version

# Verify Easy-RSA is available
ls /usr/share/easy-rsa/

# Check OpenVPN service status
systemctl status openvpn-server@server

Setting Up PKI with Easy-RSA

install openvpn server firewall routing and ip forwarding configuration

OpenVPN uses Public Key Infrastructure (PKI) for authentication. Easy-RSA simplifies certificate management.

Initialize PKI Directory

# Create Easy-RSA directory
make-cadir ~/openvpn-ca
cd ~/openvpn-ca

# Alternatively, copy from system location
# mkdir ~/openvpn-ca
# cp -r /usr/share/easy-rsa/* ~/openvpn-ca/
# cd ~/openvpn-ca

Configure Easy-RSA Variables

Edit the vars file to set certificate parameters:

nano vars

Modify these variables:

set_var EASYRSA_REQ_COUNTRY    "US"
set_var EASYRSA_REQ_PROVINCE   "California"
set_var EASYRSA_REQ_CITY       "San Francisco"
set_var EASYRSA_REQ_ORG        "MyCompany"
set_var EASYRSA_REQ_EMAIL      "admin@mycompany.com"
set_var EASYRSA_REQ_OU         "IT Department"

# Set key size (4096 recommended)
set_var EASYRSA_KEY_SIZE       4096

# Set certificate validity (in days)
set_var EASYRSA_CA_EXPIRE      3650
set_var EASYRSA_CERT_EXPIRE    3650

Build Certificate Authority (CA)

# Initialize PKI
./easyrsa init-pki

# Build CA (you'll be prompted for CA common name)
./easyrsa build-ca

# Enter a strong passphrase when prompted
# Enter common name (e.g., "MyCompany-CA")

The CA certificate will be created at: `pki/ca.crt`

Generate Server Certificate and Key

# Generate server certificate request and key
./easyrsa gen-req server nopass

# Sign the server certificate with CA
./easyrsa sign-req server server

# Type 'yes' to confirm
# Enter CA passphrase when prompted

Server files created:
– Private key: `pki/private/server.key`
– Certificate: `pki/issued/server.crt`

Generate Diffie-Hellman Parameters

# Generate DH params (this takes several minutes)
./easyrsa gen-dh

# DH parameters created at: pki/dh.pem

Generate TLS Authentication Key

# Generate TLS auth key for additional security
openvpn --genkey secret ta.key

# Move to PKI directory
mv ta.key ~/openvpn-ca/pki/
Important: Keep your CA passphrase secure and backed up. You’ll need it to sign all client certificates. Loss of this passphrase means you cannot issue new certificates without rebuilding your entire PKI.

Configuring OpenVPN Server

Create the server configuration file with security best practices.

Copy Certificates to OpenVPN Directory

# Create OpenVPN directory if needed
sudo mkdir -p /etc/openvpn/server

# Copy server certificates and keys
sudo cp ~/openvpn-ca/pki/ca.crt /etc/openvpn/server/
sudo cp ~/openvpn-ca/pki/issued/server.crt /etc/openvpn/server/
sudo cp ~/openvpn-ca/pki/private/server.key /etc/openvpn/server/
sudo cp ~/openvpn-ca/pki/dh.pem /etc/openvpn/server/
sudo cp ~/openvpn-ca/pki/ta.key /etc/openvpn/server/

# Set appropriate permissions
sudo chmod 600 /etc/openvpn/server/server.key
sudo chmod 600 /etc/openvpn/server/ta.key

Create Server Configuration File

sudo nano /etc/openvpn/server/server.conf

Add this comprehensive configuration:

# OpenVPN Server Configuration

# Port and protocol
port 1194
proto udp

# Device type (tun for routed, tap for bridged)
dev tun

# SSL/TLS root certificate, server certificate, and key
ca ca.crt
cert server.crt
key server.key

# Diffie-Hellman parameters
dh dh.pem

# VPN subnet
server 10.8.0.0 255.255.255.0

# Maintain client IP addresses across restarts
ifconfig-pool-persist /var/log/openvpn/ipp.txt

# Push routes to client (allows access to server LAN)
# push "route 192.168.1.0 255.255.255.0"

# Push DNS servers to clients
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 8.8.8.8"

# Redirect all client traffic through VPN (full tunnel)
push "redirect-gateway def1 bypass-dhcp"

# Enable compression (LZ4 recommended)
compress lz4-v2
push "compress lz4-v2"

# Client-to-client communication (optional)
# client-to-client

# Keepalive ping
keepalive 10 120

# TLS authentication for additional security
tls-auth ta.key 0

# Cipher selection (use strong ciphers)
cipher AES-256-GCM
auth SHA256

# User/group for privilege downgrade
user nobody
group nogroup

# Persist keys and TUN device
persist-key
persist-tun

# Status and log files
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log

# Logging verbosity (0-11, 3 recommended)
verb 3

# Suppress duplicate messages
mute 20

# Notify clients when restarting
explicit-exit-notify 1

Create Log Directory

# Create log directory
sudo mkdir -p /var/log/openvpn

# Set permissions
sudo chown nobody:nogroup /var/log/openvpn

Configuring Network and Firewall

Enable packet forwarding and configure firewall rules for VPN traffic.

Enable IP Forwarding

# Enable IPv4 forwarding temporarily
sudo sysctl -w net.ipv4.ip_forward=1

# Make permanent
sudo nano /etc/sysctl.conf

# Add or uncomment:
net.ipv4.ip_forward=1

# Apply changes
sudo sysctl -p

Configure UFW (Ubuntu/Debian)

# Allow OpenVPN port
sudo ufw allow 1194/udp

# Edit UFW before rules for NAT
sudo nano /etc/ufw/before.rules

# Add these lines at the top (after header comments):
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Allow traffic from OpenVPN client to eth0
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT

# Save and reload
sudo ufw reload

# Enable UFW if not already enabled
sudo ufw enable

Configure Firewalld (CentOS/RHEL/Fedora)

# Add OpenVPN service
sudo firewall-cmd --permanent --add-service=openvpn

# Or add port directly
sudo firewall-cmd --permanent --add-port=1194/udp

# Enable masquerading
sudo firewall-cmd --permanent --add-masquerade

# Add OpenVPN interface to internal zone
sudo firewall-cmd --permanent --zone=trusted --add-interface=tun0

# Reload firewall
sudo firewall-cmd --reload

# Verify
sudo firewall-cmd --list-all

Configure iptables (Manual)

# Allow OpenVPN port
sudo iptables -A INPUT -p udp --dport 1194 -j ACCEPT

# Allow TUN interface
sudo iptables -A INPUT -i tun0 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -j ACCEPT

# NAT for VPN clients (replace eth0 with your interface)
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# Save rules (varies by distribution)
# Ubuntu/Debian:
sudo apt install iptables-persistent -y
sudo netfilter-persistent save

# CentOS/RHEL:
sudo service iptables save
Interface Note: Replace ‘eth0’ with your actual network interface name. Find it with ip a or ifconfig.

Starting OpenVPN Server

Start the OpenVPN service and enable it for automatic startup.

Start and Enable Service

# Start OpenVPN server
sudo systemctl start openvpn-server@server

# Enable at boot
sudo systemctl enable openvpn-server@server

# Check status
sudo systemctl status openvpn-server@server

Verify Server is Running

# Check if tun0 interface exists
ip a show tun0

# Verify OpenVPN is listening
sudo ss -tulpn | grep 1194

# Check logs
sudo tail -f /var/log/openvpn/openvpn.log

Expected output shows OpenVPN listening on UDP 1194 and tun0 interface active with IP 10.8.0.1.

Generating Client Certificates

Create certificates for each client that will connect to your VPN.

Generate Client Certificate and Key

# Navigate to Easy-RSA directory
cd ~/openvpn-ca

# Generate client certificate request (replace client1 with client name)
./easyrsa gen-req client1 nopass

# Sign the client certificate
./easyrsa sign-req client client1

# Type 'yes' to confirm
# Enter CA passphrase

Files created:
– Private key: `pki/private/client1.key`
– Certificate: `pki/issued/client1.crt`

Create Client Configuration Directory

# Create directory for client configs
mkdir -p ~/client-configs/files
chmod 700 ~/client-configs/files

# Copy necessary files
cp ~/openvpn-ca/pki/ca.crt ~/client-configs/
cp ~/openvpn-ca/pki/ta.key ~/client-configs/

Creating Client Configuration Files

install openvpn server client configuration for windows linux macos ios android

Generate .ovpn configuration files for clients.

Create Base Configuration Template

nano ~/client-configs/base.conf

Add this client configuration:

# OpenVPN Client Configuration

# Specify client mode
client

# Use the same device type as server
dev tun

# Use the same protocol as server
proto udp

# Server address and port (CHANGE THIS)
remote YOUR_SERVER_IP 1194

# Keep trying indefinitely to resolve hostname
resolv-retry infinite

# Don't bind to specific local port
nobind

# Downgrade privileges after initialization
user nobody
group nogroup

# Persist keys and TUN device across restarts
persist-key
persist-tun

# Verify server certificate
remote-cert-tls server

# Enable compression (must match server)
compress lz4-v2

# Set log file verbosity
verb 3

# Cipher and auth settings (must match server)
cipher AES-256-GCM
auth SHA256

# TLS authentication
key-direction 1

# Uncomment if you need to specify DNS
# script-security 2
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf

Create Configuration Generation Script

nano ~/client-configs/make_config.sh

Add this script:

#!/bin/bash

# First argument: Client identifier

KEY_DIR=~/openvpn-ca/pki
OUTPUT_DIR=~/client-configs/files
BASE_CONFIG=~/client-configs/base.conf

cat ${BASE_CONFIG} \
    <(echo -e '') \
    ${KEY_DIR}/ca.crt \
    <(echo -e '\n') \
    ${KEY_DIR}/issued/${1}.crt \
    <(echo -e '\n') \
    ${KEY_DIR}/private/${1}.key \
    <(echo -e '\n') \
    ~/client-configs/ta.key \
    <(echo -e '') \
    > ${OUTPUT_DIR}/${1}.ovpn

echo "Client configuration created: ${OUTPUT_DIR}/${1}.ovpn"

Make script executable:

chmod 700 ~/client-configs/make_config.sh

Generate Client Configuration

# Replace YOUR_SERVER_IP in base.conf first
sed -i 's/YOUR_SERVER_IP/123.456.789.0/g' ~/client-configs/base.conf

# Generate client configuration
cd ~/client-configs
./make_config.sh client1

# Configuration created at: ~/client-configs/files/client1.ovpn

Setting Up OpenVPN Clients

Configure clients on different operating systems.

Linux Client

# Install OpenVPN client
sudo apt install openvpn -y  # Ubuntu/Debian
sudo dnf install openvpn -y  # Fedora/CentOS

# Copy client configuration
sudo cp client1.ovpn /etc/openvpn/client/

# Connect using configuration
sudo openvpn --config /etc/openvpn/client/client1.ovpn

# Or use systemd (rename to client.conf first)
sudo cp client1.ovpn /etc/openvpn/client/client.conf
sudo systemctl start openvpn-client@client
sudo systemctl enable openvpn-client@client

Windows Client

  1. Download OpenVPN GUI from openvpn.net
  2. Install OpenVPN GUI with default settings
  3. Copy client1.ovpn to C:\Program Files\OpenVPN\config\
  4. Right-click OpenVPN GUI system tray icon
  5. Select your configuration and click “Connect”

macOS Client

  1. Install Tunnelblick from tunnelblick.net
  2. Double-click client1.ovpn file
  3. Tunnelblick will import the configuration
  4. Click Tunnelblick menu bar icon and connect

iOS Client

  1. Install “OpenVPN Connect” from App Store
  2. Transfer client1.ovpn via email, AirDrop, or cloud storage
  3. Open file with OpenVPN Connect app
  4. Import and tap to connect

Android Client

  1. Install “OpenVPN for Android” from Play Store
  2. Transfer client1.ovpn to device
  3. Open app and tap “+” to import configuration
  4. Select profile and tap connect button

Testing VPN Connection

Verify your OpenVPN setup works correctly.

Basic Connectivity Tests

From connected client:

# Check VPN interface exists
ip a show tun0

# Ping VPN server
ping -c 4 10.8.0.1

# Check your public IP (should show server IP)
curl ifconfig.me

# Test DNS resolution
nslookup google.com

# Traceroute to external site
traceroute -n 8.8.8.8

Server-Side Verification

On the server:

# Check connected clients
sudo cat /var/log/openvpn/openvpn-status.log

# View real-time log
sudo tail -f /var/log/openvpn/openvpn.log

# Check client routing table
sudo cat /var/log/openvpn/ipp.txt

Performance Testing

# Install iperf3 on both server and client
sudo apt install iperf3 -y

# On server, start iperf3 server
iperf3 -s

# On client, test VPN throughput
iperf3 -c 10.8.0.1

# Test with different parameters
iperf3 -c 10.8.0.1 -t 30  # 30 second test
iperf3 -c 10.8.0.1 -R     # Reverse direction
Connection Success: If you can ping 10.8.0.1 from the client and your public IP shows the server’s IP address, your VPN is working correctly.

Adding Additional Clients

Generate certificates and configurations for new clients.

Generate New Client Certificate

cd ~/openvpn-ca

# Generate certificate for client2
./easyrsa gen-req client2 nopass

# Sign the certificate
./easyrsa sign-req client client2

# Enter CA passphrase
# Type 'yes' to confirm

Create Configuration File

# Generate .ovpn file for new client
cd ~/client-configs
./make_config.sh client2

# Configuration created at: ~/client-configs/files/client2.ovpn

Distribute to Client

# Transfer securely via SCP
scp ~/client-configs/files/client2.ovpn user@client-machine:~

# Or create downloadable link (temporarily)
cd ~/client-configs/files
python3 -m http.server 8000
# Access via: http://server-ip:8000/client2.ovpn
# STOP server after download: Ctrl+C
Security Warning: Never transfer .ovpn files over unencrypted channels. Use SCP, SFTP, or encrypted messaging. The .ovpn file contains private keys and provides full VPN access.

Revoking Client Certificates

Remove access for compromised or unused certificates.

Revoke Certificate

cd ~/openvpn-ca

# Revoke client certificate
./easyrsa revoke client1

# Enter CA passphrase
# Type 'yes' to confirm revocation

Generate Certificate Revocation List (CRL)

# Generate CRL
./easyrsa gen-crl

# Copy CRL to OpenVPN directory
sudo cp ~/openvpn-ca/pki/crl.pem /etc/openvpn/server/

# Set permissions
sudo chmod 644 /etc/openvpn/server/crl.pem

Enable CRL in Server Configuration

sudo nano /etc/openvpn/server/server.conf

# Add this line:
crl-verify crl.pem

# Restart OpenVPN
sudo systemctl restart openvpn-server@server

Update CRL Regularly

Create a cron job to update CRL:

sudo crontab -e

# Add this line (update CRL daily at 2 AM):
0 2 * * * cd /root/openvpn-ca && ./easyrsa gen-crl && cp pki/crl.pem /etc/openvpn/server/ && systemctl restart openvpn-server@server

Advanced Configuration Options

Split Tunnel Configuration

Route only specific traffic through VPN:

sudo nano /etc/openvpn/server/server.conf

# Comment out full tunnel redirect:
# push "redirect-gateway def1 bypass-dhcp"

# Add specific routes instead:
push "route 192.168.1.0 255.255.255.0"
push "route 10.10.0.0 255.255.0.0"

# Restart service
sudo systemctl restart openvpn-server@server

Client-to-Client Communication

Allow VPN clients to communicate with each other:

sudo nano /etc/openvpn/server/server.conf

# Uncomment or add:
client-to-client

# Restart service
sudo systemctl restart openvpn-server@server

Multiple Concurrent Connections

Allow same certificate to connect from multiple devices:

sudo nano /etc/openvpn/server/server.conf

# Add this line:
duplicate-cn

# Restart service
sudo systemctl restart openvpn-server@server
Security Note: Using duplicate-cn reduces security as you can’t revoke access for individual devices. Better practice: generate unique certificates for each device.

Custom DNS Configuration

Push specific DNS servers to clients:

sudo nano /etc/openvpn/server/server.conf

# Internal DNS server
push "dhcp-option DNS 192.168.1.1"

# Or public DNS
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 8.8.8.8"

# Push search domain
push "dhcp-option DOMAIN internal.company.com"

TCP Mode Configuration

Use TCP instead of UDP (useful for restrictive networks):

sudo nano /etc/openvpn/server/server.conf

# Change protocol to TCP
proto tcp

# Change explicit-exit-notify
# TCP doesn't support explicit-exit-notify
# Remove or comment out: explicit-exit-notify 1

# Update firewall
sudo ufw allow 1194/tcp

# Restart service
sudo systemctl restart openvpn-server@server

Update client configurations to use TCP as well.

Monitoring and Logging

install openvpn server monitoring security hardening and performance optimization

View Connected Clients

# Check status file
sudo cat /var/log/openvpn/openvpn-status.log

# Watch in real-time
watch -n 2 'sudo cat /var/log/openvpn/openvpn-status.log'

Monitor Logs

# Real-time log monitoring
sudo tail -f /var/log/openvpn/openvpn.log

# View last 50 lines
sudo tail -50 /var/log/openvpn/openvpn.log

# Search for specific client
sudo grep "client1" /var/log/openvpn/openvpn.log

# Check for errors
sudo grep "ERROR" /var/log/openvpn/openvpn.log

System Journal Logs

# View OpenVPN service logs
sudo journalctl -u openvpn-server@server -f

# Last 100 lines
sudo journalctl -u openvpn-server@server -n 100

# Since yesterday
sudo journalctl -u openvpn-server@server --since yesterday

Traffic Statistics

# Monitor interface traffic
sudo iftop -i tun0

# View interface statistics
ip -s link show tun0

# Connection details
sudo ss -i tun0

Troubleshooting Common Issues

Connection Refused or Times Out

Solutions:

# Verify OpenVPN is running
sudo systemctl status openvpn-server@server

# Check if listening on correct port
sudo ss -tulpn | grep 1194

# Verify firewall allows traffic
sudo ufw status | grep 1194
sudo firewall-cmd --list-all | grep 1194

# Test UDP connectivity
nc -u -v SERVER_IP 1194

# Check server logs
sudo tail -50 /var/log/openvpn/openvpn.log

TLS Handshake Failed

Solutions:

# Verify certificates are valid
openssl verify -CAfile ~/openvpn-ca/pki/ca.crt ~/openvpn-ca/pki/issued/server.crt

# Check certificate dates
openssl x509 -in /etc/openvpn/server/server.crt -noout -dates

# Verify ta.key direction matches
# Server: key-direction 0
# Client: key-direction 1

# Check cipher compatibility
grep cipher /etc/openvpn/server/server.conf

No Internet Access Through VPN

Solutions:

# Verify IP forwarding enabled
sysctl net.ipv4.ip_forward

# Check NAT rules
sudo iptables -t nat -L POSTROUTING -n -v

# Verify routing on server
ip route show

# Test DNS resolution
nslookup google.com

# Check if redirect-gateway is pushed
grep redirect-gateway /etc/openvpn/server/server.conf

DNS Not Working

Solutions:

# Check DNS push in server config
grep "dhcp-option DNS" /etc/openvpn/server/server.conf

# On Linux client, install resolvconf
sudo apt install openresolv -y

# Test DNS from client
nslookup google.com
dig google.com

# Manually set DNS in client config
nano client.ovpn
# Add: dhcp-option DNS 1.1.1.1

Certificate Verification Failed

Solutions:

# Ensure all certificates signed by same CA
openssl verify -CAfile ca.crt server.crt
openssl verify -CAfile ca.crt client1.crt

# Check certificate common names
openssl x509 -in server.crt -noout -subject
openssl x509 -in client1.crt -noout -subject

# Verify remote-cert-tls in client config
grep remote-cert-tls client.ovpn

High CPU Usage

Solutions:

# Check cipher being used
grep cipher /etc/openvpn/server/server.conf

# Consider using hardware acceleration
# Install: sudo apt install openssl-aes-ni

# Use less CPU-intensive cipher
cipher AES-128-GCM  # Instead of AES-256-GCM

# Disable compression if not needed
# Comment out: compress lz4-v2

Security Hardening

Strengthen Cipher Configuration

sudo nano /etc/openvpn/server/server.conf

# Use strongest available ciphers
cipher AES-256-GCM
ncp-ciphers AES-256-GCM:AES-128-GCM

# Use SHA512 for authentication
auth SHA512

# Require minimum TLS version
tls-version-min 1.2

# Disable weak ciphers in TLS
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384

Limit Connection Attempts

sudo nano /etc/openvpn/server/server.conf

# Add connection limits
max-clients 10

# Limit reconnection attempts
connect-retry-max 3

Enable Additional Logging

sudo nano /etc/openvpn/server/server.conf

# Increase verbosity for debugging
verb 4

# Log client connections
log-append /var/log/openvpn/openvpn.log

# Enable status file
status /var/log/openvpn/openvpn-status.log 10

Implement Fail2Ban Protection

# Install Fail2Ban
sudo apt install fail2ban -y

# Create OpenVPN filter
sudo nano /etc/fail2ban/filter.d/openvpn.conf

# Add:
[Definition]
failregex = .*TLS Error
            .*TLS handshake failed
ignoreregex =

# Configure jail
sudo nano /etc/fail2ban/jail.local

# Add:
[openvpn]
enabled = true
port = 1194
protocol = udp
filter = openvpn
logpath = /var/log/openvpn/openvpn.log
maxretry = 3
bantime = 3600

# Restart Fail2Ban
sudo systemctl restart fail2ban

Backup and Disaster Recovery

Backup PKI and Configurations

# Create backup directory
sudo mkdir -p /root/openvpn-backup

# Backup PKI
sudo tar czf /root/openvpn-backup/pki-backup-$(date +%Y%m%d).tar.gz ~/openvpn-ca/pki/

# Backup server configs
sudo tar czf /root/openvpn-backup/server-config-$(date +%Y%m%d).tar.gz /etc/openvpn/server/

# Backup client configs
tar czf /root/openvpn-backup/client-configs-$(date +%Y%m%d).tar.gz ~/client-configs/

# Transfer to remote location
scp /root/openvpn-backup/*.tar.gz user@backup-server:/backups/openvpn/

Automated Backup Script

sudo nano /usr/local/bin/backup-openvpn.sh

#!/bin/bash
BACKUP_DIR="/root/openvpn-backup"
DATE=$(date +%Y%m%d-%H%M)

mkdir -p $BACKUP_DIR

# Backup PKI
tar czf $BACKUP_DIR/pki-$DATE.tar.gz ~/openvpn-ca/pki/

# Backup configs
tar czf $BACKUP_DIR/configs-$DATE.tar.gz /etc/openvpn/

# Keep only last 30 days
find $BACKUP_DIR -name "*.tar.gz" -mtime +30 -delete

echo "OpenVPN backup completed: $DATE"

# Make executable
sudo chmod +x /usr/local/bin/backup-openvpn.sh

# Schedule daily backup
sudo crontab -e
# Add: 0 3 * * * /usr/local/bin/backup-openvpn.sh

Restore from Backup

# Stop OpenVPN
sudo systemctl stop openvpn-server@server

# Restore PKI
tar xzf /root/openvpn-backup/pki-backup-20240101.tar.gz -C ~/

# Restore server configs
sudo tar xzf /root/openvpn-backup/server-config-20240101.tar.gz -C /

# Fix permissions
sudo chmod 600 /etc/openvpn/server/*.key
sudo chmod 600 /etc/openvpn/server/ta.key

# Restart OpenVPN
sudo systemctl start openvpn-server@server

Performance Optimization

Optimize Network Buffer Sizes

sudo nano /etc/openvpn/server/server.conf

# Add buffer size tuning
sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"

# Optimize fragment size for better throughput
fragment 0
mssfix 0

Enable Fast I/O

sudo nano /etc/openvpn/server/server.conf

# Enable fast I/O
fast-io

# Optimize TUN/TAP queue
txqueuelen 1000

Kernel Parameter Tuning

sudo nano /etc/sysctl.conf

# Add these optimizations:
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.ipv4.tcp_rmem = 4096 87380 67108864
net.ipv4.tcp_wmem = 4096 65536 67108864
net.core.netdev_max_backlog = 5000
net.ipv4.tcp_congestion_control = bbr

# Apply
sudo sysctl -p

Best Practices Summary

  • Use Strong Encryption – AES-256-GCM with SHA256/SHA512 authentication
  • Secure Key Management – Protect CA passphrase, backup regularly
  • Implement CRL – Enable certificate revocation checking
  • Enable TLS Auth – Additional security layer against attacks
  • Unique Certificates – Generate separate cert for each client/device
  • Monitor Connections – Regularly review connected clients
  • Regular Updates – Keep OpenVPN and system packages current
  • Secure Distribution – Transfer .ovpn files only via encrypted channels
  • Log Review – Periodically check logs for suspicious activity
  • Backup Everything – Maintain current backups of PKI and configurations

Conclusion

OpenVPN remains the gold standard for VPN technology, offering unmatched flexibility, security, and compatibility across platforms. While the initial setup requires more steps than modern alternatives like WireGuard, OpenVPN’s mature ecosystem, extensive configuration options, and proven track record make it the preferred choice for enterprise deployments and complex networking scenarios.

This guide has walked you through the complete process of establishing a production-ready OpenVPN server, from PKI infrastructure setup through client configuration and security hardening. The certificate-based authentication model, combined with strong encryption and comprehensive logging, provides robust security suitable for protecting sensitive communications and critical infrastructure.

By implementing the security best practices outlined here—including certificate revocation capabilities, TLS authentication, monitoring, and regular backups—you create a VPN infrastructure that can serve your organization reliably for years. The extensive configuration options allow you to fine-tune OpenVPN for your specific requirements, whether that’s optimizing for performance, implementing strict security policies, or accommodating complex routing scenarios.

Remember that VPN security extends beyond the protocol itself. Regular monitoring, timely certificate rotation, keeping software updated, and maintaining secure key management practices all contribute to a robust security posture. Take time to document your configuration, establish procedures for onboarding and offboarding users, and regularly review access logs to ensure your VPN infrastructure continues serving its intended purpose effectively.

With OpenVPN properly configured and maintained, you’ve established secure communication channels that protect your data, enable remote access, and provide the foundation for secure network connectivity in an increasingly distributed world.


You May Also Like