How to Set Up OpenVPN on a Dedicated Server (2026 Guide)

What You'll Need

• A dedicated server running Ubuntu 24.04 LTS (Noble Numbat) or Ubuntu 26.04 LTS (Resolute Raccoon), Canonical's current long-term support releases. Debian 12 works with the same steps with minor package-name differences.
• Root or sudo access via SSH.
• The TUN/TAP kernel module enabled on your server. Most dedicated server providers enable this by default on KVM and bare-metal instances; if OpenVPN fails to start later, this is the first thing to check with your host.
• A public IPv4 address (or IPv6, if your provider supports it) reachable from the internet.
• Roughly 15–20 minutes.

Choosing Your Installation Method

There are two reliable paths:

• Scripted install — uses a maintained installer that automates Easy-RSA certificate generation and server hardening. Best for most people.
• Manual install — you configure Easy-RSA and the server config by hand. Best if you want to understand or customize every setting.

Both are covered below.

Method 1: Scripted Install (Recommended for Most Users)

The most widely used community installer for this is angristan/openvpn-install, an actively maintained bash script that supports Debian, Ubuntu, Fedora, CentOS, Rocky Linux, AlmaLinux, Oracle Linux, and Arch. It generates certificates through Easy-RSA, applies current TLS and cipher defaults, and produces a ready-to-import client profile.

Step 1: Download and Run the Script

curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
sudo ./openvpn-install.sh

Step 2: Answer the Setup Prompts

The script will ask you to confirm or set:

• Public IP or hostname: It auto-detects your server's public IP; confirm it's correct, especially if the server sits behind NAT.
• Protocol: UDP is faster and the default recommendation; choose TCP only if UDP is blocked on your network (e.g., some restrictive corporate or hotel networks).
• Port: The default OpenVPN port is 1194, but you can pick a custom port to reduce automated scanning noise.
• DNS resolver for clients: You can use your server's own resolver or push a public resolver to connected clients.
• Cipher suite: The script defaults to modern authenticated encryption (AES-GCM family) with ECDHE key exchange, which is appropriate for nearly all use cases. Elliptic-curve Diffie-Hellman (ECDH) is used instead of classic DH because key generation is faster and the resulting keys are ephemeral.
• Client name: The identifier for your first client certificate.

Step 3: Retrieve the Client Configuration

Once the script finishes, it generates a .ovpn file in your home directory (e.g., /root/client.ovpn). Copy this off the server securely:

scp root@your-server-ip:/root/client.ovpn ./

Method 2: Manual Setup with Easy-RSA

If you want to see (and control) every moving part, here's the manual process.

Step 1: Install OpenVPN and Easy-RSA

sudo apt update
sudo apt install openvpn easy-rsa -y

On Ubuntu 24.04/26.04 this installs the distribution's packaged OpenVPN build from the 2.6.x branch. If you specifically want the newest upstream release (2.7.x, current as of mid-2026), add the official OpenVPN APT repository listed in the OpenVPN Community Wiki instead of relying on the default Ubuntu archive.

Step 2: Set Up the Certificate Authority

make-cadir ~/openvpn-ca
cd ~/openvpn-ca

Edit vars to set your organization details, then initialize the PKI and build the CA:

./easyrsa init-pki
./easyrsa build-ca nopass

Step 3: Generate the Server Certificate and Key

./easyrsa gen-req server nopass
./easyrsa sign-req server server

Step 4: Generate Diffie-Hellman Parameters and a TLS Auth Key

./easyrsa gen-dh
openvpn --genkey secret ta.key

The ta.key (or tls-crypt key, which is the current recommended alternative) adds an extra HMAC layer that helps the server silently drop unauthenticated packets — useful for reducing exposure to port scans and DoS attempts.

Step 5: Generate a Client Certificate

./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Step 6: Configure the Server

Copy the sample server config as a starting point:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/server/

Then edit /etc/openvpn/server/server.conf to point to your generated certificates and keys, and set current security-conscious defaults:

port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh.pem

tls-crypt ta.key

cipher AES-256-GCM
auth SHA256
tls-version-min 1.2

server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"

keepalive 10 120
persist-key
persist-tun

user nobody
group nogroup

Step 7: Enable IP Forwarding

sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
sudo sysctl -p

Step 8: Configure the Firewall (UFW example)

sudo ufw allow 1194/udp
sudo ufw allow OpenSSH
sudo ufw enable

You'll also need a NAT masquerade rule so clients can reach the internet through the server. Add this to /etc/ufw/before.rules above the *filter line, adjusting the interface name (eth0) to match your server:

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT

Then set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw and restart UFW.

Step 9: Start and Enable the Service

sudo systemctl start openvpn-server@server
sudo systemctl enable openvpn-server@server

Check that it's running cleanly:

sudo systemctl status openvpn-server@server

Step 10: Build the Client Config File

Combine the client cert, key, CA cert, and ta.key into a single .ovpn file so it's portable across desktop and mobile clients. A minimal client template looks like:

client
dev tun
proto udp
remote your-server-ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
tls-version-min 1.2
key-direction 1

<ca>
[contents of ca.crt]
</ca>
<cert>
[contents of client1.crt]
</cert>
<key>
[contents of client1.key]
</key>
<tls-crypt>
[contents of ta.key]
</tls-crypt>

Testing the Connection

• Import the .ovpn file into your client of choice — OpenVPN Connect, Tunnelblick on macOS, or the OpenVPN client built into most Linux network managers.
• Connect, then verify your public IP has changed by visiting an IP-check site.
• Run a DNS leak test to confirm DNS queries are routing through the server rather than your ISP's resolver.

Common Issues

• Connection times out: Usually a firewall or security group blocking your chosen UDP/TCP port at the provider level, separate from UFW. Check your hosting control panel for a network-level firewall.
• TUN device errors on start: The TUN module isn't enabled on the host; contact your dedicated server provider, since this is often a hypervisor-level setting on KVM/OpenVZ platforms.
• Clients connect but have no internet access: Almost always a missing or misconfigured NAT masquerade rule, or IP forwarding not actually enabled after a reboot (confirm with sysctl net.ipv4.ip_forward).

Keeping the Server Updated

OpenVPN ships regular security and bug-fix releases — the 2.6.x branch and the newer 2.7.x branch both receive active updates. Keep the package current with your distribution's package manager:

sudo apt update && sudo apt upgrade openvpn -y

If you used the script, note that it doesn't self-update an existing install — reinstalling via the script isn't necessary for a security patch, since a standard apt upgrade covers the OpenVPN binary itself; the script is only for the initial setup and certificate management.

Whichever method you choose, the fundamentals stay the same: strong certificate-based authentication through Easy-RSA, authenticated encryption (AES-GCM) over TLS 1.2+, and a firewall that only exposes the port you actually need.