Setting up an openvpn server gives you a private, encrypted tunnel for remote access, secure browsing, and bypassing restrictive networks. This guide walks through practical deployment steps, configuration nuances, and ongoing management tasks.
By following a structured approach, you can deploy a stable OpenVPN instance that balances security, performance, and ease of use for laptops, phones, and home office devices.
Deployment Planning and Topology
Before you run any commands, clarify how the server will fit into your network and threat model.
| Deployment Mode | Network Position | Security Level | Typical Use Case |
|---|---|---|---|
| Gateway Mode | Server as default router for clients | High, full tunnel | Remote workers, site-to-site, privacy |
| Split Tunnel | Local LAN access preserved | Medium, selective routing | Office resources plus internet |
| Cloud Host | Public cloud VM | High, depends on provider | Global access, cloud workloads |
| Home Router | Behind NAT on home broadband | Medium, dynamic IPs | Family privacy, remote NAS |
Installing OpenVPN and Easy-RSA
Choose your package manager and install the required components on the server host.
Debian and Ubuntu
Update index packages, then install openvpn and easy-rsa to build certificates and keys.
CentOS and Rocky Linux
Enable PowerTools if needed, then install openvpn and easy-rsa to prepare the PKI infrastructure.
Place the Easy-RSA directory outside the OpenVPN config tree to simplify upgrades and permission management.
Building the Public Key Infrastructure (PKI)
A robust PKI ties certificates, keys, and revocation together, making management predictable.
Configure Easy-RSA Variables
Set KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL in vars so certificates match your environment.
Generate CA, Server, and Client Certificates
Build the CA first, then the server certificate with TLS authentication, followed by individual client certificates and strong Diffie-Hellman parameters.
Export TLS-auth key for extra layer against DoS and port scanning, and keep all signing keys offline when possible.
Configuring the OpenVPN Service
Place server.conf in the proper config directory and tune networking settings for reliable tunnels.
Core Server Options
Define protocol, port, device type, ca, cert, key, dh, tls-auth, and server subnet with consistent paths and permissions.
Routing and Push Rules
Control whether clients route all traffic through the VPN using push "redirect-gateway" or push "route" for selective access.
DNS and Security Hardening
Push DNS servers used by clients, set keepalive to detect dead peers, and enable compression only when endpoints agree on ciphers.
Firewall, Routing, and Service Management
Align host firewall, IP forwarding, and NAT or bridging so traffic reaches the VPN and the broader internet.
IP Tables and NAT
Allow UDP, enable ip_forward, and add a MASQUERADE rule so clients reach external networks through the server host.
Routing and Access Control
Add routes for remote subnets if doing site-to-site links and restrict client access with per-client config snippets or user-group rules.
Starting and Monitoring the Server
Start the service, enable it on boot, and verify logs for handshake errors, MTU issues, or certificate mismatches.
Operational Best Practices and Maintenance
- Rotate certificates before expiry and keep revocation lists up to date for compromised keys.
- Monitor bandwidth, CPU, and memory usage; tune cipher and compression for your workload.
- Automate backups of the PKI, server config, and firewall rules to simplify recovery.
- Document topology, client subnets, and access policies for audits and handovers.
- Schedule periodic reviews of firewall and routing rules as networks evolve.
FAQ
Reader questions
How do I diagnose a client that cannot reach the local network behind the server?
Check IP forwarding, firewall rules, client routes pushed by the server, and test with a ping and traceroute to confirm reachability.
What should I do if the tunnel is slow or MTU issues cause packet drops?
Lower the tunnel MTU, enable or disable compression based on CPU and throughput tests, and measure jitter and latency to choose the best protocol and cipher.
Can I revoke a client certificate and keep the server running without rebuilding the whole PKI?
Yes, generate a CRL with revoked serials, place it on the server, and add crl-verify to the server config so revoked peers are rejected on next handshake.
Will changing server port or protocol break existing client configs?
Yes, clients must update remote host and port to match the new server settings, and any firewall or NAT rules must be updated accordingly.