Skip to main content
OpenVPN is a classic VPN protocol: it can run over TCP/443, and almost any client, router, and piece of corporate hardware understands it. Without a specific reason pick WireGuard: it is usually faster and simpler.

​
Installation

The script installs OpenVPN, sets up the certificates and NAT, and issues a client file. It works on Ubuntu 18.04+, Debian 11+, AlmaLinux, Rocky Linux, and CentOS Stream 8+.
  1. SSH – connect as root, the IP and password are on the server card: Connection.
  2. Script – angristan/openvpn-install, download and run it:
  3. Questions – external IP, protocol, port, DNS for clients, and the first client’s name. If unsure, leave the defaults. UDP is faster, TCP gets through restrictions better.
  4. Client file – the script saves the .ovpn to the home folder, /root for root, and shows the path. Download the file to your device, for example with scp from your computer:

​
Manual installation

Instead of the script, if you want full control. Commands for Ubuntu and Debian.
Besides these steps you need NAT rules and IP forwarding enabled. The script sets them up itself.
  1. Packages:
  2. Certificates – create the PKI and copy the keys to /etc/openvpn:
  3. Config and start – copy the example from /usr/share/doc/openvpn/examples/ to /etc/openvpn/server.conf, set the paths to the keys, and start the service:

​
Port

Open the OpenVPN port in the firewall, otherwise clients will not connect. The standard one is 1194/udp. If you changed the port or protocol during installation, use yours:
More: Firewall.

​
Clients

Install the official OpenVPN Connect client:
  • Windows, macOS, Linux – openvpn.net/client.
  • iOS – App Store.
  • Android – Google Play.
In the app: Import Profile → the .ovpn file → connect. Each device needs its own .ovpn: run ./openvpn-install.sh again and add a client. The same menu revokes a client or uninstalls OpenVPN entirely.

​
Troubleshooting

  • Service status – the output should show active (running):
    On AlmaLinux, Rocky, and CentOS the service is called openvpn-server@server.
  • Client does not connect – check that the port and protocol from the installation are open in the firewall.
  • Port will not open or the server has no network – write to @lumisup_robot. Support handles the server and network, the VPN is on you.
Next: WireGuard, Amnezia.