OpenVPN

OpenVPN is a time-tested VPN protocol. It’s slower and heavier than WireGuard, but practically every client and piece of corporate hardware understands it. On a Lumi VPS (Ubuntu 22.04 by default, you connect as root over SSH) it deploys with a single script.

Commands are current as of writing. Script names and flags change from time to time — check the official repo angristan/openvpn-install.

OpenVPN or WireGuard

Pick OpenVPN if	Pick WireGuard if
You need maximum compatibility with old software and routers	Speed and simplicity matter
You connect from networks that throttle non-standard protocols (it can run over TCP/443)	You want a lightweight, modern tunnel
You already have OpenVPN infrastructure	You’re setting up from scratch for yourself

If there’s no particular reason, WireGuard is usually faster and simpler. People choose OpenVPN for compatibility and legacy reasons.

Installation

Two paths: a ready-made script (quick) or manual (full control). The script is enough for most people.

Script — quick and easy
Manual — full control

The script will install OpenVPN, set up the certificates, and hand you a ready client file.

Connect to the server over SSH

Take the IP and root password from the server card in the bot.

ssh root@YOUR_SERVER_IP

Download and make the script executable

curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh

Run the installer

./openvpn-install.sh

The script will ask a few questions: the external IP, the protocol (UDP is faster, TCP gets through restrictions better), the port, DNS for clients, and the name of the first client. Not sure — leave the defaults.

Grab the client file

The ready .ovpn file appears in the home folder (for root — /root). The script shows the path on screen. Move the file to your device, for example via scp:

scp root@YOUR_SERVER_IP:/root/client_name.ovpn .

Add or remove a client. Each device gets its own .ovpn. Run the script again — a management menu appears:

./openvpn-install.sh

From the menu you can add a new client, revoke an existing one, or uninstall OpenVPN entirely.

The script works on: Ubuntu (≥ 18.04), Debian (≥ 11), CentOS Stream (≥ 8), AlmaLinux (≥ 8), Rocky Linux (≥ 8), Fedora (≥ 40), Oracle Linux (≥ 8), Amazon Linux 2023, Arch Linux, openSUSE. It needs root access, systemd, and the TUN module enabled — a Lumi VPS has all of this.

For those who want to understand every step.

Install the packages

apt update && apt install -y openvpn easy-rsa

Create the PKI and certificates

make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-dh

Copy the keys to /etc/openvpn

cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem /etc/openvpn/

Create the server config and start it

Copy the example config (/usr/share/doc/openvpn/examples/) to /etc/openvpn/server.conf, set the paths to the keys, and start the service:

systemctl enable --now openvpn@server

The manual method also needs NAT rules and IP forwarding enabled. The script in the other tab does this for you — if you’d rather not fuss with it, pick the script.

Verify

Make sure the service is running:

systemctl status openvpn

You should see active (running).

If you chose a non-standard port during installation, open it in the firewall. For the UDP protocol on the standard port:

ufw allow 1194/udp

Substitute your own port and protocol (udp/tcp) if you changed them during installation. More details — Firewall (ufw).

Connecting devices

Install the official OpenVPN Connect client and import the .ovpn file:

Desktop

Windows / macOS / Linux — openvpn.net/clientIn the app: Import Profile → select the .ovpn file → connect.

Mobile

iOS — App Store (“OpenVPN Connect”)Android — Google Play (“OpenVPN Connect”)

What Lumi handles, and what you do

Lumi handles the server and network: the VPS is up, you have root access, and traffic is unlimited. Setting up the VPN software itself is on you — it’s your personal service. If a port won’t open or the network won’t come up on the server side, message support at @lumisup_robot.

OpenVPN or WireGuard

Installation

Verify

Connecting devices

Desktop

Mobile

What Lumi handles, and what you do

Where to next

WireGuard

Amnezia

​OpenVPN or WireGuard

​Installation

​Verify

​Connecting devices

Desktop

Mobile

​What Lumi handles, and what you do

​Where to next

WireGuard

Amnezia

OpenVPN or WireGuard

Installation

Verify

Connecting devices

What Lumi handles, and what you do

Where to next