How to set up a VPN server on Linux with OpenVPN? (Step-by-Step)

OpenVPN服务器搭建需安装OpenVPN与easy-rsa，构建CA并生成密钥证书，配置server.conf、启用IP转发与防火墙规则，最后分发安全的client.ovpn文件。

Setting up an OpenVPN server on Linux is straightforward if you follow the right steps—especially with modern tools like openvpn-install or manual configuration using easy-rsa. The key is generating secure certificates, configuring the server correctly, and enabling network forwarding so clients can reach other devices or the internet.

Install OpenVPN and easy-rsa

Start by updating your system and installing OpenVPN plus the certificate management toolkit:

• On Debian/Ubuntu: sudo apt update && sudo apt install openvpn easy-rsa
• On CentOS/RHEL/Rocky: sudo dnf install epel-release && sudo dnf install openvpn easy-rsa

Easy-RSA helps create a private PKI (public key infrastructure) — essential for authenticating clients and the server securely.

Set up the CA and generate server/client certificates

Copy the Easy-RSA scripts to a working directory and initialize the PKI:

• make-cadir ~/openvpn-ca && cd ~/openvpn-ca
• Edit vars to set your country, organization, etc., then run source vars, ./clean-all, and ./build-ca
• Build the server cert: ./build-key-server server
• Build a client cert: ./build-key client1
• Generate Diffie-Hellman params: ./build-dh
• Optionally add TLS auth: openvpn --genkey --secret keys/ta.key

Keep the keys/ folder safe — it contains all private keys and certs needed for your setup.

Configure the OpenVPN server

Create /etc/openvpn/server.conf with these core settings:

• port 1194 (or another port if 1194 is blocked)
• proto udp (UDP is faster; use tcp only if UDP is filtered)
• dev tun (layer 3 tunneling — preferred over tap for most use cases)
• Point to your keys: ca /home/youruser/openvpn-ca/keys/ca.crt, cert /home/youruser/openvpn-ca/keys/server.crt, key /home/youruser/openvpn-ca/keys/server.key, dh /home/youruser/openvpn-ca/keys/dh2048.pem, tls-auth /home/youruser/openvpn-ca/keys/ta.key 0
• Add server 10.8.0.0 255.255.255.0 to define the VPN subnet
• Push DNS: push "dhcp-option DNS 8.8.8.8"
• Enable client-to-client traffic if needed: client-to-client
• Keep logs clean: log /var/log/openvpn.log, verb 3

Then enable IP forwarding: edit /etc/sysctl.conf and set net.ipv4.ip_forward = 1, then run sudo sysctl -p.

Start the service and configure firewall

Enable and start OpenVPN:

• sudo systemctl enable openvpn@server
• sudo systemctl start openvpn@server
• Check status: sudo systemctl status openvpn@server

Allow traffic through your firewall:

• UFW (Ubuntu): sudo ufw allow 1194/udp and sudo ufw route allow in on eth0 out on tun0
• firewalld (RHEL/CentOS): sudo firewall-cmd --add-port=1194/udp --permanent, then sudo firewall-cmd --add-masquerade --permanent, and reload

Finally, create a client config file (client1.ovpn) combining the client cert, key, CA cert, and TLS auth key — and distribute it securely to users.

Basically, that’s it — no need for third-party services or paid tools. It’s not complex but easy to misconfigure if you skip certificate hygiene or NAT rules. Test with one client first, check logs, and verify routing before scaling up.

The above is the detailed content of How to set up a VPN server on Linux with OpenVPN? (Step-by-Step). For more information, please follow other related articles on the PHP Chinese website!