How To Set Up an OpenVPN Server on Ubuntu
Goal
In this tutorial, you will install OpenVPN and easy-rsa's certificate infrastructure on an Ubuntu server using a well-established community setup script, open the correct firewall port on both the host and any cloud firewall layer, generate a client .ovpn profile, and verify that a client can actually connect.
Prerequisites
- An Ubuntu 22.04 or 24.04 server with a non-root user that has sudo privileges
- ufw installed and enabled, with SSH access already allowed through it
- The server's public IP address or a DNS name pointing to it
- Basic comfort with SSH and the command line
Let an AI agent do this for you
Copy a ready-made prompt for an AI coding assistant with terminal access to your server (Claude Code, Cursor, or similar) — it can carry out the steps below for you. Review what it plans to run before it executes anything.
OpenVPN is the older of the two mainstream VPN choices for Linux servers. WireGuard is newer, faster, and has a much smaller codebase, and it's the right default for most new deployments. OpenVPN still earns its place when you need broad client compatibility with older or locked-down devices, when a client uses TCP-only networks that block arbitrary UDP, or when an organization's security policy specifically mandates OpenVPN. It's more configurable than WireGuard — separate control over ciphers, authentication methods, and routing modes — but that configurability comes at the cost of a heavier handshake and a more involved setup. This tutorial covers that setup end to end: installing OpenVPN and easy-rsa's certificate infrastructure (PKI), opening the correct firewall port, generating a client profile, and confirming a real client can connect.
Step 1 — Update the server and confirm firewall basics
Start with a fully patched system, and confirm ufw is active with SSH already allowed — you don't want to lock yourself out while adding VPN rules later.
sudo apt update && sudo apt upgrade -y
sudo ufw status verboseIf ufw shows "inactive" or SSH isn't listed as allowed, fix that before continuing: `sudo ufw allow OpenSSH` followed by `sudo ufw enable`.
Step 2 — Download and review the OpenVPN installer script
Setting up OpenVPN by hand means building an easy-rsa PKI, generating a Certificate Authority, issuing a server certificate, writing the server config, enabling IP forwarding, and hand-writing iptables NAT rules — a lot of tedious, error-prone steps. angristan/openvpn-install on GitHub is a widely used, actively maintained open-source script written specifically to automate that process. It's a reasonable, well-established path rather than a shortcut that skips security fundamentals.
“Never pipe a script straight from the internet into a shell as root without reading it first — this applies to any setup script, not just this one. Go to https://github.com/angristan/openvpn-install, read the README for the download command it currently documents (script URLs and flags do change between releases, so use whatever the repo shows today rather than a copied command from an old tutorial), save the script to your home directory, and open it in a pager before running it.”
# after downloading the script per the repo's current README, e.g.:
less openvpn-install.sh # read through it before running anything
chmod +x openvpn-install.sh
sudo ./openvpn-install.shStep 3 — Answer the setup prompts
Tricknowtech VPS Hosting
Dedicated KVM resources and full root access — deployed in under 60 seconds, no ticket required.
Ready to try it yourself?
Create a free account and follow along.