Home

OpenVPN Server: Set up your own VPN server

Security
Difficulty: Advanced
4 min read

Complete tutorial to install and configure an OpenVPN server, in order to create a secure virtual private network.

Back to tutorials

Key takeaways

  • A self-hosted OpenVPN server creates an encrypted tunnel that protects your traffic on untrusted networks (public Wi-Fi) and gives you access to the remote network's resources as if you were physically there. Non-negotiable prerequisite: a static IP address on the server.
  • Manual configuration (certificate authority, keys, firewall rules, routing) is instructive but long and easy to get wrong. Nyr's script runs the whole sequence: installation, CA, server keys, first client, firewall and service startup.
  • The wizard asks five questions: the public IP (auto-detected), the protocol (UDP is generally faster), the port (1194 by default), the DNS servers, and the name of the first client. It produces a client configuration file such as /root/my-laptop.ovpn.
  • That .ovpn file is the only thing to move to the client, via scp. It is then imported as-is into the official OpenVPN Community client (Windows), Tunnelblick (macOS), OpenVPN Connect (Android/iOS), or the openvpn package / NetworkManager on Linux.
  • To manage the lifecycle of your accesses, you simply re-run sudo ./openvpn-install.sh: the script detects the existing installation and offers a menu to add or revoke a user, or to uninstall OpenVPN.
What is a VPN?
A VPN (Virtual Private Network) creates a secure, encrypted "tunnel" for your internet traffic. This protects your data from prying eyes on unsecured networks (such as public Wi-Fi) and lets you access resources on a remote network as if you were physically there. OpenVPN is one of the most robust and reliable solutions for creating a VPN server.

Why use OpenVPN?

  • Open-Source and Audited: The code is public and has been audited multiple times.
  • Highly Configurable: Offers very fine-grained control over encryption protocols, ports and network options.
  • Cross-platform: Clients exist for virtually every operating system (Windows, macOS, Linux, Android, iOS).
  • Solid Security: Uses the OpenSSL library and the TLS protocol for cutting-edge security.

Prerequisites

  • A dedicated Linux server (Ubuntu/Debian recommended), which will be your VPN server.
  • Root access or sudo privileges.
  • A static IP address on the server.

Premium Content

This advanced tutorial is reserved for premium members.

9,90€ / month
  • All advanced tutorials
  • New content every week
  • Progress tracking
  • Cancel anytime
Log in Create an account
MR

Written by

Morgann Riu

Cybersecurity and Linux administration expert. I share my knowledge through free tutorials and training to help system administrators and developers secure their infrastructures.

My profile LinkedIn GitHub

Frequently asked questions

Should I configure OpenVPN by hand or use a script?
By hand you have to set up the certificate authority, generate and sign the server and client certificates, and write the firewall and routing rules: an excellent learning exercise, but long and easy to break on a single detail. Nyr's script runs that sequence consistently and hands you a working server in a few minutes. For a first installation, take the script; keep the manual route for understanding what it did.
How do I add or revoke a client once the server is in production?
Do not start a fresh installation: just re-run sudo ./openvpn-install.sh. The script detects the existing setup and switches to a management menu that lets you add a new user (generating their .ovpn), revoke an existing user, or uninstall OpenVPN. Revocation is the right answer to a lost laptop or someone leaving.
Why does the server need a static IP address?
Because the server address is hard-coded into every .ovpn file handed out to clients. If the public IP changes, every already-deployed profile points at nothing and no client can connect — you then have to regenerate and redistribute the configurations one by one. It is also what lets you cleanly open port 1194/UDP on the firewall.
Does a self-hosted VPN make me anonymous online?
No, and this is a common confusion. It does encrypt your connection and hide your IP behind the server's from the sites you visit, which solves the untrusted Wi-Fi problem. But your hosting provider (OVH, Scaleway, DigitalOcean...) can see that you connect to your server, and all outbound traffic carries an IP that is registered in your name. For actual anonymity, a commercial no-logs service is a better fit.
How do I transfer the .ovpn file without compromising the VPN?
That file contains the client keys: anyone who gets hold of it can connect to your VPN. It must therefore never travel over email, chat or an HTTP link. Use scp from your local machine, for example scp root@SERVER_IP:/root/my-laptop.ovpn ., which goes through the already encrypted and authenticated SSH channel. If a profile ever leaks, revoke it from the installation script menu.

Share this tutorial

X LinkedIn WhatsApp

Did you enjoy this article?

Was this article helpful?

Thanks for your feedback!

Comments

Recommended for you

Sécurité

WireGuard : VPN simple et performant

 Sécurité

UFW : Pare-feu simple pour Linux

 Sécurité

iptables : Configurer un Pare-feu sur Linux

 Sécurité

FTPS : Sécuriser les transferts FTP avec SSL/TLS

Checklist Sécurité Linux

30 points essentiels pour sécuriser un serveur Linux. Recevez aussi les nouveaux tutoriels par email.

Pas de spam. Désabonnement en 1 clic.

← Back to home
↑