How to Set Up OpenVPN Server on VPS for Secure Internet

Using public Wi-Fi at a coffee shop, airport, or hotel without encryption is a risk that many people underestimate. Login credentials, passwords, and session tokens can be intercepted through Man-in-the-Middle attacks or packet sniffing. The most cost-effective solution is to host your own OpenVPN server on a VPS — you get a private VPN that is not shared with strangers, has no suspicious logging policies, and is 100% under your control.

This guide walks you through turning your Ubuntu VPS into a fully functional OpenVPN server, from installation through certificate creation and client configuration, with hardening tips for maximum security.

Why Self-Host OpenVPN on a VPS?

OpenVPN is an open-source VPN solution that uses OpenSSL to encrypt traffic with AES-256 — military-grade encryption. It supports both UDP and TCP, making it more flexible than many other VPN protocols when it comes to bypassing firewalls. Here are the key reasons to run it on your own VPS:

• True privacy — You own the server. No third party is logging your activity.
• No expensive monthly subscription — A VPS costing a few hundred baht per month gives you unlimited VPN access at no extra charge.
• Control your IP — The VPS IP is what destination servers see, useful for testing your applications from a specific geographic location.
• Multi-user support — Issue separate certificates to each team member at no additional cost.
• Universal client support — Free OpenVPN clients exist for Windows, macOS, Linux, iOS, and Android.

Prerequisites

Before you begin, confirm you have the following:

Step 1 — Update the System and Install OpenVPN with Easy-RSA

SSH into your VPS as root and start by updating the package list and installing OpenVPN along with Easy-RSA. Easy-RSA is a Certificate Authority (CA) management toolkit that handles the authentication layer OpenVPN relies on.

# Update package list and upgrade installed packages
apt update && apt upgrade -y

# Install OpenVPN and Easy-RSA
apt install -y openvpn easy-rsa

# Verify installation
openvpn --version
ls /usr/share/easy-rsa/

Next, create a dedicated directory for your PKI (Public Key Infrastructure). Keeping it separate makes backups and certificate management much cleaner.

# Create Easy-RSA working directory
mkdir -p /etc/openvpn/easy-rsa
cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/
cd /etc/openvpn/easy-rsa

Step 2 — Build the Certificate Authority and Server Certificate

Easy-RSA makes it straightforward to create a CA and issue certificates without having to write raw OpenSSL commands. Follow these steps in order:

cat > /etc/openvpn/server/server.conf << 'EOF'
# Network settings
port 1194
proto udp
dev tun

# Certificate files
ca   /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key  /etc/openvpn/server/server.key
dh   /etc/openvpn/server/dh.pem

# TLS authentication
tls-auth /etc/openvpn/server/ta.key 0
tls-version-min 1.2
cipher AES-256-GCM
auth SHA256

# VPN subnet — assigns IPs in the 10.8.0.x range to clients
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt

# Route all client traffic through the VPN
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 8.8.8.8"

# Keepalive
keepalive 10 120
compress lz4-v2
push "compress lz4-v2"

# Drop privileges after startup
user nobody
group nogroup
persist-key
persist-tun

# Logging
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
EOF

# Create log directory
mkdir -p /var/log/openvpn

# Enable IP forwarding permanently
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

# Confirm it is active (should output: 1)
cat /proc/sys/net/ipv4/ip_forward

# Find the default network interface
ip route | grep default
# Example output: default via 192.168.1.1 dev eth0
# → interface is eth0