This guide will walk you through setting up a basic OpenVPN server and client connection using SSL/TLS authentication. You’ll have a working VPN in minutes.
This guide assumes you have already installed OpenVPN on both the server and client machines.
You’ll be prompted for a CA password and Common Name. For testing, you can use simple values.
Keep the CA key (pki/private/ca.key) secure and never share it. This is the root of your PKI security.
2
Generate server certificate and key
Create the server certificate:
./easyrsa build-server-full server nopass
Generate Diffie-Hellman parameters (this may take several minutes):
./easyrsa gen-dh
Optionally, generate an HMAC signature for additional security:
openvpn --genkey secret pki/ta.key
The nopass option creates a key without a password. For production, consider using a password and systemd to manage it securely.
3
Generate client certificate and key
Create a certificate for your first client:
./easyrsa build-client-full client1 nopass
Repeat this step for each client that needs access, using unique names (client2, client3, etc.).
Each client should have its own unique certificate for better security and revocation management.
4
Create server configuration
Copy the certificates to your OpenVPN directory:
sudo mkdir -p /etc/openvpn/serversudo cp pki/ca.crt /etc/openvpn/server/sudo cp pki/issued/server.crt /etc/openvpn/server/sudo cp pki/private/server.key /etc/openvpn/server/sudo cp pki/dh.pem /etc/openvpn/server/sudo cp pki/ta.key /etc/openvpn/server/ # if you created it
Create the server configuration file /etc/openvpn/server/server.conf:
# Listen on UDP port 1194port 1194proto udp# Create a routed IP tunneldev tun# SSL/TLS certificates and keysca ca.crtcert server.crtkey server.keydh dh.pem# Network topologytopology subnet# VPN subnet - server will use 10.8.0.1server 10.8.0.0 255.255.255.0# Maintain client IP associationsifconfig-pool-persist /var/log/openvpn/ipp.txt# Keepalive pingkeepalive 10 120# Persist across restartspersist-tun# Status logstatus /var/log/openvpn/openvpn-status.log# Verbosity levelverb 3# Notify clients when restartingexplicit-exit-notify 1
This is a minimal production-ready configuration based on the official sample configuration.
5
Configure the server system
Enable IP forwarding:
# Temporary (until reboot)echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward# Permanentecho 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.confsudo sysctl -p
On the client machine, create a directory for OpenVPN:
mkdir -p ~/openvpn-clientcd ~/openvpn-client
Copy the following files from the server:
pki/ca.crt
pki/issued/client1.crt
pki/private/client1.key
pki/ta.key (if you created it)
Create the client configuration file client.conf:
# Specify that we are a clientclient# Use the same settings as the serverdev tunproto udp# Server hostname/IP and portremote your-server-ip-or-hostname 1194# Keep trying to resolve the serverresolv-retry infinite# Don't bind to a specific local portnobind# Persist across restartspersist-tun# SSL/TLS certificates and keysca ca.crtcert client1.crtkey client1.key# Verify server certificateremote-cert-tls server# Verbosity levelverb 3
Replace your-server-ip-or-hostname with your actual server’s IP address or domain name.
8
Connect the client
Connect to the VPN:
sudo openvpn --config client.conf
Successful connection output:
Initialization Sequence Completed
Verify the connection:
# Check the TUN interfaceip addr show tun0# Test connectivity to the serverping 10.8.0.1
On macOS and Windows, you may see different interface names (e.g., utun0 on macOS).
Enhance your VPN with these common configuration options:
Route all client traffic through VPN
Add to server configuration:
# Redirect all client traffic through VPNpush "redirect-gateway def1 bypass-dhcp"# Push DNS servers to clientspush "dhcp-option DNS 8.8.8.8"push "dhcp-option DNS 8.8.4.4"
Configure NAT on the server:
# Replace eth0 with your server's internet interfacesudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
Make sure to save iptables rules to persist across reboots.
Allow client-to-client communication
Add to server configuration:
# Allow clients to see each otherclient-to-client
Restart the server to apply changes:
sudo systemctl restart openvpn-server@server
Add HMAC authentication (tls-auth)
If you generated a ta.key file, add to server configuration:
tls-auth ta.key 0
Add to client configuration:
tls-auth ta.key 1
The server uses parameter 0, clients use parameter 1. This adds an HMAC signature to prevent DoS attacks.
Use TCP instead of UDP
Change in both server and client configurations:
proto tcp-server # on serverproto tcp-client # on client
Update firewall:
sudo ufw allow 1194/tcp
TCP is more reliable but has higher overhead than UDP. Use it when UDP is blocked or unreliable.
Drop privileges after startup
Add to server configuration (Linux only):
user openvpngroup openvpn
Create the user:
sudo useradd -r -s /usr/sbin/nologin openvpn
Dropping privileges improves security by limiting what the OpenVPN process can do if compromised.
Assign static IPs to specific clients
Create client config directory:
sudo mkdir -p /etc/openvpn/server/ccd
Add to server configuration:
client-config-dir ccd
Create a file /etc/openvpn/server/ccd/client1:
ifconfig-push 10.8.0.10 255.255.255.0
This assigns 10.8.0.10 to the client named “client1”.
Learn to revoke certificates, renew expired certs, and manage your PKI
Advanced configurations
Explore site-to-site VPNs, bridged mode, and load balancing
Security hardening
Implement TLS-crypt, stronger ciphers, and security best practices
Monitoring
Set up logging, monitoring, and alerting for your VPN infrastructure
For production deployments, consider using configuration management tools like Ansible or Terraform to automate OpenVPN deployment and certificate management.