Security

Install OpenVPN on a VPS at thueVPS, Step-by-Step Guide

BM BizMaC Team Jul 21, 2026 8 min read

Running your own VPN gives you full control over your privacy, encryption, and access rules. When you install OpenVPN on a VPS at thueVPS, you bypass the risks of shared VPN services, no logs kept by a third party, no bandwidth throttling, and no shared IP blacklists. This guide walks you through a production-ready OpenVPN setup on Ubuntu 24.04 LTS. Every command is copy-paste safe, and every step includes a verification check so you know it works.

Prerequisites

  • A Linux VPS running Ubuntu 24.04 LTS (a fresh install is recommended).
  • Root or sudo access to the server.
  • A domain name pointing to the server’s IPv4 address (or use the server’s public IP directly).
  • An SSH client (like ssh on Linux/macOS or Windows Terminal/ PuTTY).
  • Basic familiarity with the terminal and file editing in nano or vim.

Why set up your own OpenVPN server?

A self-hosted OpenVPN server running on a Vietnam VPS with dedicated IPv4 gives you advantages that commercial VPNs cannot match. You choose the encryption cipher, control the logging policy (none if you want none), and assign static IPs to your clients. For developers, this means secure tunnels to staging environments or databases without exposing ports to the public internet. For regular users, it means unthrottled bandwidth and a clean IP that isn’t shared with other users that might have triggered blocks.

When you install OpenVPN on a VPS at thueVPS, you also benefit from NVMe SSD storage and domestic bandwidth, which keeps latency low for connections within Vietnam. The setup described here works with any KVM-based VPS, just adjust the firewall commands if you use a different OS like AlmaLinux.

Step 1, Update the system and install OpenVPN

Start by ensuring the server packages are current. Then install OpenVPN and easy-rsa, the tool we will use to generate the certificate authority and keys.

ssh root@your-server-ip
apt update && apt upgrade -y
apt install openvpn easy-rsa -y

Verify:

openvpn --version | head -n 1

You should see output like OpenVPN 2.6.12 x86_64-pc-linux-gnu (the exact version may differ). If the command returns without error, the install succeeded.

Step 2, Set up the PKI (Public Key Infrastructure)

OpenVPN authenticates clients via certificates, not passwords. Generate a certificate authority (CA) and server certificate in a dedicated directory.

mkdir -p /etc/openvpn/easy-rsa
ln -s /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/
cd /etc/openvpn/easy-rsa

Initialize the PKI and build the CA:

./easyrsa init-pki
./easyrsa build-ca nopass

When prompted for a Common Name, enter something descriptive like thueVPS-OpenVPN-CA. You do not need to set a passphrase (the nopass flag skips it).

Next, generate the server certificate and key:

./easyrsa gen-req server nopass
./easyrsa sign-req server server

The server key and certificate are now ready. Generate Diffie-Hellman parameters (this may take a minute):

./easyrsa gen-dh

Finally, generate a TLS-crypt key for an extra layer of protection against attacks:

openvpn --genkey secret /etc/openvpn/tls-crypt.key

Step 3, Configure the OpenVPN server

Copy the sample configuration file and adapt it for your environment:

cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
gzip -d /etc/openvpn/server.conf.gz
nano /etc/openvpn/server.conf

Adjust the following lines in /etc/openvpn/server.conf:

  • Set port 1194 and proto udp (default values are fine).
  • Uncomment or set tls-crypt /etc/openvpn/tls-crypt.key to enable the pre-shared key.
  • Set the DHCP option to push the DNS server of your choice: push "dhcp-option DNS 1.1.1.1" or push "dhcp-option DNS 208.67.222.222".
  • Uncomment user nobody and group nogroup to drop privileges after startup.

Save the file and exit. Copy the generated certificates and keys to the OpenVPN directory:

cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem /etc/openvpn/

Step 4, Enable IP forwarding and configure the firewall

The server must route traffic from the VPN client network to the internet. Enable IP forwarding:

echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
sysctl -p

Configure ufw to allow OpenVPN traffic and forward client traffic. First, allow SSH (so you don’t lock yourself out):

ufw allow ssh

Allow the OpenVPN port:

ufw allow 1194/udp

Edit the ufw forwarding policy:

nano /etc/ufw/before.rules

Add the following block near the top (before the *filter section):

# NAT (Network Address Translation) for OpenVPN
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT

Save, then reload ufw:

ufw disable && ufw enable

Verify: Run ufw status verbose, you should see 1194/udp listed as allowed.

Step 5, Start and enable OpenVPN

Start the OpenVPN service and enable it to run on boot:

systemctl start openvpn@server
systemctl enable openvpn@server

Verify:

systemctl status openvpn@server

The output must show active (running). Also check that the TUN interface is up:

ip addr show tun0 | grep inet

You should see an IP in the 10.8.0.1 range.

Step 6, Generate a client configuration

Create a certificate and key for each device that will connect. In the easy-rsa directory:

cd /etc/openvpn/easy-rsa
./easyrsa gen-req mylaptop nopass
./easyrsa sign-req client mylaptop

Now build the client .ovpn file. Create a script or do it manually:

mkdir -p /root/client-configs
cat > /root/client-configs/mylaptop.ovpn << 'EOF'
client
dev tun
proto udp
remote YOUR_SERVER_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-crypt /etc/openvpn/tls-crypt.key
ca [inline]
cert [inline]
key [inline]
verb 3
EOF

Replace YOUR_SERVER_IP with your actual server IP or domain. Then embed the certificates:

sed -i 's/ca \[inline\]/#### CA CERT\n\n['"$(cat /etc/openvpn/ca.crt)"']\n<\/ca>/' /root/client-configs/mylaptop.ovpn

Repeat similarly for the client certificate and key, or use a tool like ovpngen for a simpler method. The important thing is that the client .ovpn file contains all three inline: CA, client certificate, and client key.

Note: For production, do not distribute the tls-crypt.key directly inside the .ovpn file, it is a shared secret. Ship it separately. The example above includes it inline for simplicity in a lab; for real use, set tls-crypt on the client side with a separate key file.

Step 7, Import the client config on your device

Copy the .ovpn file to your local machine via SCP or a secure download:

scp root@your-server-ip:/root/client-configs/mylaptop.ovpn ~/Downloads/

Install the OpenVPN client app on your device (available for Windows, macOS, Linux, iOS, Android). Open the app, import the .ovpn file, and connect.

Verify on the server: run journalctl -u openvpn@server -f and watch for the new client connection. A line like … peer connection inititated with … confirms success.

From the client, check your public IP using curl ifconfig.me. The IP should be the same as your VPS server, not your home ISP address.

Troubleshooting common issues

Problem: Client connects but no internet access
Run iptables -t nat -L -n -v on the server. If the MASQUERADE rule is missing, re-check the /etc/ufw/before.rules block and reload ufw. Also verify IP forwarding is active: sysctl net.ipv4.ip_forward must return 1.

Problem: OpenVPN service fails to start
Check journalctl -xeu [email protected]. Common culprits: missing tls-crypt.key, wrong paths in the config, or a port conflict.

Problem: Firewall blocks all traffic
If you enabled ufw before allowing SSH, you might be locked out. Use the VNC or console panel at thueVPS to regain access and re-run the firewall commands.

FAQ

Is OpenVPN secure enough for production use?

Yes. OpenVPN uses TLS for the control channel and AES-256 for the data channel. Combined with TLS-crypt, it mitigates common attack vectors like timing attacks and buffer overflows. It is widely used by enterprises and security-conscious individuals.

Can I use the same VPS for other services?

Yes. OpenVPN runs on port 1194/udp by default and does not conflict with HTTP/HTTPS services. You can host a web server, n8n, or a database on the same VPS. Just ensure your firewall rules are precise.

Do I need a domain name for OpenVPN?

Not strictly. The remote directive in the client config can use the server’s raw IPv4 address. However, a domain helps if the IP changes and easier certificate management.

How do I revoke a client certificate?

Run ./easyrsa revoke clientname in the easy-rsa directory, then regenerate the CRL (Certificate Revocation List) with ./easyrsa gen-crl. Add crl-verify /etc/openvpn/easy-rsa/pki/crl.pem to your server config and restart OpenVPN.

What is the difference between OpenVPN and WireGuard?

WireGuard is newer, has a smaller codebase, and generally offers higher throughput. OpenVPN is older, more audited, and supports TCP fallback, which is useful in restrictive networks (e.g., coffee shop Wi-Fi that blocks UDP). Both are excellent. For this guide, we chose OpenVPN because of its broad client compatibility and mature tooling.

Related articles

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.