Install an OpenVPN Server on a KVM VPS

What you need

• A KVM VPS with root access (or a user with sudo). The TUN/TAP device must be available, which KVM provides.
• Basic knowledge of the Linux command line.
• Optional: a domain name that points to the IP address of the server.

The commands below are for Ubuntu or Debian.

Step 1: Update the server

sudo apt update && sudo apt upgrade -y

Step 2: Install OpenVPN and Easy-RSA

sudo apt install openvpn easy-rsa -y

Step 3: Set up the certificate authority (CA)

Make a folder for Easy-RSA and start the PKI:

make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki

(Older guides edit a vars file here. Easy-RSA 3 works with its defaults, and you can set your values in vars if you want to.)

Build the CA:

./easyrsa build-ca nopass

Enter a common name when asked, for example MyVPN-CA.

Step 4: Create the server certificate

./easyrsa gen-req server nopass
./easyrsa sign-req server server

Create the Diffie-Hellman parameters and a TLS key:

./easyrsa gen-dh
sudo openvpn --genkey secret ~/openvpn-ca/ta.key

Copy the files to the OpenVPN folder:

sudo cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem ta.key /etc/openvpn/

Step 5: Configure the OpenVPN server

Create the file /etc/openvpn/server.conf:

sudo nano /etc/openvpn/server.conf

Add:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
cipher AES-256-GCM
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

Save and close (Ctrl + X, Y, Enter).

Step 6: Turn on IP forwarding

sudo nano /etc/sysctl.conf

Remove the # in front of this line:

net.ipv4.ip_forward=1

Apply it:

sudo sysctl -p

Step 7: Firewall rules

Allow SSH and the OpenVPN port, then turn on UFW:

sudo ufw allow 1194/udp
sudo ufw allow OpenSSH
sudo ufw enable

Add NAT so that clients can reach the internet. Find the name of your network interface with ip a (for example eth0). Add these lines at the top of /etc/ufw/before.rules, before the *filter line:

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT

Also set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw, then reload:

sudo ufw reload

Step 8: Start the OpenVPN service

sudo systemctl enable --now openvpn@server
sudo systemctl status openvpn@server

Step 9: Make a client certificate

cd ~/openvpn-ca
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Step 10: Build the client config

Create client1.ovpn on your computer with these lines, and paste the contents of the CA certificate, client certificate, client key and TLS key into the matching blocks:

client
dev tun
proto udp
remote YOUR_SERVER_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
key-direction 1
verb 3
<ca>
...contents of ca.crt...
</ca>
<cert>
...contents of client1.crt...
</cert>
<key>
...contents of client1.key...
</key>
<tls-auth>
...contents of ta.key...
</tls-auth>

Step 11: Connect

Install an OpenVPN client on your device, import client1.ovpn and connect. Check your public IP address. It should now be the IP address of your VPS.

Quick recap

• Install OpenVPN and Easy-RSA, build a CA and the server certificate.
• Configure server.conf, forwarding and the firewall.
• Create a client certificate and .ovpn file, then connect.