Install OpenVPN Server on an Ubuntu VPS

Introduction

Virtual Private Networks (VPNs) have become essential tools for ensuring online privacy and security. OpenVPN is a widely used, open-source VPN solution that provides robust security features. In this tutorial, we will guide you through the process of installing an OpenVPN server on an Ubuntu VPS and discuss the benefits of having a self-hosted VPN. By the end of this guide, you will have a fully functional VPN server, allowing you to browse securely and privately from anywhere in the world.

Section 1: Understanding VPN and OpenVPN

1.1 What is a VPN?

A laptop connected to a server through an encrypted tunnel

A Virtual Private Network (VPN) is a service that encrypts your internet connection and hides your online identity, making it difficult for third parties to track your activities. VPNs are widely used to secure communications over potentially insecure networks, such as public Wi-Fi, and to bypass geo-restrictions and censorship. By routing your internet traffic through a secure tunnel to a remote server, a VPN ensures that your data remains private and secure.

1.2 Why use a VPN?

VPNs provide several key benefits, including enhanced privacy, security, and unrestricted access to the internet. They mask your IP address, making it harder for websites and advertisers to track your online behavior. VPNs also encrypt your data, protecting it from hackers and other malicious entities, especially when using public Wi-Fi networks. Additionally, VPNs allow you to bypass geographic restrictions and access content that may be blocked in your region, such as streaming services and websites.

1.3 Introduction to OpenVPN

OpenVPN is an open-source VPN protocol that provides secure point-to-point or site-to-site connections. It is highly configurable and known for its robust security features, including support for a wide range of encryption algorithms and authentication methods. OpenVPN can be used in a variety of configurations, from securing remote access for individual users to creating site-to-site VPNs for connecting multiple networks. Its flexibility and strong security make it a popular choice for both personal and enterprise use. For more information, visit the OpenVPN official website.

1.4 Differences between self-hosted and commercial VPNs

Self-hosted VPNs offer greater control and privacy compared to commercial VPN services. When you host your own VPN, you have full control over the server, including its configuration, security settings, and the data that passes through it. This eliminates the need to trust a third-party provider with your data. Additionally, self-hosted VPNs can be more cost-effective in the long run, as they avoid recurring subscription fees associated with commercial services. However, self-hosting requires technical knowledge and ongoing maintenance to ensure the server remains secure and functional.

Section 2: Preparing Your Ubuntu VPS

2.1 Choosing a VPS provider

Selecting a reliable VPS provider is crucial for the performance and reliability of your VPN server. Some popular options include DigitalOcean, AWS, and Linode. These providers offer a range of plans to suit different needs and budgets, with features like scalable resources, high uptime guarantees, and robust security measures. When choosing a provider, consider factors such as server location options, customer support quality, and additional features like automated backups and DDoS protection.

2.2 Minimum system requirements

Ensure your VPS meets the minimum requirements for running an OpenVPN server: at least 1 CPU core, 1 GB of RAM, and 10 GB of storage. These specifications are sufficient for small to medium-sized deployments. For larger deployments or higher traffic volumes, consider upgrading to a VPS with more CPU cores, RAM, and storage to ensure optimal performance.

2.3 Setting up your VPS

Once you have chosen a VPS provider and plan, follow their instructions to set up your VPS and gain SSH access. Typically, this involves creating an account, selecting a server plan, and deploying an Ubuntu image. After deployment, you will receive the VPS's IP address and SSH login credentials. Use an SSH client like PuTTY (Windows) or the terminal (Linux/macOS) to connect to your VPS. For example:

ssh root@your_vps_ip

2.4 Updating and upgrading the system

Before installing OpenVPN, it's important to ensure your system is up to date. Run the following commands to update the package lists and upgrade installed packages to their latest versions:

sudo apt update
sudo apt upgrade

These commands will fetch the latest package information and apply any available updates, improving the security and stability of your system.

Section 3: Installing OpenVPN on Ubuntu

3.1 Installing necessary packages

To install OpenVPN and its dependencies, run the following command:

sudo apt install openvpn easy-rsa

This command installs OpenVPN, a versatile VPN daemon, and Easy-RSA, a utility for managing SSL certificates. These packages are essential for setting up and securing your VPN server.

3.2 Setting up the OpenVPN repository

To ensure you have the latest version of OpenVPN, add the official OpenVPN repository to your system:

wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | sudo apt-key add -
sudo add-apt-repository "deb http://build.openvpn.net/debian/openvpn/release/2.4 bionic main"
sudo apt update

These commands download and add the repository's GPG key, add the repository to your sources list, and update your package lists. This ensures that you can install the latest stable release of OpenVPN.

3.3 Installing OpenVPN

With the repository added, install OpenVPN by running:

sudo apt install openvpn

This command installs the OpenVPN package from the official repository, ensuring you have the most recent version with all the latest features and security patches.

3.4 Configuring the server

Copy the sample server configuration file and decompress it:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
sudo gzip -d /etc/openvpn/server.conf.gz

Open the configuration file for editing:

sudo nano /etc/openvpn/server.conf

Modify the configuration file to suit your needs. Key parameters to set include the port, protocol, and paths to your certificates. Detailed configuration instructions can be found in the OpenVPN documentation.

Section 4: Generating Server and Client Certificates

4.1 Installing Easy-RSA

Easy-RSA is a toolkit for managing SSL certificates. It simplifies the process of setting up a certificate authority (CA) and generating certificates for your server and clients. Install Easy-RSA by running:

sudo apt install easy-rsa

This command installs Easy-RSA from the Ubuntu repositories.

4.2 Configuring Easy-RSA

Create a new directory for Easy-RSA and navigate to it:

make-cadir ~/openvpn-ca
cd ~/openvpn-ca

This directory will contain all the files necessary for managing your CA and generating certificates.

4.3 Building the Certificate Authority (CA)

Initialize the Easy-RSA variables and build the CA:

source vars
./clean-all
./build-ca

Follow the prompts to set up your CA. These steps create the CA's private key and certificate, which will be used to sign all other certificates.

4.4 Generating server certificate and key

Generate the server's certificate and key:

./build-key-server server

Follow the prompts, ensuring you use the same Common Name (CN) throughout the process. This command generates the server's private key and certificate, signed by your CA.

4.5 Generating client certificates and keys

Generate a certificate and key for a client:

./build-key client1

Repeat this process for each client that will connect to your VPN. Each command generates a unique certificate and key for a client, signed by your CA.

Section 5: Configuring OpenVPN

5.1 Creating server configuration file

Open the OpenVPN server configuration file for editing:

sudo nano /etc/openvpn/server.conf

This file contains the settings for your OpenVPN server. Customize it to suit your needs, setting parameters such as port, protocol, and paths to certificates.

5.2 Understanding and setting essential parameters

Key parameters in the server configuration file include:

port: The port on which the OpenVPN server will listen (default is 1194).
proto: The protocol to use (udp or tcp).
dev: The virtual network interface (typically tun).
ca, cert, key, dh: Paths to the CA certificate, server certificate, server key, and Diffie-Hellman parameters.
server: The IP range for VPN clients.

For detailed explanations of each parameter, refer to the OpenVPN manual.

5.3 Configuring network settings

Enable IP forwarding by editing the sysctl configuration file:

sudo nano /etc/sysctl.conf

Uncomment the following line:

net.ipv4.ip_forward=1

Apply the changes:

sudo sysctl -p

Configure firewall rules to allow VPN traffic:

sudo ufw allow 1194/udp
sudo ufw allow OpenSSH
sudo ufw enable

These commands open the necessary ports for OpenVPN and SSH.

5.4 Setting up IP forwarding and firewall rules

In addition to enabling IP forwarding, you need to set up firewall rules to route traffic through the VPN:

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
sudo sh -c 'iptables-save > /etc/iptables.rules'

These commands configure NAT for VPN traffic, ensuring it can reach the internet.

5.5 Starting and enabling the OpenVPN service

Start the OpenVPN service and enable it to start on boot:

sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server

Verify that the service is running:

sudo systemctl status openvpn@server

The service should be active and running, indicating that your OpenVPN server is ready to accept connections.

Section 6: Configuring Clients

6.1 Installing OpenVPN client on different operating systems

To connect to your OpenVPN server, you need to install the OpenVPN client on your devices. Here are installation instructions for different operating systems:

Windows: Download and install the OpenVPN client from the OpenVPN website.
macOS: Use Tunnelblick, a free, open-source OpenVPN client for macOS.
Linux: Install the OpenVPN package using your distribution's package manager (e.g., sudo apt install openvpn on Ubuntu).

6.2 Transferring client configuration files

Transfer the client configuration file (.ovpn) and certificates to your client device. Use SCP (secure copy) for secure file transfer:

scp client1.ovpn user@client_ip:/path/to/config/

Replace user with your client device's username and client_ip with its IP address. This command copies the configuration file to the specified directory on your client device.

6.3 Connecting to the OpenVPN server

Use the OpenVPN client to connect to your server. On Windows, launch the OpenVPN GUI and import the .ovpn file. On macOS, open Tunnelblick, import the configuration file, and connect. On Linux, use the following command:

sudo openvpn --config /path/to/client1.ovpn

This command starts the OpenVPN client using the specified configuration file. Once connected, your device will route its internet traffic through the VPN server, ensuring a secure and private connection.

Section 7: Testing and Troubleshooting

7.1 Verifying the server status

Check the status of the OpenVPN server to ensure it is running properly:

sudo systemctl status openvpn@server

The output should indicate that the service is active and running. If there are any issues, the status output will provide information to help diagnose the problem.

7.2 Checking the client connection

After connecting a client to the VPN, verify that the connection is established and functioning correctly. Check the client's IP address to confirm it is using the VPN:

curl ifconfig.me

This command returns the client's public IP address. If the VPN is working, the IP address should be that of the VPN server, not the client's original IP.

7.3 Common issues and solutions

Some common issues when setting up OpenVPN include:

Connection Refused: Ensure the OpenVPN server is running and the correct port is open in the firewall.
Authentication Failure: Verify that the client certificates and keys match those on the server.
Network Issues: Check IP forwarding and firewall rules to ensure traffic is properly routed.

Refer to the OpenVPN troubleshooting guide for more detailed solutions.

Section 8: Enhancing Security

8.1 Implementing advanced security measures

Enhance the security of your VPN server by implementing additional measures such as two-factor authentication (2FA) and intrusion detection systems (IDS). Tools like Duo Security can add 2FA to your VPN, while IDS tools like Snort can help detect and respond to malicious activity.

8.2 Regular updates and patches

Keep your system and software up to date to protect against vulnerabilities. Regularly update your Ubuntu system and OpenVPN package by running:

sudo apt update
sudo apt upgrade

This ensures you have the latest security patches and feature updates.

8.3 Using strong encryption methods

Ensure your OpenVPN server uses strong encryption methods. Configure the server to use AES-256 encryption and 2048-bit or higher RSA keys. Adjust the server configuration file:

cipher AES-256-CBC
dh dh2048.pem

These settings enhance the security of your VPN connection.

8.4 Monitoring and logging

Implement monitoring and logging to keep track of VPN usage and detect potential issues. Use tools like Graylog or Grafana for centralized logging and monitoring. Configure OpenVPN to log connection data:

log /var/log/openvpn.log

Regularly review logs to identify and address any suspicious activity.

Section 9: Benefits of a Self-Hosted VPN

9.1 Enhanced privacy and control

A self-hosted VPN gives you full control over your data and privacy settings. Unlike commercial VPN services, which may log and track user activity, a self-hosted VPN allows you to manage and secure your own data. This ensures that your online activities remain private and under your control.

9.2 Customization and flexibility

Customize the VPN server to meet your specific needs and preferences. You can configure the server to support multiple clients, set up custom routing rules, and implement advanced security measures. This flexibility allows you to create a VPN solution tailored to your unique requirements.

9.3 Cost-effectiveness

Save money in the long run by avoiding subscription fees for commercial VPN services. While there is an initial investment in setting up a VPS and configuring the VPN server, the ongoing costs are typically lower than those of commercial services. This makes a self-hosted VPN a cost-effective solution for individuals and small businesses.

9.4 Increased security

Implement and manage your own security measures to ensure the highest level of protection. By hosting your own VPN, you can control the encryption methods used, enforce strong authentication, and regularly update the server to address vulnerabilities. This level of control is not always possible with commercial VPN services.

Conclusion

Setting up a self-hosted OpenVPN server on an Ubuntu VPS provides enhanced privacy, control, and security. This comprehensive guide has covered the necessary steps to install and configure OpenVPN, as well as the benefits of managing your own VPN server. By following this tutorial, you can enjoy a secure and customizable VPN solution tailored to your needs. For further assistance and advanced configurations, refer to the OpenVPN community resources.

Appendices

Appendix A: Sample Configuration Files

Sample server configuration file (/etc/openvpn/server.conf):

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-256-CBC
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
verb 3

Sample client configuration file (client1.ovpn):

client
dev tun
proto udp
remote your_vps_ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
verb 3

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----

Appendix B: Useful Commands

sudo systemctl start openvpn@server - Start the OpenVPN server.
sudo systemctl stop openvpn@server - Stop the OpenVPN server.
sudo systemctl restart openvpn@server - Restart the OpenVPN server.
sudo systemctl status openvpn@server - Check the status of the OpenVPN server.
sudo ufw allow 1194/udp - Open the OpenVPN port in the firewall.
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE - Set up NAT for VPN traffic.
sudo sysctl -p - Apply sysctl configuration changes.
scp client1.ovpn user@client_ip:/path/to/config/ - Transfer the client configuration file to a client device.

Appendix C: Troubleshooting Guide

Connection Refused:

Ensure the OpenVPN server is running and the correct port is open in the firewall. Use sudo systemctl status openvpn@server to check the server status and sudo ufw allow 1194/udp to open the port.

Authentication Failure:

Verify that the client certificates and keys match those on the server. Check the server log for errors using cat /var/log/openvpn.log.

Network Issues:

Ensure IP forwarding is enabled and firewall rules are correctly configured. Use sudo sysctl -p to apply IP forwarding settings and sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE to set up NAT for VPN traffic.