VPN: OpenVPN Configuration - Complete Implementation Guide

Introduction

OpenVPN is one of the most trusted and widely deployed open-source VPN solutions, providing secure, encrypted network connectivity across untrusted networks like the Internet. Whether you need to secure remote access for employees, create site-to-site connections between office locations, or protect your privacy while browsing from public WiFi hotspots, OpenVPN offers robust security through SSL/TLS encryption combined with flexible configuration options suitable for both small deployments and enterprise-scale networks.

Unlike proprietary VPN solutions, OpenVPN's open-source nature means extensive peer review, transparency, and freedom from vendor lock-in. It supports multiple platforms including Linux, Windows, macOS, iOS, and Android, making it an ideal choice for heterogeneous environments. OpenVPN operates in either routed (TUN) or bridged (TAP) mode, supports various authentication methods, and can traverse NAT and firewalls more effectively than IPSec.

This comprehensive guide covers OpenVPN server installation and configuration on Linux, client setup across different platforms, certificate authority management with Easy-RSA, security hardening, troubleshooting, and best practices for production deployments. By the end of this guide, you'll have the knowledge to deploy a secure, reliable OpenVPN infrastructure tailored to your specific requirements.

Understanding OpenVPN Architecture

How OpenVPN Works

OpenVPN creates a secure tunnel between two endpoints using SSL/TLS for key exchange and encryption. The basic architecture includes:

Components:

  • OpenVPN Server - Accepts incoming VPN connections
  • OpenVPN Client - Initiates connection to server
  • Certificate Authority (CA) - Issues and signs certificates
  • TUN/TAP Virtual Network Interface - Routes encrypted traffic
  • Encryption Layer - AES, Blowfish, or other ciphers
  • Authentication - Certificates, username/password, or both

Connection Flow:

  1. Client initiates connection to server
  2. SSL/TLS handshake establishes encrypted channel
  3. Certificate authentication verifies identity
  4. Server assigns IP address to client from VPN subnet
  5. Routing rules direct traffic through encrypted tunnel
  6. Data encrypted on client, decrypted on server (and vice versa)

TUN vs TAP Mode

TUN (Layer 3 - IP Routing):

  • Routes IP packets
  • More efficient and faster
  • Suitable for most VPN scenarios
  • Cannot bridge to local network
  • Use cases: Remote access, site-to-site routing

TAP (Layer 2 - Ethernet Bridging):

  • Bridges Ethernet frames
  • Allows broadcast traffic
  • Can bridge client to LAN
  • Higher overhead
  • Use cases: Network games, Windows file sharing, legacy applications

Prerequisites

Before configuring OpenVPN, ensure you have:

  • Linux server with root/sudo access (Ubuntu, Debian, CentOS, or Rocky Linux)
  • Static IP address or dynamic DNS hostname
  • Open port for OpenVPN (default: UDP/1194 or TCP/443)
  • Basic understanding of networking concepts (IP addressing, routing)
  • Firewall access to configure port forwarding
  • Minimum 512MB RAM (1GB+ recommended)
  • SSL/TLS certificate knowledge helpful but not required

System Requirements

# Check system resources
free -h
df -h
uname -r

# Verify network connectivity
ip addr show
ip route show

OpenVPN Server Installation

Installation on Ubuntu/Debian

# Update package repository
sudo apt update

# Install OpenVPN and Easy-RSA
sudo apt install openvpn easy-rsa -y

# Verify installation
openvpn --version

Installation on CentOS/Rocky Linux/RHEL

# Enable EPEL repository
sudo dnf install epel-release -y

# Install OpenVPN and Easy-RSA
sudo dnf install openvpn easy-rsa -y

# Verify installation
openvpn --version

Installation from Source (Advanced)

# Install dependencies
sudo apt install build-essential libssl-dev liblzo2-dev libpam0g-dev

# Download latest OpenVPN
wget https://swupdate.openvpn.org/community/releases/openvpn-2.6.8.tar.gz
tar -xzf openvpn-2.6.8.tar.gz
cd openvpn-2.6.8

# Compile and install
./configure
make
sudo make install

Certificate Authority Setup with Easy-RSA

Easy-RSA simplifies PKI (Public Key Infrastructure) management for OpenVPN.

Initialize PKI Infrastructure

# Create Easy-RSA directory
make-cadir ~/openvpn-ca
cd ~/openvpn-ca

# Edit vars file to set defaults
nano vars

Configure default certificate parameters:

# vars configuration
set_var EASYRSA_REQ_COUNTRY    "US"
set_var EASYRSA_REQ_PROVINCE   "California"
set_var EASYRSA_REQ_CITY       "San Francisco"
set_var EASYRSA_REQ_ORG        "Example Corp"
set_var EASYRSA_REQ_EMAIL      "[email protected]"
set_var EASYRSA_REQ_OU         "IT Department"
set_var EASYRSA_KEY_SIZE       2048
set_var EASYRSA_CA_EXPIRE      3650
set_var EASYRSA_CERT_EXPIRE    1825

Build Certificate Authority

# Initialize PKI
./easyrsa init-pki

# Build CA
./easyrsa build-ca nopass

# Enter Common Name for CA (e.g., "Example-CA")

Output: CA certificate created at pki/ca.crt

Generate Server Certificate

# Generate server certificate and key
./easyrsa gen-req server nopass

# Sign server certificate
./easyrsa sign-req server server

# Verify when prompted by typing 'yes'

Generated files:

  • pki/private/server.key - Server private key
  • pki/issued/server.crt - Server certificate

Generate Diffie-Hellman Parameters

# Generate DH parameters (takes several minutes)
./easyrsa gen-dh

Output: pki/dh.pem

Generate TLS Authentication Key

# Generate additional HMAC signature
openvpn --genkey secret ta.key

Generate Client Certificates

# Generate client certificate (replace 'client1' with client name)
./easyrsa gen-req client1 nopass

# Sign client certificate
./easyrsa sign-req client client1

# Repeat for additional clients:
./easyrsa gen-req client2 nopass
./easyrsa sign-req client client2

Copy Certificates to OpenVPN Directory

# Create directory for keys
sudo mkdir -p /etc/openvpn/server

# Copy server certificates
sudo cp pki/ca.crt /etc/openvpn/server/
sudo cp pki/issued/server.crt /etc/openvpn/server/
sudo cp pki/private/server.key /etc/openvpn/server/
sudo cp pki/dh.pem /etc/openvpn/server/
sudo cp ta.key /etc/openvpn/server/

# Set proper permissions
sudo chmod 600 /etc/openvpn/server/server.key

OpenVPN Server Configuration

Create Server Configuration File

sudo nano /etc/openvpn/server/server.conf

Basic server configuration:

# Server mode and protocol
port 1194
proto udp
dev tun

# SSL/TLS certificates
ca ca.crt
cert server.crt
key server.key
dh dh.pem

# Network configuration
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt

# Push routes to clients
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

# Client configuration
client-to-client
duplicate-cn

# TLS authentication
tls-auth ta.key 0
cipher AES-256-GCM
auth SHA256

# Privileges and security
user nobody
group nogroup
persist-key
persist-tun

# Logging
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 1

# Keepalive
keepalive 10 120

# Compression (optional)
compress lz4-v2
push "compress lz4-v2"

Configuration breakdown:

  • port 1194 - UDP port (standard OpenVPN port)
  • proto udp - Protocol (UDP recommended for speed)
  • dev tun - TUN device for routing
  • server 10.8.0.0 255.255.255.0 - VPN subnet
  • push "redirect-gateway" - Route all client traffic through VPN
  • push "dhcp-option DNS" - DNS servers for clients
  • tls-auth ta.key 0 - HMAC authentication (0 for server)
  • cipher AES-256-GCM - Strong encryption
  • user nobody - Drop privileges after startup
  • keepalive 10 120 - Connection keepalive

Create Log Directory

sudo mkdir -p /var/log/openvpn
sudo chown nobody:nogroup /var/log/openvpn

Advanced Server Configuration Options

Site-to-Site VPN Configuration

# Add to server.conf
# Route to remote network
route 192.168.2.0 255.255.255.0

# Client specific configuration
client-config-dir /etc/openvpn/ccd

# Create client config
sudo mkdir -p /etc/openvpn/ccd
sudo nano /etc/openvpn/ccd/site-office

# In site-office file:
iroute 192.168.2.0 255.255.255.0

Certificate Revocation List (CRL)

# Add to server.conf
crl-verify /etc/openvpn/server/crl.pem

Generate CRL:

cd ~/openvpn-ca
./easyrsa gen-crl
sudo cp pki/crl.pem /etc/openvpn/server/

TCP Mode (Alternative to UDP)

# For restrictive firewalls
port 443
proto tcp

Split Tunnel Configuration

# Don't redirect all traffic, only specific routes
# Remove: push "redirect-gateway def1 bypass-dhcp"

# Add specific routes
push "route 10.0.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"

Network Configuration

Enable IP Forwarding

# Enable immediately
sudo sysctl -w net.ipv4.ip_forward=1

# Make permanent
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Configure Firewall (iptables)

# Get network interface name
ip route | grep default

# Configure NAT (replace eth0 with your interface)
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# Allow OpenVPN through firewall
sudo iptables -A INPUT -p udp --dport 1194 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Save iptables rules
sudo apt install iptables-persistent
sudo netfilter-persistent save

Configure Firewall (UFW)

# Edit UFW before rules
sudo nano /etc/ufw/before.rules

Add before *filter section:

# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT

Enable forwarding:

sudo nano /etc/default/ufw
# Change: DEFAULT_FORWARD_POLICY="ACCEPT"

# Allow OpenVPN
sudo ufw allow 1194/udp

# Reload UFW
sudo ufw disable
sudo ufw enable

Configure Firewall (firewalld - RHEL/CentOS)

# Enable masquerading
sudo firewall-cmd --permanent --add-masquerade

# Add OpenVPN service
sudo firewall-cmd --permanent --add-service=openvpn

# Or add port directly
sudo firewall-cmd --permanent --add-port=1194/udp

# Add tun interface to trusted zone
sudo firewall-cmd --permanent --zone=trusted --add-interface=tun0

# Reload firewall
sudo firewall-cmd --reload

Start OpenVPN Server

Using systemd

# Enable OpenVPN server
sudo systemctl enable openvpn-server@server

# Start OpenVPN server
sudo systemctl start openvpn-server@server

# Check status
sudo systemctl status openvpn-server@server

# View logs
sudo journalctl -u openvpn-server@server -f

Verify Server is Running

# Check listening port
sudo ss -tulpn | grep 1194

# Check tun interface
ip addr show tun0

# Check OpenVPN process
ps aux | grep openvpn

OpenVPN Client Configuration

Create Client Configuration File

# Create client config directory
mkdir -p ~/client-configs/files

# Create base configuration
nano ~/client-configs/base.conf

Base client configuration:

client
dev tun
proto udp
remote your-server-ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
key-direction 1
verb 3

# Compression
compress lz4-v2

Generate Client Configuration Script

nano ~/client-configs/make_config.sh

Script to bundle certificates into client config:

#!/bin/bash

# Configuration
KEY_DIR=~/openvpn-ca/pki
OUTPUT_DIR=~/client-configs/files
BASE_CONFIG=~/client-configs/base.conf

# First argument: client name
CLIENT=$1

cat ${BASE_CONFIG} \
    <(echo -e '<ca>') \
    ${KEY_DIR}/ca.crt \
    <(echo -e '</ca>\n<cert>') \
    ${KEY_DIR}/issued/${CLIENT}.crt \
    <(echo -e '</cert>\n<key>') \
    ${KEY_DIR}/private/${CLIENT}.key \
    <(echo -e '</key>\n<tls-auth>') \
    ~/openvpn-ca/ta.key \
    <(echo -e '</tls-auth>') \
    > ${OUTPUT_DIR}/${CLIENT}.ovpn

echo "Client configuration created: ${OUTPUT_DIR}/${CLIENT}.ovpn"

Make executable:

chmod +x ~/client-configs/make_config.sh

Generate Client Configuration

# Generate .ovpn file for client1
./client-configs/make_config.sh client1

# Generated file location:
ls ~/client-configs/files/client1.ovpn

Transfer Client Configuration

# Transfer via SCP
scp ~/client-configs/files/client1.ovpn user@client-machine:~/

# Or display content and copy manually
cat ~/client-configs/files/client1.ovpn

Client Setup on Different Platforms

Linux Client

Install OpenVPN:

sudo apt install openvpn

Connect using terminal:

sudo openvpn --config client1.ovpn

Connect using NetworkManager:

# Install Network Manager OpenVPN plugin
sudo apt install network-manager-openvpn-gnome

# Import configuration:
# 1. Click network icon → VPN Settings
# 2. Click + to add VPN
# 3. Select "Import from file"
# 4. Select client1.ovpn file
# 5. Click "Add"
# 6. Click toggle to connect

Windows Client

  1. Download OpenVPN GUI from https://openvpn.net/community-downloads/
  2. Install OpenVPN GUI
  3. Copy client1.ovpn to C:\Program Files\OpenVPN\config\
  4. Run OpenVPN GUI as Administrator
  5. Right-click system tray icon → Connect

macOS Client

  1. Download Tunnelblick from https://tunnelblick.net/
  2. Install Tunnelblick
  3. Double-click client1.ovpn file
  4. Tunnelblick imports configuration
  5. Click Tunnelblick icon → Connect

Android Client

  1. Install "OpenVPN Connect" from Google Play Store
  2. Transfer client1.ovpn to device
  3. Open OpenVPN Connect
  4. Tap + icon → File
  5. Navigate to client1.ovpn
  6. Tap to connect

iOS Client

  1. Install "OpenVPN Connect" from App Store
  2. Transfer client1.ovpn via email, cloud storage, or iTunes
  3. Open file in OpenVPN Connect app
  4. Tap + to import
  5. Tap to connect

Testing and Verification

Verify Client Connection

# On client, check IP address
ip addr show tun0

# Should show IP from VPN subnet (10.8.0.x)

Test Connectivity

# Ping VPN server from client
ping 10.8.0.1

# Ping client from server
ping 10.8.0.6  # Replace with client's VPN IP

# Check routing
ip route
traceroute google.com

Verify Traffic is Encrypted

# Check public IP before VPN
curl ifconfig.me

# Connect to VPN

# Check public IP after VPN (should match server's IP)
curl ifconfig.me

DNS Leak Test

# Check DNS servers
nslookup google.com

# Or visit: https://www.dnsleaktest.com

Check OpenVPN Logs

Server logs:

# Real-time server log
sudo tail -f /var/log/openvpn/openvpn.log

# Connection status
sudo cat /var/log/openvpn/openvpn-status.log

Client logs:

# Linux client
sudo journalctl -u openvpn -f

# Or check terminal output when running manually

Troubleshooting Common Issues

Issue 1: Client Cannot Connect

Symptoms:

  • Connection timeout
  • "Connection refused" error

Diagnosis:

# On server, verify OpenVPN is running
sudo systemctl status openvpn-server@server

# Check if port is listening
sudo ss -tulpn | grep 1194

# Check firewall
sudo iptables -L -n -v
sudo ufw status

Solutions:

# Restart OpenVPN server
sudo systemctl restart openvpn-server@server

# Verify firewall allows traffic
sudo ufw allow 1194/udp

# Check client config has correct server IP
grep remote client1.ovpn

Issue 2: Connection Established but No Internet

Symptoms:

  • VPN connects successfully
  • Cannot access Internet or local network

Diagnosis:

# Check IP forwarding
cat /proc/sys/net/ipv4/ip_forward
# Should be 1

# Check NAT rules
sudo iptables -t nat -L -n -v

Solutions:

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Add NAT rule
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

# Save rules
sudo netfilter-persistent save

Issue 3: DNS Not Working

Symptoms:

  • Can ping IP addresses but not domain names

Diagnosis:

# Check DNS configuration on client
cat /etc/resolv.conf

# Test DNS resolution
nslookup google.com

Solutions:

# On server, verify DNS push in config
grep "push.*DNS" /etc/openvpn/server/server.conf

# Add if missing:
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

# Restart server
sudo systemctl restart openvpn-server@server

Issue 4: Certificate Errors

Symptoms:

  • "Certificate verification failed"
  • "TLS handshake failed"

Diagnosis:

# Verify certificate dates
openssl x509 -in /etc/openvpn/server/server.crt -noout -dates

# Check certificate chain
openssl verify -CAfile /etc/openvpn/server/ca.crt /etc/openvpn/server/server.crt

Solutions:

Regenerate expired certificates following the Easy-RSA steps.

Issue 5: Slow VPN Performance

Diagnosis:

# Test bandwidth
iperf3 -s  # On server
iperf3 -c server-ip  # On client

Solutions:

# Switch to TCP if UDP has packet loss
proto tcp

# Adjust MTU
tun-mtu 1400

# Enable fast-io (server config)
fast-io

# Disable compression if CPU-bound
# Comment out: compress lz4-v2

Security Hardening

Strengthen Encryption

# Use strongest encryption
cipher AES-256-GCM
auth SHA512
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256

Disable Duplicate Connections

# Remove from server.conf if present
# duplicate-cn

# Force unique certificates per client

Implement CRL (Certificate Revocation List)

# Revoke client certificate
cd ~/openvpn-ca
./easyrsa revoke client1
./easyrsa gen-crl

# Update CRL on server
sudo cp pki/crl.pem /etc/openvpn/server/
sudo systemctl restart openvpn-server@server

Two-Factor Authentication

Install Google Authenticator PAM module:

sudo apt install libpam-google-authenticator

# Configure for OpenVPN user
google-authenticator

Add to server.conf:

plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn

Create PAM configuration:

sudo nano /etc/pam.d/openvpn

auth required pam_google_authenticator.so

Fail2Ban Integration

# Install Fail2Ban
sudo apt install fail2ban

# Create OpenVPN filter
sudo nano /etc/fail2ban/filter.d/openvpn.conf

[Definition]
failregex = ^.*TLS Error: TLS handshake failed.*<HOST>
            ^.*VERIFY ERROR.*<HOST>
ignoreregex =

Enable jail:

sudo nano /etc/fail2ban/jail.local

[openvpn]
enabled = true
port = 1194
protocol = udp
filter = openvpn
logpath = /var/log/openvpn/openvpn.log
maxretry = 3
bantime = 600

Restart Fail2Ban:

sudo systemctl restart fail2ban

Best Practices

1. Regular Certificate Rotation

  • Renew certificates before expiration
  • Use shorter validity periods (1-2 years)
  • Automate renewal reminders

2. Monitoring and Logging

# Monitor connections
watch -n 5 'cat /var/log/openvpn/openvpn-status.log'

# Set up log rotation
sudo nano /etc/logrotate.d/openvpn

/var/log/openvpn/*.log {
    weekly
    rotate 4
    compress
    delaycompress
    notifempty
    missingok
    sharedscripts
    postrotate
        systemctl reload openvpn-server@server
    endscript
}

3. Backup Critical Files

#!/bin/bash
# Backup OpenVPN configuration and certificates

BACKUP_DIR="/backup/openvpn-$(date +%F)"
mkdir -p $BACKUP_DIR

cp -r /etc/openvpn/server $BACKUP_DIR/
cp -r ~/openvpn-ca/pki $BACKUP_DIR/
tar -czf $BACKUP_DIR.tar.gz $BACKUP_DIR
rm -rf $BACKUP_DIR

echo "Backup completed: $BACKUP_DIR.tar.gz"

4. Network Segmentation

Isolate VPN clients:

# Prevent client-to-client communication
# Remove: client-to-client

# Create separate firewall rules for VPN subnet

5. Documentation

Maintain documentation:

  • Server configuration details
  • Certificate expiration dates
  • Client assignments
  • Network topology
  • Troubleshooting procedures
  • Emergency contact information

Conclusion

OpenVPN provides enterprise-grade security with the flexibility and transparency of open-source software. This guide has covered the complete process from installation through production deployment, including certificate management, security hardening, multi-platform client configuration, and troubleshooting common issues.

Key takeaways:

  • Easy-RSA simplifies PKI management for certificate creation and signing
  • Proper network configuration including IP forwarding and NAT is essential
  • Client configuration files can be generated as single .ovpn files for easy distribution
  • Security hardening through strong encryption, CRL, and optional 2FA enhances protection
  • Regular maintenance including certificate rotation and monitoring ensures reliability
  • Platform flexibility allows connections from Windows, macOS, Linux, iOS, and Android

OpenVPN's proven security model, active development community, and extensive documentation make it an excellent choice for VPN deployments of any scale. Whether securing remote workers, connecting branch offices, or protecting personal privacy, the configurations and practices covered in this guide provide a solid foundation for reliable, secure VPN infrastructure.

Continue learning by exploring advanced topics such as multi-hop VPN chains, OpenVPN Access Server for GUI management, and integration with RADIUS or LDAP authentication systems.