How To Setup OpenVPN Server on Ubuntu

OpenVPN is a full-featured SSL VPN (virtual private network). It implements OSI layer 2 or 3 secure network extension using the SSL/TLS protocol. It is an open source software and distributed under the GNU GPL. A VPN allows you to connect securely to an insecure public network such as wifi network at the airport or hotel. VPN is also required to access your corporate or enterprise or home server resources. You can bypass geo-blocked site and increase your privacy or safety online.

This tutorial provides step-by-step instructions for configuring an OpenVPN “road warrior” server on Ubuntu Linux v14.04/16.04 LTS version including ufw/iptables firewall configuration. The steps are as follows:

  1. Find and note down your public IP address
  2. Download openvpn-install.sh script
  3. Run openvpn-install.sh to install OpenVPN server
  4. Connect an OpenVPN server using IOS/Android/Linux/Windows client
  5. Verify your connectivity

1. Find your public IP address

Use any one of the following command to find out your IPv4 public address. If your internface name is eth0 or eth1, enter:
$ ip addr show eth0
OR
$ ip addr show eth1
Or use the host command or dig command as follows:
$ host myip.opendns.com resolver1.opendns.com
OR
$ dig TXT +short o-o.myaddr.l.google.com @ns1.google.com

OpenVPN Public IP
Find out your public IPv4 address using the CLI

Note down the public IP address 139.59.1.155 i.e. public ip address of your OpenVPN server.

2. Download openvpn-install.sh script

Type the following command:
$ wget https://git.io/vpn -O openvpn-install.sh

3. Run openvpn-install.sh to install OpenVPN server

Type the following command:
$ sudo openvpn-install.sh

When prompted set IP address to 139.59.1.155 and Port to 1194. Use Google or OpenDNS DNS servers with the vpn. Next, type client name (such as iPhone, Nexus6, LinuxRouter etc). Finally, press [Enter] key to install and setup OpenVPN on your system:

Setting up OpenVPN server on an Ubuntu Linux server v16.04 LTS
Setting up OpenVPN server on an Ubuntu Linux server v16.04 LTS

The script will now generate keys, DH parameters and more as follows:

Okay, that was all I needed. We are ready to setup your OpenVPN server now
Press any key to continue...
Get:1 http://security.ubuntu.com
......
...
..
--2016-06-27 17:10:38--  https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz
Resolving github.com (github.com)... 192.30.252.120
Connecting to github.com (github.com)|192.30.252.120|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://github-cloud.s3.amazonaws.com/releases/4519663/9dab10e8-7b6a-11e5-91af-0660987e9192.tgz?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAISTNZFOVBIJMK3TQ%2F20160627%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20160627T114040Z&X-Amz-Expires=300&X-Amz-Signature=717ae4f606d1999b4c7c164ae06d163c494197f04aafffa9f760a8e0bf136136&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3DEasyRSA-3.0.1.tgz&response-content-type=application%2Foctet-stream [following]
--2016-06-27 17:10:40--  https://github-cloud.s3.amazonaws.com/releases/4519663/9dab10e8-7b6a-11e5-91af-0660987e9192.tgz?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAISTNZFOVBIJMK3TQ%2F20160627%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20160627T114040Z&X-Amz-Expires=300&X-Amz-Signature=717ae4f606d1999b4c7c164ae06d163c494197f04aafffa9f760a8e0bf136136&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3DEasyRSA-3.0.1.tgz&response-content-type=application%2Foctet-stream
Resolving github-cloud.s3.amazonaws.com (github-cloud.s3.amazonaws.com)... 54.231.72.3
Connecting to github-cloud.s3.amazonaws.com (github-cloud.s3.amazonaws.com)|54.231.72.3|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 40960 (40K) [application/octet-stream]
Saving to: ‘/root/EasyRSA-3.0.1.tgz’
 
/root/EasyRSA-3.0.1.tgz       100%[================================================>]  40.00K  38.8KB/s   in 1.0s
 
2016-06-27 17:10:43 (38.8 KB/s) - ‘/root/EasyRSA-3.0.1.tgz’ saved [40960/40960]
 
 
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/easy-rsa/pki
Generating a 2048 bit RSA private key
........+++
...............................................................................................+++
writing new private key to '/etc/openvpn/easy-rsa/pki/private/ca.key.BjRh5frdDd'
-----
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
....+.....+................................................................................+..................................................................................................................................................................+......................................
...
..
.................................................................................................................+........................................................................................................................................+.................................+......................................................+...++*++*
 
DH parameters of size 2048 created at /etc/openvpn/easy-rsa/pki/dh.pem
 
Generating a 2048 bit RSA private key
.......................................................................+++
..................................................+++
writing new private key to '/etc/openvpn/easy-rsa/pki/private/server.key.9ieuluTC2R'
-----
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server'
Certificate is to be certified until Jun 25 11:55:48 2026 GMT (3650 days)
 
Write out database with 1 new entries
Data Base Updated
Generating a 2048 bit RSA private key
.........+++
.........+++
writing new private key to '/etc/openvpn/easy-rsa/pki/private/iphone.key.lokNfOiobc'
-----
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'iphone'
Certificate is to be certified until Jun 25 11:55:48 2026 GMT (3650 days)
 
Write out database with 1 new entries
Data Base Updated
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.cnf
 
An updated CRL has been created.
CRL file: /etc/openvpn/easy-rsa/pki/crl.pem
 
244
 
Looks like your server is behind a NAT!
 
If your server is NATed (e.g. LowEndSpirit), I need to know the external IP
If that's not the case, just ignore this and leave the next field blank
External IP:

That is all. Your OpenVPN server has been configured and ready to use. You can see added firewall rules /etc/rc.local file:
$ cat /etc/rc.local

Sample outputs:

iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 139.59.1.155

You can view your openvpn server config file generated by the script as follows (do not edit this file by hand):
$ sudo more /etc/openvpn/server.conf
$ sudo vi /etc/openvpn/server.conf

Sample outputs:

port 1194
proto udp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

How do I start/stop/restart OpenVPN server on Ubuntu Linux 16.04 LTS?

Type the following command stop the OpenVPN service:
$ sudo systemctl stop [email protected]
Type the following command start the OpenVPN service:
$ sudo systemctl start [email protected]
Type the following command restart the OpenVPN service:
$ sudo systemctl restart [email protected]

How do I start/stop/restart OpenVPN server on Ubuntu Linux 14.04 LTS?

Type the following command stop the OpenVPN service:
$ sudo /etc/init.d/openvpn stop
Type the following command start the OpenVPN service:
$ sudo /etc/init.d/openvpn start
Type the following command restart the OpenVPN service:
$ sudo /etc/init.d/openvpn restart