DEV Community

Cover image for How to Install a Private OpenVPN Server on Ubuntu 22.04
NodeShift profile image Aditi Bindal
Aditi Bindal for NodeShift

Posted on • Edited on

How to Install a Private OpenVPN Server on Ubuntu 22.04

#vpn #openvpn #cybersecurity #privacy

Amid the age of growing privacy concerns, we often look for options to browse the internet safely without relying on third-party services. Setting up a private VPN (Virtual Private Network) server is one of the secure solutions in these times. OpenVPN offers one of the most trusted and flexible VPN solutions, which allows you to set up a private network that shields your data from potential network vulnerabilities. Some popular cases of using a VPN include but are not limited to bypassing regional restrictions, securing usage of public Wi-fi, and so on.

OpenVPN Illsutration
In this guide, we'll walk you through a step-by-step approach to setting up your own OpenVPN server on Ubuntu 22.04. We recommend thoroughly following this guide from installation to starting the server so you can seamlessly set up the server without errors!

Prerequisites

  • A Virtual Machine (such as the ones provided by NodeShift) with:
    • 2 vCPUs
    • 2 GB RAM
    • 10 GB SSD
  • Ubuntu 22.04 VM

Note: The above prerequisites are highly variable across use cases. A high-end configuration should be used for a large-scale deployment.

Step-by-step process to install private OpenVPN server on Ubuntu 22.04

For the purpose of this tutorial, we'll be using a CPU-powered Virtual Machine by NodeShift since it provides Compute Virtual Machines at a very affordable cost on a scale that meets GDPR, SOC2, and ISO27001 requirements. Also, it offers an intuitive and user friendly interface, making it easier even for beginners to get started with Cloud deployments. However, feel free to use any cloud provider of your choice, and follow the same steps for the rest of the tutorial.

Step 1: Setting up a NodeShift Account

Visit NodeShift Platform and create an account by filling in basic details, or continue signing up with your Google/GitHub account.

If you already have an account, login straight to your dashboard.

illustration1

Step 2: Create a Compute Node (CPU Virtual Machine)

After accessing your account, you should see a dashboard (see image), here:

  1. Navigate to the menu on the left side.
  2. Click on the Compute Nodes option. illustration2
  3. Click on Start to start creating your very first compute node.

illustration3

These Compute nodes are CPU powered virtual machines by NodeShift. These nodes are highly customizable, and let you control different environmental configurations, such as CPUs, RAM and storage, according to your needs.

Step 3: Select configuration for VM

  1. The first option you see is the Reliability dropdown, which lets you choose the type of uptime guarantee level you're seeking for your VM (e.g., 99%). illustration4
  2. Next, select a geographical region from the Region dropdown, where you want to launch your VM (e.g. United States). illustration5
  3. Now, most importantly, select the right specifications for your VM according to your use-case by sliding the bars for each option. illustration6

Step 4: Choose VM Configuration and Image

  1. After selecting your required configuration options, you'll see the available VMs in your region and as per (or very close to) your configuration. We'll be choosing a '4 vCPUs/4GB/80GB SSD' Compute node in our case.

  2. Next, you'll need to choose an image for your Virtual Machine. For the scope of this tutorial, we'll choose Ubuntu, but you can choose any other option where you want to set your VPN.

    illustration of step 4

Step 5: Choose the Billing cycle and Authentication Method

  1. For the billing cycle, two options are available: Hourly being ideal for short-term usage, offering pay-as-you-go flexibility, and Monthly being best for long-term projects with consistent usage rate and potentially lower cost.

    illustration for step 5

  2. Next, you'll need to select an authentication method. There are two methods available: Password and SSH Key. We recommend using SSH keys as they are more secure option. In order to create one, head over to our official documentation.

    illustration for step 5

Step 6: Finalize Details and Create Deployment

Finally, if you may want, you can also add a VPC (Virtual Private Cloud), which provides an isolated section for you to launch your cloud resources (Virtual machine, storage, etc.) in a secure, private environment. We're keeping this option as default for now, but feel free to create a VPC as per your needs.

Also, you can deploy multiple nodes at once by clicking + in the Quantity tab.

illustration for step 6

That's it! Now, you are ready to deploy the node. Finalize the configuration summary, if it looks good, go ahead and click Create to deploy the node.

illustration for step 6

Step 7: Connect to active Compute Node using SSH

As soon as you create the node, it will take few seconds or a minute to get deployed, once it is deployed you will see a status "Running" in green meaning that our Compute node is ready to use!
illustration for step 7
Once your node shows this status, follow the below steps to connect to the VM via SSH:

  1. Open your terminal and run the below SSH command: (replace root with your username and paste the IP of your VM in place of ip after copying it from the NodeShift dashboard) 
ssh root@ip
Enter fullscreen mode Exit fullscreen mode
  1. If SSH keys are set up, the terminal will authenticate automatically.
  2. In some cases, your terminal may take your consent before connecting, enter 'yes', and you should be connected. illustration for step 7

Step 8: Install Dependencies for OpenVPN

Before we move on to install OpenVPN, we first need to perform some prerequisites which are required for the installation of OpenVPN.

  1. Let's start by updating the Ubuntu package source list for the latest version and security updates 
sudo apt update
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 8

  1. Once the update is done, install OpenVPN. 
sudo apt install openvpn
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 8

We'll need to install Easy-RSA along with OpenVPN, which serves as a utility for generating SSL certificates and keys for secure communication.

sudo apt install easy-rsa
Enter fullscreen mode Exit fullscreen mode

Note: In some cases, after executing the above command, you might come across an error like this:

illustration for step 8

This usually occurs when universe repository, where easy-rsa is located, is not enabled.

Here's how to fix it:

  1. Enable the universe repository 
sudo add-apt-repository universe
Enter fullscreen mode Exit fullscreen mode
  1. Update the package source list again 
sudo apt update
Enter fullscreen mode Exit fullscreen mode

  1. Once again, run the easy-rsa installation command, and now it should execute successfully.

    illustration for step 8

Step 9: Initialize PKI (Public Key Infrastructure)

Once the above installation is done, proceed to set up PKI, which is essential for generating certificates and keys for OpenVPN.

To initialize PKI, you need to:

  1. Copy the Easy-RSA directory to an alternate location (as a safeguard measure) 
sudo cp -r /usr/share/easy-rsa /etc/
Enter fullscreen mode Exit fullscreen mode
  1. Navigate to the copied directory 
cd  /etc/easy-rsa/
Enter fullscreen mode Exit fullscreen mode
  1. Initialize PKI 
sudo ./easyrsa init-pki
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 9

Step 10: Generate Server Certificates and Keys

Next, we are ready to generate CA (certificate authority) and keys, follow the below steps thoroughly to successfully generate all the required certificates and keys for setting up OpenVPN server.

  1. Generate certificate authority 
sudo ./easyrsa build-ca
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 10

  1. Generate Diffie-Hellman parameters 
sudo ./easyrsa gen-dh
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 10

  1. Generate OpenVPN server certificate and key 
sudo ./easyrsa build-server-full server nopass
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 10

  1. Generate HMAC key HMAC keys authenticate the integrity of data and packets, ensuring they come from a trusted source and have not been tampered with. 
sudo openvpn --genkey secret /etc/easy-rsa/pki/ta.key
Enter fullscreen mode Exit fullscreen mode
  1. Generate OpenVPN Revocation Certificate OpenVPN revocation certificate ensures that an unauthorized client cannot use a revoked certificate to connect to the server. 
sudo ./easyrsa gen-crl
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 10

  1. Copy server certificates and keys Finally, we'll copy all the generated server certificates and keys to the server's configuration directory, which will be used to establish a secure connection between the server and client. 
sudo cp -rp /etc/easy-rsa/pki/{ca.crt,dh.pem,ta.key,crl.pem,issued,private} /etc/openvpn/server/
Enter fullscreen mode Exit fullscreen mode

Step 11: Generate Client Certificates and Keys

In this step, we'll generate unique certificates and keys for each client that needs to connect with our server.

  1. Create certificates and keys for a client

(replace clientname with the actual name of the client)

sudo ./easyrsa build-client-full clientname nopass
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 11

  1. Create directories for each client 
sudo mkdir /etc/openvpn/client/clientname
Enter fullscreen mode Exit fullscreen mode
  1. Copy the client files to its unique directory 
sudo cp -rp /etc/easy-rsa/pki/{ca.crt,issued/clientname.crt,private/clientname.key} /etc/openvpn/client/clientname/
Enter fullscreen mode Exit fullscreen mode

Step 12: Configure the OpenVPN server

  1. Copy a sample configuration file to OpenVPN server configuration directory. We'll edit these configuration as per our needs in next step. 
sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/server/
Enter fullscreen mode Exit fullscreen mode
  1. Edit the server configuration file. 
sudo nano /etc/openvpn/server/server.conf
Enter fullscreen mode Exit fullscreen mode

The above command will open the configuration file in Nano, which is a text editor, that will look something like this:

illustration for step 12

Go ahead and overwrite this file with the below configuration details (right-click on the editor to paste the below text)

port 1194  
proto udp4  
dev tun  
ca ca.crt  
cert issued/server.crt  
key private/server.key # This file should be kept secret  
dh dh.pem  
topology subnet  
server 172.16.20.0 255.255.255.0  
ifconfig-pool-persist /var/log/openvpn/ipp.txt  
push "redirect-gateway def1 bypass-dhcp"  
push "dhcp-option DNS 208.67.222.222"  
push "dhcp-option DNS 208.67.220.220"  
client-to-client  
keepalive 10 120  
tls-auth ta.key 0 # This file is secret  
cipher AES-256-CBC  
persist-key  
persist-tun  
status /var/log/openvpn/openvpn-status.log  
log-append /var/log/openvpn/openvpn.log  
verb 3  
explicit-exit-notify 1  
auth SHA512
Enter fullscreen mode Exit fullscreen mode

The edited file should look something like this:

illustration for step 12

Save this edited file (Ctrl + O > Enter) and exit the editor (Ctrl + X).

This server configuration will set up an OpenVPN server on port 1194 using UDP along with other important specifications and network settings. Our server is now ready to route all client traffic through VPN, ensuring secure communication.

Step 13: Enable IP forwarding

IP forwarding will further help our server to route traffic between our client and other internal networks. This is crucial to allow client to access resources beyond a VPN server, such as public websites, remote server, etc.

  1. Enable IP forwarding 
sudo sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
Enter fullscreen mode Exit fullscreen mode
  1. Apply the changes to the server (without reboot) 
sudo sysctl --system
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 13

  1. Configure firewall to allow traffic on UDP port 1194 
sudo ufw allow 1194/udp
Enter fullscreen mode Exit fullscreen mode

Output:
illustration for step 13

Step 14: Configure IP masquerading

IP masquerading is the technique that actually makes VPNs so powerful. It hides the individual client's IP behind its one main public IP so that any external website can only see the VPN server's public IP and not the client one.

  1. Use the below command to identify the default network interface 
ip route get 8.8.8.8
Enter fullscreen mode Exit fullscreen mode

Output:

illustration for step 14

  1. Update UFW (Uncomplicated Firewall) rules UFW is a user-friendly interface for managing firewalls in Linux-based systems.

Update the UFW configuration with the below command

sudo sed -i 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
Enter fullscreen mode Exit fullscreen mode
  1. Reload UFW for changes to take effect 
sudo ufw reload
Enter fullscreen mode Exit fullscreen mode

Note: In some cases, after executing the above command, you might encounter an error like this:
illustration for step 14

to fix this, we'll need to enable the firewall:

sudo sed -ie 's/ENABLED=no/ENABLED=yes/' /etc/ufw/ufw.conf
Enter fullscreen mode Exit fullscreen mode

after this, go ahead to try the previous reload command again, and it should work fine this time.
Output:

illustration for step 14

Step 15: Start the OpenVPN Server

Finally, our server is ready to start and work. Let's run the final commands to start the server and see the logs.

  1. Enable and start the OpenVPN server 
sudo systemctl enable --now openvpn-server@server
Enter fullscreen mode Exit fullscreen mode

Output:
illustration for step 15
If you see the above output, it means our server has been started successfully.

  1. Check the log messages 
sudo systemctl status openvpn-server@server
Enter fullscreen mode Exit fullscreen mode

Output:
illustration for step 15

Congratulations, our OpenVPN private server is successfully up and running!

Conclusion

Setting up a private OpenVPN server on Ubuntu 22.04 provides a secure and safe way to access resources on the internet while maintaining privacy at the same time. This article approached this use case by deploying Ubuntu Virtual Machine on NodeShift-powered Compute Nodes. With NodeShift, you can leverage advanced computing capabilities, ensuring optimal efficiency and power for running VPNs without breaking the bank. Whether you're setting up a private VPN or deploying network services, NodeShift's streamlined cloud deployment offers a robust foundation for running secure and reliable server configurations seamlessly.

For more information about NodeShift:

Top comments (0)

Read next

vdelitz profile image

No Matching Passkeys Available: Troubleshooting Your Login Issue

vdelitz -

carrie_luo1 profile image

The Beginner's Guide to Understanding WebSocket

Carrie -

scofieldidehen profile image

Passwords: Are they going extinct?

Scofield Idehen -

trixsec profile image

New Vulnerability Scanner (Must Try)

Trix Cyrus -