DEV Community

Cover image for Installing and Setting Up Pritunl VPN Server on Ubuntu 24.04
Vultr profile image Sanskriti Harmukh
Sanskriti Harmukh for Vultr

Posted on with Aashish Chaurasiya • Originally published at docs.vultr.com

Installing and Setting Up Pritunl VPN Server on Ubuntu 24.04

#vpn #linux #security #networking

Pritunl is an open-source VPN solution supporting OpenVPN and WireGuard, with a web console for managing organizations, users, servers, and client profiles — plus automatic NAT and Let's Encrypt certificates. This guide installs it on Ubuntu 24.04, creates a server/organization/user structure, connects a client, and covers revoking access.

Prerequisites: an Ubuntu 24.04 server, non-root sudo user, a domain A record (e.g. pritunlvpn.example.com).

Install Pritunl

Needs MongoDB (management data), OpenVPN, and WireGuard.

$ sudo apt update
$ sudo apt upgrade -y
$ sudo apt install gnupg -y
Enter fullscreen mode Exit fullscreen mode

Add the repos:

$ sudo tee /etc/apt/sources.list.d/mongodb-org.list << EOF
deb [ signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse
EOF
$ sudo tee /etc/apt/sources.list.d/openvpn.list << EOF
deb [ signed-by=/usr/share/keyrings/openvpn-repo.gpg ] https://build.openvpn.net/debian/openvpn/stable noble main
EOF
$ sudo tee /etc/apt/sources.list.d/pritunl.list << EOF
deb [ signed-by=/usr/share/keyrings/pritunl.gpg ] https://repo.pritunl.com/stable/apt noble main
EOF
Enter fullscreen mode Exit fullscreen mode

Fetch GPG keys:

$ curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | sudo gpg -o /usr/share/keyrings/mongodb-server-8.0.gpg --dearmor --yes
$ curl -fsSL https://swupdate.openvpn.net/repos/repo-public.gpg | sudo gpg -o /usr/share/keyrings/openvpn-repo.gpg --dearmor --yes
$ curl -fsSL https://raw.githubusercontent.com/pritunl/pgp/master/pritunl_repo_pub.asc | sudo gpg -o /usr/share/keyrings/pritunl.gpg --dearmor --yes
Enter fullscreen mode Exit fullscreen mode

Install:

$ sudo apt update
$ sudo apt install mongodb-org openvpn wireguard wireguard-tools -y
$ sudo apt install pritunl -y
$ pritunl version
Enter fullscreen mode Exit fullscreen mode

Manage the Services 

$ sudo systemctl enable pritunl
$ sudo systemctl start pritunl
$ sudo systemctl status pritunl
$ sudo systemctl enable mongod
$ sudo systemctl start mongod
Enter fullscreen mode Exit fullscreen mode

Initial Setup

1. Generate a one-time setup key:

$ sudo pritunl setup-key
Enter fullscreen mode Exit fullscreen mode

2. Open the firewall:

$ sudo ufw allow 80/tcp
$ sudo ufw allow 443/tcp
$ sudo ufw reload
$ sudo ufw status
Enter fullscreen mode Exit fullscreen mode

3. Visit http://YOUR-SERVER-IP (accept the self-signed cert warning), paste the setup key, confirm the MongoDB URI points at localhost, Save.

4. Get the default web console credentials:

$ sudo pritunl default-password
Enter fullscreen mode Exit fullscreen mode

5. Log in at http://YOUR-SERVER-IP/login with that username/password, set a new strong password in the Initial Setup dialog, confirm the server's public IP, enter your domain (e.g. pritunlvpn.example.com) as the Let's Encrypt Domain — your A record must already point here for cert issuance to work — Save.

Set Up Servers, Organizations, and Users

  • Server — the actual VPN endpoint (OpenVPN or WireGuard)
  • Organization — a standalone CA issuing user certs, for grouping/permissions
  • User — a client profile tied to an organization with its own certificate

1. Create a server: https://pritunlvpn.example.com → Servers → Add Server → name, DNS server, port, protocol, virtual network subnet → ADD.

2. Create an organization: Users → Add Organization → name → Add.

3. Attach and start: Servers → select your server → Attach Organization → pick the org → Attach → Start Server.

4. Create a user: Users → Add User → name, organization, email, PIN → Add.

5. Get the profile: from the user's options, Download Profile (archive) or Link for a shareable download link.

Firewall for VPN Traffic

Each server profile uses its own port/protocol — check Servers → Server for the exact port.

$ sudo ufw status
$ sudo ufw allow 12800/udp
$ sudo ufw reload
$ sudo ufw status
Enter fullscreen mode Exit fullscreen mode

Replace 12800/udp with whatever your server profile actually uses.

Connect a Client

1. Download the Pritunl client for your OS.

2. Import: open Pritunl client → Import → Browse → select the downloaded .tar profile → Import.

3. Connect: verify user/server info, Connect, enter the PIN, Connect again to establish the tunnel.

4. Verify: check connection stats in the client, confirm your public IP via an IP checker matches the VPN server, and check Users in the web console shows the user as Online.

Revoke a User

Users → select the user → Delete Selected.

Next Steps

Pritunl is running with TLS via Let's Encrypt and at least one active VPN connection. From here:

  • Add more organizations to separate teams or environments
  • Configure split tunneling per server profile if you don't want all client traffic routed through the VPN
  • Set up additional servers on WireGuard for lower-overhead connections

For the full guide, visit the original article on Vultr Docs.

Top comments (0)