As remote work became the norm, VPN turned into one of the words we hear most. So what is a VPN, what exactly does it do, and how hard is it to run your own VPN server? In this post we first explain how VPNs work and compare the protocols with tables, then answer how to set up OpenVPN step by step on a Linux virtual server.
What Is a VPN?
VPN stands for Virtual Private Network. It creates an encrypted tunnel between your device and a VPN server. Your traffic goes through this tunnel; anyone snooping on the network in between (café Wi-Fi, hotel network, etc.) only sees meaningless encrypted data.
In short, VPNs are used for three main things:
- Secure connections: Encrypting your traffic on networks you don't trust.
- Remote access: Securely reaching servers, files and internal apps on the company network from home or the field.
- Joining networks: Securely connecting different offices or data centers.
How Does a VPN Work?
Simply put: the VPN client (the app on your computer or phone) connects to the server, both sides verify each other with certificates or keys, and they agree on a shared encryption key. From then on every packet you send is encrypted and sent through the tunnel to the server, which decrypts it and forwards it to its destination. The return path works the same way. The destination site sees you with the VPN server's IP address.
Types of VPN
| Type | What it does | Typical use |
|---|---|---|
| Remote access | Connects a single user to a network | Connecting to the office network from home, secure browsing |
| Site-to-site | Permanently connects two networks | Linking a branch to HQ, or an office to a data center |
| Commercial VPN services | Route traffic through ready-made servers | Personal privacy, security on public networks |
VPN Protocols Compared
"VPN" isn't a single technology; there are several protocols, each with its own strengths and weaknesses:
| Protocol | Security | Speed | Setup | Note |
|---|---|---|---|---|
| OpenVPN | Very good | Good | Medium | Very mature and flexible, clients for almost every platform; can get through restrictive networks on TCP 443 |
| WireGuard | Very good | Very good | Easy | Modern, minimal and very fast; short configuration |
| IPsec / IKEv2 | Very good | Very good | Hard | Standard on enterprise devices and for site-to-site links; handles network switching well on mobile |
| L2TP / IPsec | Medium | Medium | Medium | Old, not recommended for new setups |
| PPTP | Weak | Fast | Easy | Considered insecure, shouldn't be used |
OpenVPN or WireGuard?
| OpenVPN | WireGuard | |
|---|---|---|
| Maturity | Over 20 years of history, very widespread | Newer, but built into the Linux kernel |
| Performance | Good | Usually faster and lighter on CPU |
| Authentication | Flexible: certificates, username/password, LDAP, etc. | Key pairs |
| Getting through restrictive networks | Can run over TCP 443 | UDP only |
| Configuration | Longer, more options | Very short and simple |
If you want flexibility, broad client support and certificate-based user management, OpenVPN is still a very solid choice. That's why our guide covers OpenVPN.
A Commercial VPN Service or Your Own VPN Server?
| Commercial VPN service | Your own VPN server | |
|---|---|---|
| Setup | None, download the app and connect | Server setup needed (the steps in this post) |
| Control | With the provider | Entirely yours |
| Fixed IP | Usually a shared IP | Your own fixed IP; can be whitelisted in firewalls |
| Access to the company network | Not suitable | Exactly what it's ideal for |
| Good for | Personal use | Companies, teams, developers |
Especially if you want "my servers should only be reachable from my own IP", your own VPN server makes life alot easier: you open your servers' management ports only to the VPN's IP and keep everything else closed.
How to Set Up OpenVPN (Step by Step on an Ubuntu Virtual Server)
The steps below are written for a Linux virtual server running Ubuntu 24.04. OpenVPN uses very few resources; for a handful of users even the smallest plan is more than enough. Run the commands as a user with root privileges.
1. Install the packages
sudo apt update
sudo apt install -y openvpn easy-rsa2. Create the certificate authority (CA)
OpenVPN relies on the server and clients verifying each other with certificates. For that we set up a small certificate authority with Easy-RSA:
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca nopass3. Generate the server certificate and keys
./easyrsa gen-req server nopass
./easyrsa sign-req server server # type "yes" to confirm
openvpn --genkey secret ta.key
sudo cp pki/ca.crt pki/issued/server.crt pki/private/server.key ta.key /etc/openvpn/server/ta.key is a shared key that protects traffic with an extra layer even before the connection is established. It weeds out unauthorized connection attempts right at the start.
4. Write the server configuration
Create /etc/openvpn/server/server.conf with the following:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh none
tls-crypt ta.key
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 9.9.9.9"
keepalive 10 120
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
user nobody
group nogroup
persist-key
persist-tun
verb 3This configuration gives VPN clients IPs from the 10.8.0.0/24 network and sends all internet traffic through the tunnel. If you only want access to the company network, remove the redirect-gateway line and push just that network instead, e.g. push "route 192.168.10.0 255.255.255.0".
5. Enable IP forwarding and NAT
The server needs to forward VPN traffic to the internet. First find the name of your network interface (usually something like eth0 or ens3):
ip route | grep default
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-openvpn.conf
sudo sysctl --system
# replace eth0 with your interface name
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
sudo apt install -y iptables-persistent # makes the rule permanentIf you use a firewall like UFW on the server, don't forget to allow port 1194/udp: sudo ufw allow 1194/udp.
6. Start OpenVPN
sudo systemctl enable --now openvpn-server@server
sudo systemctl status openvpn-server@serverIf the status output shows "active (running)", the server is ready. If something's wrong, check the logs with journalctl -u openvpn-server@server.
7. Create a client certificate
It's best to generate a seperate certificate for each user (or device); when someone leaves, you revoke only theirs:
cd ~/openvpn-ca
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1 # type "yes" to confirm8. Prepare the client file (.ovpn)
On the client side, putting everything in a single file is the most practical way. Create a file called client1.ovpn and use the template below; replace SERVER_IP with your server's IP and paste the contents of the relevant files between the tags:
client
dev tun
proto udp
remote SERVER_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
verb 3
<ca>
...contents of ca.crt...
</ca>
<cert>
...contents of client1.crt...
</cert>
<key>
...contents of client1.key...
</key>
<tls-crypt>
...contents of ta.key...
</tls-crypt>Files you need: pki/ca.crt, pki/issued/client1.crt, pki/private/client1.key and ta.key.
9. Connect
Transfer client1.ovpn to your device securely and import it into the OpenVPN client (official apps exist for Windows, macOS, Linux, Android and iOS). Once connected, if an IP-check site shows your server's IP address, everything works.
.ovpn file contains a private key, so treat it like a password; don't send it in plain email. To remove a user's access, revoke the certificate with ./easyrsa revoke client1 and ./easyrsa gen-crl, then add the resulting list to the server configuration with a crl-verify line.Common Problems
| Symptom | Likely cause | Fix |
|---|---|---|
| Client can't connect, times out | Port 1194/udp is closed | Open the port on the server and any provider firewall |
| Connects but no internet | IP forwarding or NAT missing | Check step 5 and the interface name |
| Sites won't load but IPs work | DNS settings | Check the dhcp-option DNS lines |
| "TLS handshake failed" error | Wrong ta.key or certificate | Re-copy the file contents into the .ovpn |
Which Virtual Server for a VPN?
OpenVPN is lightweight; what really matters is the connection speed and the CPU's encryption performance. For a team of a few users, VECDC's smallest virtual server plan (2 Core, 8 GB RAM, $6/month) is more than enough; a fixed IPv4 address is included and it's ready in about 5 minutes with automated setup. You can also pick the location at order time so it's close to your users.
If you need company-wide site-to-site VPN, high availability and firewall integration, we can design an enterprise VPN setup with our pfSense consulting and FortiGate consulting services.
Frequently Asked Questions
Is using a VPN legal?
A VPN is a standard technology widely used by companies for remote access and network security. However, what you do over a VPN is still subject to applicable laws; using a VPN doesn't make an illegal activity legal.
Is OpenVPN free?
Yes. The OpenVPN community edition is open source and free; the setup in this post uses only free components. You only pay for the server it runs on.
Which port does OpenVPN use?
By default it uses UDP port 1194. It can also run on a different port and protocol, such as TCP 443, to get through restrictive networks.
How many resources does my own VPN server need?
Very few. For a team of a few users, 1–2 cores and a few GB of RAM are more than enough; what really matters is the server's connection speed and the number of users.
In Short
A VPN protects your traffic by building an encrypted tunnel between your device and a server, and gives you secure access to remote networks. OpenVPN is a mature, flexible VPN solution that runs on every platform. With the steps in this post you can have a working OpenVPN server on your own virtual server in about half an hour. If you get stuck, drop us a message, were happy to help.