How to Set Up an OpenVPN Server on a VPS

OpenVPN has been the workhorse VPN for two decades. It's endlessly configurable and, crucially, can run over TCP 443 to blend in with normal HTTPS traffic — handy on restrictive networks that block everything else. This guide uses a well-known installer script to set up an OpenVPN server on a VPS and export ready-to-use client profiles. If raw speed matters more than compatibility, compare with WireGuard on a VPS.

When to choose OpenVPN

• You need to get through firewalls that block UDP or non-standard ports (run OpenVPN on TCP 443).
• You want mature, widely available clients on legacy systems.
• You need fine-grained routing, per-client rules or certificate revocation.

For most home users on modern devices, WireGuard is lighter — but OpenVPN wins on reach.

Prerequisites

• A fresh Ubuntu or Debian VPS with root access.
• The server's public IP. If SSH is new, start with how to connect to a VPS via SSH.

Install with the road-warrior script

Rather than hand-building a PKI, use the widely trusted angristan/openvpn-install script, which handles certificates, the server config and firewall rules:

curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
sudo ./openvpn-install.sh

The interactive prompts ask for:

• Protocol: UDP is faster; choose TCP if you need port 443 to slip through firewalls.
• Port: 1194 by default, or 443 for stealth.
• DNS: pick a resolver for clients (or point them at your own Pi-hole).
• First client name: e.g. laptop.

When it finishes, it drops a .ovpn profile in your home directory.

Add and remove clients

Re-run the script any time to manage clients:

sudo ./openvpn-install.sh

Choose Add a new client to generate another .ovpn file, or Revoke to instantly cut off a lost device — a key advantage of OpenVPN's certificate model.

Connect a device

Copy the .ovpn file to your device securely (scp from your machine, not email):

scp root@your-server-ip:/root/laptop.ovpn .

Import it into the OpenVPN Connect app (mobile) or the OpenVPN GUI (desktop) and connect. Your traffic now exits through the VPS.

Firewall notes

The installer configures the needed rules, but confirm SSH stays open and only your chosen VPN port is exposed:

sudo ufw status

If you're layering this onto a hardened box, the securing your first Linux VPS checklist is worth a pass.

Routing, DNS and leak protection

When the installer asks about routing, most people want a full tunnel so all traffic exits through the VPS — the default. Pair it with a resolver so DNS queries don't leak back to your ISP; point clients at a public resolver or, better, your own Pi-hole for ad blocking on the move. After connecting, verify there are no leaks: confirm a "what is my IP" site shows the VPS address, and run a quick DNS-leak test to check lookups go through the tunnel.

If you'd rather only route traffic to your private services (a split tunnel), push specific routes instead of the default gateway — edit /etc/openvpn/server.conf, adjust the push "redirect-gateway" and push "route ..." directives, then restart the service.

Troubleshooting connections

A few issues account for most failures:

• TLS handshake timeout: the port is blocked. Confirm the firewall allows your chosen UDP/TCP port and that your network isn't filtering it.
• AUTH failed: the profile is stale — regenerate the client with the installer.
• Connects but no internet: IP forwarding or NAT isn't set. The script configures this, but if you customised the firewall, ensure forwarding is enabled:

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-openvpn.conf
sudo sysctl --system
sudo systemctl restart openvpn@server

UDP vs TCP, and performance

The protocol you chose at install time has real consequences:

• UDP is the default and the right choice almost always — it's faster and lower-latency because it doesn't add TCP's reliability overhead on top of what the tunnelled traffic already handles.
• TCP (typically on port 443) is slower and can suffer "TCP meltdown" under packet loss, but it slips through restrictive firewalls and proxies that block everything except HTTPS. Keep it as your fallback for locked-down networks, not your everyday setting.

If throughput feels low, check the client's MTU — VPNs sometimes need a slightly lower MTU to avoid fragmentation. You can also increase performance headroom by picking a VPS close to where you actually are, since every packet makes a round trip through the server.

Managing the server day to day

Check who's connected and watch the service health with standard tools:

sudo systemctl status openvpn@server
sudo cat /var/log/openvpn/status.log

The status log lists connected clients and their traffic, which is handy for spotting an unexpected connection or confirming a device really is routing through the tunnel.

FAQ

OpenVPN or WireGuard?

WireGuard is faster and simpler; OpenVPN is more compatible and better at evading restrictive firewalls via TCP 443. Pick based on whether speed or reach matters more.

Can OpenVPN run on port 443?

Yes, over TCP, which makes the traffic look like normal HTTPS and helps it pass through captive portals and corporate firewalls.

How do I revoke a lost device's access?

Re-run the installer and choose Revoke. Because OpenVPN uses per-client certificates, that device is cut off immediately without affecting others.

Is one VPS enough for a small team's VPN?

Yes. A modest VPS comfortably serves a small team; bandwidth is the main constraint, so size the plan to your usage.

Put your VPN somewhere reliable with full root access — see the VPN server hosting plans, or compare specs on the pricing page.