How to Install OpenVPN on Ubuntu

To install OpenVPN on Ubuntu, execute sudo apt install openvpn easy-rsa. This tutorial describes the above, the creation of the certificates required by OpenVPN to even function, and the systemd trick which gets everyone the first time they try to start OpenVPN.

How do I install OpenVPN on Ubuntu?

Install sudo apt install openvpn easy-rsa. easy-rsa is the tool which creates those certificates, hence is installed together with OpenVPN itself instead of in a separate procedure after.

$ sudo apt install openvpn easy-rsa

As per its man page, OpenVPN is described as "a robust and highly flexible VPN daemon" that "supports SSL/TLS security, ethernet bridging, TCP or UDP tunnel transport through proxies or NAT" — the certificate creation process from the next section is the foundation of the above SSL/TLS security.

How do I set up the certificate authority for OpenVPN with easy-rsa?

Copy the easy-rsa directory with make-cadir, and then run easyrsa init-pki and easyrsa build-ca to create your own certificate authority. All OpenVPN certificates after that are signed by this CA.

$ sudo make-cadir /etc/openvpn/easy-rsa
$ cd /etc/openvpn/easy-rsa
$ ./easyrsa init-pki && ./easyrsa build-ca
$ ./easyrsa gen-req myservername nopass
$ ./easyrsa gen-dh
$ ./easyrsa sign-req server myservername

These exact commands can be found in the official Ubuntu documentation — gen-req creates the certificate request of the server, gen-dh creates the Diffie-Hellman parameters for key exchange, and sign-req server is the command to turn the request into a certificate, which your own certificate authority will vouch for.

Why won't sudo systemctl start openvpn work on its own?

OpenVPN's systemd service is templated, hence requires a config name specified, e.g. openvpn@myserver for myserver.conf. Running systemctl start openvpn does not match any unit.

$ sudo systemctl start openvpn@myserver

The documentation explicitly states that systemctl start openvpn "won't work" by itself, and the templated service name must exactly correspond to the name of your configuration file — the config saved under the name of client1.conf requires openvpn@client1, and not openvpn@myserver.

Should I use UDP or TCP for my OpenVPN server?

Use UDP as the default option; as OpenVPN manual mentions, this is connectionless protocol with connection failure detection with the help of --ping and --ping-restart options. TCP is used in case UDP traffic is blocked.

proto udp

The man page provides the explanation of difference: "the proto argument indicates the protocol to use when connecting with the remote, and may be tcp or udp", and specifies that "UDP is connectionless, connection failure is defined by the --ping and --ping-restart options" — the TCP protocol works as a connection-oriented one and is usually slower in case of a tunnel connection, unless you are using a workaround of some kind.

Where do the server's certificate files need to end up?

The created dh.pem, ca.crt, server certificate and server key files need to be copied from the easy-rsa pki directory to /etc/openvpn/. The server config of OpenVPN assumes the existence of those files in the last location.

$ cp pki/dh.pem pki/ca.crt pki/issued/myservername.crt pki/private/myservername.key /etc/openvpn/

The exact copy process is described right after the signing process — this step is a common reason why OpenVPN server config cannot start despite the correct creation of certificates in the previous section.

Our VPS plans and Bare Metal servers both provide full access to apt, systemd and networking tools, hence OpenVPN server setup works as described above.