Updated: 28 September 2026 · Applies to: OpenVPN 2.5/2.6 with Easy-RSA 3 on Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9
Debian 10 is end of life; these steps are for Debian 12 (OpenVPN 2.6), and also work on Ubuntu 24.04 and AlmaLinux/Rocky 9. OpenVPN creates an encrypted tunnel so your devices can use the server's connection securely.
1. Install OpenVPN and Easy-RSA
apt install openvpn easy-rsa # Ubuntu 24.04 / Debian 12 dnf install epel-release && dnf install openvpn easy-rsa # AlmaLinux / Rocky 9
2. Create the certificate authority and certificates
make-cadir ~/easy-rsa && cd ~/easy-rsa # AlmaLinux/Rocky: mkdir ~/easy-rsa && cp -r /usr/share/easy-rsa/3/* ~/easy-rsa/ && cd ~/easy-rsa ./easyrsa init-pki ./easyrsa build-ca nopass ./easyrsa build-server-full server nopass ./easyrsa build-client-full client1 nopass openvpn --genkey secret ta.key cp pki/ca.crt pki/issued/server.crt pki/private/server.key ta.key /etc/openvpn/server/
For better security, keep the CA on a separate machine and only copy the signed certificates to the VPN server.
3. Server configuration
Create /etc/openvpn/server/server.conf:
port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh none tls-crypt ta.key server 10.8.0.0 255.255.255.0 push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 1.1.1.1" keepalive 10 120 user nobody group nogroup persist-key persist-tun verb 3
On AlmaLinux/Rocky use group nobody. dh none uses modern elliptic-curve key exchange, so no DH file is needed.
4. Forwarding and NAT
echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn.conf && sysctl --system # AlmaLinux / Rocky (firewalld) firewall-cmd --permanent --add-service=openvpn firewall-cmd --permanent --add-masquerade firewall-cmd --reload
With UFW (Ubuntu/Debian): set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw, add this at the top of /etc/ufw/before.rules (replace eth0 with your interface from ip route), then ufw allow 1194/udp && ufw reload:
*nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE COMMIT
5. Start the server
systemctl enable --now openvpn-server@server systemctl status openvpn-server@server
6. Client configuration
Create client1.ovpn and paste the contents of the files between the tags:
client dev tun proto udp remote SERVER-IP 1194 resolv-retry infinite nobind persist-key persist-tun remote-cert-tls server verb 3 <ca> (contents of pki/ca.crt) </ca> <cert> (contents of pki/issued/client1.crt, from -----BEGIN CERTIFICATE-----) </cert> <key> (contents of pki/private/client1.key) </key> <tls-crypt> (contents of ta.key) </tls-crypt>
Import the file into the OpenVPN Connect app (Windows, macOS, Android, iOS) or use sudo openvpn --config client1.ovpn on Linux. Check your public IP after connecting: it should be the server's.
Tip: WireGuard is a simpler and faster alternative for new VPNs: apt install wireguard, one small configuration file per side, and apps for all platforms.
