Ubuntu 18.04 LTS Set Up OpenVPN Server In 5 Minutes

I am a new Ubuntu Linux 18.04 LTS server user. How do I set up an OpenVPN Server on Ubuntu Linux version 18.04 LTS server to shield my browsing activity from bad guys on public Wi-Fi, and more?

Introduction OpenVPN is a full-featured SSL VPN (virtual private network). It implements OSI layer 2 or 3 secure network extension using the SSL/TLS protocol. It is an open source software and distributed under the GNU GPL. A VPN allows you to connect securely to an insecure public network such as wifi network at the airport or hotel. VPN is also required to access your corporate or enterprise or home server resources. You can bypass the geo-blocked site and increase your privacy or safety online. This tutorial provides step-by-step instructions for configuring an OpenVPN server on Ubuntu Linux 18.04 LTS server.
Tutorial details
Difficulty level Easy
Root privileges Yes
Requirements Ubuntu 18.04 LTS
Est. reading time 5 minutes

Procedure: Ubuntu 18.04 LTS Set Up OpenVPN Server In 5 Minutes

The steps are as follows:

Step 1 – Update your system

Run the apt command/apt-get command:
$ sudo apt update
$ sudo apt upgrade

Step 2 – Find and note down your IP address

Use the ip command as follows:
$ ip a
$ ip a show eth0

ip command get my IP address on Ubuntu Linux 18.04 LTS
Another option is to run the following dig command/host command to find out your public IP address from Linux command line:
$ dig +short myip.opendns.com @resolver1.opendns.com
OR
dig TXT +short o-o.myaddr.l.google.com @ns1.google.com | awk -F'"' '{ print $2}'
Find out my public IP address using the CLI

A note about IP address

Most cloud servers have two types of IP address:

  1. Public static IP address directly assigned to your box and routed from the Internet. For example, Linode, Digital Ocean, and others gives you direct public IP address.
  2. Private static IP address directly attached to your server and your server is behind NAT with public IP address. For example, AWS EC2/Lightsail give you this kind of NAT public IP address.

The script will automatically detect your networking setup. All you have to do is provide correct IP address when asked for it.

Step 3 – Download and run openvpn-install.sh script

I am going to use the wget command:
$ wget https://git.io/vpn -O openvpn-install.sh
Download openvpn-install.sh script to setup OpenVPN server in 5 minutes on Ubuntu
Setup permissions using the chmod command:
$ chmod +x openvpn-install.sh
One can view the script using a text editor such as nano/vim:
$ vim openvpn-install.sh

Run openvpn-install.sh to install OpenVPN server

Now all you have to do is:
$ sudo ./openvpn-install.sh
Sample session from AWS/Lightsail where my cloud server is behind NAT:
Ubuntu 18.04 LTS Setup OpenVPN Server In 5 Minutes
Sample session from Linode/DO server where cloud server has direct public IPv4 address:
How To Setup OpenVPN Server In 5 Minutes on Ubuntu Linux
To avoid problem always choose DNS as 1.1.1.1 or Google DNS. Those are fast DNS server and reached from anywhere on the Internet.

How do I start/stop/restart OpenVPN server on Ubuntu 18.04 LTS?

We need to use the systemctl command:
$ sudo systemctl stop openvpn-server@server.service # <--- stop server
$ sudo systemctl start openvpn-server@server.service # <--- start server
$ sudo systemctl restart openvpn-server@server.service # <--- restart server
$ sudo systemctl status openvpn-server@server.service # <--- get server status

 openvpn-server@server.service - OpenVPN service for server
   Loaded: loaded (/lib/systemd/system/openvpn-server@.service; indirect; vendor preset: enabled)
   Active: active (running) since Sun 2020-11-22 13:42:38 UTC; 3min 55s ago
     Docs: man:openvpn(8)
           https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
           https://community.openvpn.net/openvpn/wiki/HOWTO
 Main PID: 825 (openvpn)
   Status: "Initialization Sequence Completed"
    Tasks: 1 (limit: 536)
   CGroup: /system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service
           └─825 /usr/sbin/openvpn --status /run/openvpn-server/status-server.log --status-version 2 --suppress-timestamps --config server.conf

Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: Could not determine IPv4/IPv6 protocol. Using AF_INET
Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: UDPv4 link local (bound): [AF_INET]172.26.5.75:1194
Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: UDPv4 link remote: [AF_UNSPEC]
Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: GID set to nogroup
Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: UID set to nobody
Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: MULTI: multi_init called, r=256 v=256
Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: IFCONFIG POOL LIST
Nov 22 13:42:39 ip-172-26-5-75 openvpn[825]: Initialization Sequence Completed


Warning: AWS EC2/Lightsail users need to open the default OpenVPN port UDP/1194 using Amazon EC2 security groups for the Linux instances feature. Run the following ss command to see your OpenVPN port on EC2 cloud instance:
sudo ss -tulpn | grep -i openvpn

AWS EC2 Lightsail Open OpenVPN UDP port 1194 using Firewall

OpenVPN UDP port 1194 opened using AWS EC2/Lightsail Linux instance

Step 4 – Connect an OpenVPN server using IOS/Android/Linux/Windows client

On server your will find a client configuration file called ~/desktop.ovpn. All you have to do is copy this file to your local desktop using the scp command:
$ scp vivek@104.20.187.5:~/deskcop.ovpn .
Next, provide this file to your OpenVPN client to connect:

  1. Apple iOS client
  2. Android client
  3. Apple MacOS (OS X) client
  4. Windows 8/10 client

Forgotten your .opvn file location such as desktop.ovpn on the Ubuntu server? Try locating by typing the following command:
sudo find / -iname "*.ovpn"

Linux Desktop: OpenVPN client configuration

First, install the openvpn client for your desktop, enter:
$ sudo yum install openvpn
OR
$ sudo apt install openvpn
Next, copy desktop.ovpn as follows:
$ sudo cp desktop.ovpn /etc/openvpn/client.conf
Test connectivity from the CLI:
$ sudo openvpn --client --config /etc/openvpn/desktop.conf
Your Linux system will automatically connect when computer restart using openvpn script/service:
$ sudo systemctl start openvpn@client # <--- start client service

Step 5 - Verify/test the connectivity

Execute the following commands after connecting to OpenVPN server from your Linux desktop:
$ ping 10.8.0.1 #Ping to the OpenVPN server gateway
$ ip route #Make sure routing setup working
$ dig TXT +short o-o.myaddr.l.google.com @ns1.google.com #Must return public IP address of OpenVPN server

Step 6 - Adding or removing OpenVPN client

Log in to your server and run the script again:
$ sudo ./openvpn-install.sh

OpenVPN is already installed.

Select an option:
   1) Add a new client
   2) Revoke an existing client
   3) Remove OpenVPN
   4) Exit
Option: 

Use option number 1 to add a new client and option number 2 to remove or revoke an existing OpenVPN client from the server.

A note about trouble shooting OpenVPN server and client issues

Check OpenVPN server for errors using the jourlctl command:
$ sudo journalctl --identifier openvpn
## OR filter it using the grep command/egrep command ##
$ sudo journalctl -x -e | grep -i 'error'
$ sudo journalctl -x -e | egrep -i 'error|warn|your_ip_here'
$ sudo journalctl -xe -u openvpn-server@server.service

OpenVPN server log files and error

Click to enlarge image

Is firewall rule setup correctly on your server? Use the cat command to see rules:
$ cat /etc/systemd/system/openvpn-iptables.service

[Unit]
Before=network.target
[Service]
Type=oneshot
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 172.xxx.yyy.zzz
ExecStart=/sbin/iptables -I INPUT -p udp --dport 1194 -j ACCEPT
ExecStart=/sbin/iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
ExecStart=/sbin/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 172.xxx.yyy.zzz
ExecStop=/sbin/iptables -D INPUT -p udp --dport 1194 -j ACCEPT
ExecStop=/sbin/iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT
ExecStop=/sbin/iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ExecStart=/sbin/ip6tables -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to 2600:xxxx::yyyy:zzzz:dddd:cccc
ExecStart=/sbin/ip6tables -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
ExecStart=/sbin/ip6tables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ExecStop=/sbin/ip6tables -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to 2600:xxxx::yyyy:zzzz:dddd:cccc
ExecStop=/sbin/ip6tables -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
ExecStop=/sbin/ip6tables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target

Of course, we check status of the iptables rules that required for OpenVPN using the following command:
$ sudo systemctl status openvpn-iptables.service
If not running or failed start it:
$ sudo systemctl start openvpn-iptables.service
Another option is to run iptables command and sysctl command commands to verify NAT rule setup on your server:
$ sudo iptables -t nat -L -n -v
$ sysctl net.ipv4.ip_forward

NAT Firewall OpenVPN Rules Verification
Insert the rules if not inserted from /etc/rc.local
$ sudo systemctl start openvpn-iptables.service
$ sudo sysctl -w net.ipv4.ip_forward=1

Is OpenVPN server running and port is open? Use the ss command or netstat command and pidof command/ps command:
$ netstat -tulpn | grep :1194 ## 1194 is the openvpn server port ##
$ ss -tulpn | grep :1194 ## 1194 is the openvpn server port ##
$ ps aux | grep openvpn ## is the openvpn server running? ##
$ ps -C openvpn ## is the openvpn server running? ##
$ pidof openvpn ## find the openvpn server PID ##

Verify that OpenVPN server runnign and Port is Open on ubuntu Linux
If not running, restart the OpenVPN server:
$ sudo systemctl start openvpn-server@server.service
Look out for errors:
$ sudo systemctl status openvpn-server@server.service
Can the Linux desktop client connect to the OpenVPN server machine? First you need to run a simple test to see if the OpenVPN server port (UDP 1194) accepts connections:
$ nc -vu 104.20.187.5 1194
Connection to 104.20.187.5 1194 port [udp/openvpn] succeeded!

If not connected it means either a Linux desktop firewall or your router is blocking access to server. Make sure both client and server using same protocol and port, e.g. UDP port 1194.

Conclusion

Congratulations. You successfully set up an OpenVPN server on Ubuntu Linux 18.04 LTS server running in the cloud. See the OpenVPN website server, Github script page, and Ubuntu server/project for additional information.


🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 43 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersdf ncdu pydf
File Managementcat tree
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
43 comments… add one
  • nas Aug 9, 2020 @ 15:18

    it doesn’t work

  • Gangasagar Aug 12, 2020 @ 12:14

    how to connect openvpn from web by installing above method

    • 🐧 Vivek Gite Aug 15, 2020 @ 8:57

      Once server configured, download clients as per your operating system. Copy the client file (.ovpn) from the server and install it using your client app.

  • ignacio Aug 14, 2020 @ 16:25

    when i try to start server it gives me the following error:

    Job for openvpn@server.service failed because the control process exited with error code.
    See “systemctl status openvpn@server.service” and “journalctl -xe” for details.

    • 🐧 Vivek Gite Aug 15, 2020 @ 8:22

      Check status and error log using the following syntax (note the correct name of service changed/updated in scripts to ‘openvpn-server@server.service‘:
      sudo systemctl status openvpn-server@server.service
      sudo journalctl -xe -u openvpn-server@server.service
      sudo journalctl -xe | more

  • Hannah Aug 17, 2020 @ 14:30

    This worked perfectly on a fresh install of 18.04. Thank you. Is there a way more suited to this install script to create a second client?

    • 🐧 Vivek Gite Aug 17, 2020 @ 17:17

      Run the same script again to add or remove client.

  • Ram.k Aug 27, 2020 @ 19:58

    Great post… it worked for me… please include how to add authentication for the openvpn clients.

  • Phan Loi Sep 1, 2020 @ 8:19

    Great post. It work perfectly for me.

    Is there any way we can enable both IPv4 and IPv6? When I try this, only my IPv4 get change. My IPv6 is not changed.

    • 🐧 Vivek Gite Sep 13, 2020 @ 6:59

      You need to specify IPv6 while setting up server.

  • Jerry Sep 13, 2020 @ 3:46

    I get the following:

    Sep 12 22:36:01 nvr ovpn-server[31205]: Options error: In [CMD-LINE]:1: Error opening configuration file: /etc/openvpn/server.conf
    Sep 12 22:36:01 nvr ovpn-server[31205]: Use --help for more information.
    Sep 12 22:36:01 nvr systemd[1]: openvpn@server.service: Main process exited, code=exited, status=1/FAILURE

    The file is there, just not sure why it can’t open it.

  • lumajang Sep 24, 2020 @ 3:28

    is this can only connect to 1 device? because when i try with laptop and android one of them disconnected

    • 🐧 Vivek Gite Sep 24, 2020 @ 7:33

      You need to create user/certificate for each device. See step # 6.

  • lumajang Sep 24, 2020 @ 3:29

    is this can only connect to 1 device? when i connect with 2 device 1 get disconnected

  • chico1852 Sep 27, 2020 @ 10:59

    Impossible to download deskcop.ovpn:
    ssh: connect to host 104.20.187.5 port 22: Connection timed out

  • Anonymous Oct 13, 2020 @ 19:53

    Dear, i can’t connect, i think it is because of DPI of my internet provider.
    Can you tell me which tls version used this server configuration, is it tls 1.3???

  • minhthuan Nov 5, 2020 @ 17:53

    How I find ~/desktop.ovpn ??? Please help me

    • 🐧 Vivek Gite Nov 22, 2020 @ 13:31

      Run the following command:
      sudo find / -iname "~/desktop.ovpn"

  • wclau Nov 22, 2020 @ 7:58

    Hi,

    I tried the instructions multiple times on an AWS EC2 Ubuntu 18.04 instance.
    I understand my instance is behind the AWS NAT and the script successfully detected its public ip address correctly.

    However, after launching the openvpn service, I could not connect to the openvpn server from outside.
    The following was what I got after checking the status of the openvpn server using the
    sudo systemctl status openvpn@server” command:

    It seems when launching the openvpn service from your install script, it could not
    locate the certificate and key files: ca.crt, server.crt, server.key, etc.

    Options error: --ca fails with 'ca.crt': No such file or directory (errno=2)
    Options error:  --cert fails with 'server.crt': No such file or directory (errno=2)
     WARNING: cannot stat file 'server.key': No such file or directory (errno=2)
    Options error: --key fails with 'server.key': No such file or directory (errno=2)
    

    However, I manually check, all these key and cert files are available at /etc/openvpn/server directory.
    Is there something missing when specifying the path of these files in your script ?

    I have tried running the “sudo ./openvpn-install” both either my home directory or from the /etc/openvpn/server directory but it still did not work.

    Please advise and many thanks in advance.

  • Ahmad Audi Nov 23, 2020 @ 6:47

    This works great with Ubuntu 20.04.

  • aT5eY9mC2 Nov 25, 2020 @ 2:46

    Good instruction on the server side, however on the client side this setup results in DNS leak on Ubuntu 20.04 that can be easily verified by connecting with Wireshark to your network adapter.

    Here you can find instructions on how to fix to DNS leak:

    Key difference is:

    1) Install this on client:
    sudo apt install -y openvpn network-manager-openvpn network-manager-openvpn-gnome network-manager-vpnc resolvconf

    2) Append this to VPN config:
    script-security 2
    up /etc/openvpn/update-resolv-conf
    down /etc/openvpn/update-resolv-conf

    As a bonus here is UFW setup that ensures that nothing goes outside of the VPN tunnel:
    sudo ufw default deny outgoing
    sudo ufw allow out on ADPAPTER_NAME (tun0 in Ubuntu)
    sudo ufw allow out to VPN_SERVER_IPV4
    sudo ufw reload

  • Artem Nov 29, 2020 @ 20:25

    followed by manual, got an issue.
    pi-hole up and running, but it shows only 2 client…server IP and 127.0.0.1, i dont see if 10.8.0.2 clients IP works with pi-hole DNS.

    somewhere an issue in code.

  • Nima Dec 6, 2020 @ 14:37

    Great content. It worked partly it get connected to sites like Twitter and work but it can’t load all contents like images or for youtube nothing is show while for the telegram app on mobile it’s working very fast. the is no error in OpenVPN status and I can ping all the websites

    • Sahdnoush Apr 6, 2021 @ 7:51

      hey, I got errors in connecting to this vpn, can you help through this?

      • Oliver Barker Apr 8, 2021 @ 7:26

        I had same problem, turned out my firewall rules were preventing rules loading from the /etc/systemd/system/openvpn-iptables.service file. So I edited out my iptables rules to add rules from that file. It worked after that. So look for iptables rules.

  • Clebe Martins Dec 10, 2020 @ 22:40

    client does not surf the internet !!! ????

  • U.Akin Dec 20, 2020 @ 11:50

    Hi,
    When I issue $ ip a show eth0 comman, I got “Device “eth0″ does not exist.”
    When I issue $ dig +short myip.opendns.com @resolver1.opendns.com I got the Google Cloud external ip of my server.
    Is that normal?

  • Sanchit Jan 13, 2021 @ 8:51

    Hey Vivek,

    Is it possible to limit Internet to only one Server and not whole server. Let me know if this is possible. I want to limit access on my VPN server to Open only single website/ip.

    • 🐧 Vivek Gite Jan 13, 2021 @ 9:00

      You can do that with firewall setting or put proxy server.

  • Joel Jan 20, 2021 @ 23:16

    respect, such a good script and instruction.

  • Agus Saputra Sijabat Jan 23, 2021 @ 8:31

    Thanks, it’s worked for me.

  • boy Jan 25, 2021 @ 12:28

    desktop.ovpn client can’t connect to server openvpn

  • Néstor Gómez Mar 2, 2021 @ 1:08

    Hola, buenísimo el tutorial pero si deseo cambiar de IP estática privada a IP publica fija, cómo debo hacerlo? Gracias

    • 🐧 Vivek Gite Mar 2, 2021 @ 4:04

      VPN tunnel will always have private IP. NAT will do automatic public IPv4/IPv6.

  • Nasir Mar 6, 2021 @ 22:34

    VPN gets connected but no internet or very very slow internet on the client. Using UDP option and Windows 10 Client. Same thing on a mac OS

  • Adolfo Mar 10, 2021 @ 21:37

    Please
    I’d like the use local internet instead of server internet. How can I use may own internet to navigate, e use openvpn for consume only BD,files and etc? Thank’s

  • M Saeful Anwar Mar 16, 2021 @ 3:46

    How to change Privat IP 10.8.0.2 ?

  • Anonymous Mar 30, 2021 @ 18:07

    I’m unfamiliar with linux/ubuntu stuff, will this also work with 20.04 or are some of the commands different?

  • Breiner Henrique Apr 5, 2021 @ 15:07

    Very good, a very simple way to install and configure OpenVPN… It worked. Now I will make some changes to use in my environment.

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum