Introduction: Host Your Own Virtual Private Network (VPN) With OpenVPN

Picture of Host Your Own Virtual Private Network (VPN) With OpenVPN

A Virtual Private Network, or VPN, creates an encrypted tunnel between you computer (client) and the VPN (server). This encrypted tunnel carries data that cannot be deciphered without the proper keys, and you control what clients have access to those keys. A popular VPN software is called OpenVPN. This software uses strong encryption methods to help ensure that no spying eyes can see what you are doing. I cannot guarantee that this software will keep you completely anonymous, but it is an excellent start. VPNs have many other uses besides Internet anonymity; they can connect a user to a local area network even if they are not anywhere near it. If you need to access a file at a business from your home, a VPN is probably used. The objective of this guide is to explain how to configure OpenVPN on a server and client to form a strong encrypted VPN tunnel.

This guide helped me configure my connection. If you run into any trouble in this tutorial, take a look at this guide or leave a comment below. 

Step 1: Prerequisites

These are the things you will need in order to successfully create a VPN.

An Ubuntu Linux Server. If you do not have a Linux Server, refer to my cloud guide for more information on how to set one up.

Port forwarding skills. If you do not know how to port forward on a router, check out Step 7 of my cloud guide for specific instructions.

A domain name attached to your server. If you do not have a domain name for your server, refer to Step 9 of the cloud guide for instructions. If you have not already noticed, my cloud guide is a great reference point for basic information regarding server setup. I walk though the entire server setup in that guide. Please do not hesitate to ask questions! It is very important that you follow this guide to the letter. One mis-configured setting can throw off the entire configuration.

Step 2: Install OpenVPN

Picture of Install OpenVPN

We need to install OpenVPN on the Ubuntu Server in order to configure it properly. Open a terminal by pressing Control + Alt + T. Once the terminal window is open type:

sudo apt-get install openvpn bridge-utils

This will install the openvpn client on our server. 
Note Ubuntu will ask your password. Type in the password that you created when you installed Ubuntu on the system. Do not worry that no asterisks are showing up when you are typing your password, its supposed to work that way! 

Step 3: Configure Network Settings

Picture of Configure Network Settings

We need to create a bridge in our server to allow the VPN to work. Open a terminal and type:

sudo nano /etc/network/interfaces

This command will allow you to edit the interfaces file of the server. The file should have two lines in it. If your file has more lines in it, be sure to comment those out with a hashtag (#).  I have added my comments in the example file below. Please remember to change the fields according to your specific network requirements. Make sure that you do not copy the first two lines of this code if you already have them in your file. Copy and paste the following code into the file. Once you have finished, press Control + O and Enter to save changes, and then Control + X to exit. 

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
# The next two lines are the original lines of the file, leave them in here.

auto lo
iface lo inet loopback

#These next lines will create a the bridge for OpenVPN

auto br0
iface br0 inet static
#The IP Address above needs to be the IP address of your server.
#Be  sure that this IP address is the Internal IP Address of the
#Server, not the public IP. It should look similair to the IP
#Address above.
#The netmask will probably not need to be changed.
#The gateway column refers to the default gateaway of your router.
#This address will probably be the same as the address used to
#port forward.
bridge_ports eth0
#This command bridges your ethernet connection for OpenVPN

iface eth0 inet manual
up ifconfig $IFACE up
up ip link set $IFACE promisc on
down ip link set $IFACE promisc off
down ifconfig $IFACE down
#I really don't know what these last set of lines do, but they
#still need to be here.

Step 4: More Configuration and Forwarding!

Picture of More Configuration and Forwarding!

We need to enable IPv4 forwarding so a client on the VPN can browse the Internet. In the terminal type:

sudo nano /etc/sysctl.conf

Uncomment the line that says net.ipv4.ip_forward=1. To uncomment a line, simply remove the hashtag (#) at the beginning of the line. 

Next, we need to forward port 1194 to the IP address of our server. Please see Step 7 of my cloud guide for more information on how to port forward. 

Reboot your server and ensure that all networking components are working. To test this, try to ping the server's IP address from another client on the network. If you are using windows, open a command prompt and type:

ping <your server's IP address>

If you get a response, you are good to go!

Step 5: Create the Server Keys and Certificates

Picture of Create the Server Keys and Certificates

The certificates we will create in this step allow our server to authorize clients trying to access the VPN.


First we need to make an Easy-rsa folder, Open a terminal on the server and type:

sudo mkdir /etc/openvpn/easy-rsa/

Next, we need the example certificate files from one directory to the directory we just created.  In the terminal, enter:

sudo cp -R /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/

Change the ownership of the files by using the chown command. In the terminal enter:

sudo chown -R $USER /etc/openvpn/easy-rsa/

Vars file

We need to make some changes to the vars file in order to properly generate our certificates. In the terminal type:

sudo nano /etc/openvpn/easy-rsa/vars

This command will open the vars file in the terminal, we need to edit a couple of fields. The first field we need to edit is the export KEY_CONFIG field. Look for that line in the file and replace it with:

export KEY_CONFIG=/etc/openvpn/easy-rsa/openssl-0.9.6.cnf

This is the configuration file used to create authorization certificates. 

Next, change the following fields at the bottom of your file to you liking. There are two e-mail lines, but you only need to edit the first one. Make sure you have quotation marks around each of the values.

export KEY_CITY
export KEY_ORG
export KEY_EMAIL

Once you are finished editing the values, press Control + O and then enter to save the changes, and Control + X to exit back into terminal.
We are now ready to generate certificates for the server.

This next set of scripts is going to create the script for the server and one client. In terminal, use the cd command to move into the proper directory by entering:

cd /etc/openvpn/easy-rsa/

Open the source script:

source vars

Clean the directory:


Build the encryption of the certificates and build the actual certificates:

./pkitool --initca
./pkitool --server server

Move into the new keys directory:

cd keys

Generate another key:

openvpn --genkey --secret ta.key

Copy all the keys into the /etc/openvpn/ directory:

sudo cp server.crt server.key ca.crt dh1024.pem ta.key /etc/openvpn/

The server keys and certificates are now created. Next, we need to make the client keys and certificates.

Step 6: Create Client Certificates

Picture of Create Client Certificates

The client certificates allow a client device access to the VPN server. These certificates will be made on the server and transferred to the client PC. Open a terminal and enter:

cd /etc/openvpn/easy-rsa/

Then prepare the vars script:

source vars

Create the client certificates:

KEY_CN=client ./pkitool client

Replace the word client with whatever name you are assigning to the client device. In my example, I assign the name ubuntu to my client device. Be sure to change both instances of the word client to your specific client name.

Transfer the following files from the server to the client device. If Ubuntu does not let you copy the files. Try pressing Alt+f2 and entering gksudo +nautilus. Then you will be copying the files as root.


Please note that the first two files have different directories than the last two. Transfer the files to the client device using some form of physical storage. Do not transfer the files over the Internet in a non-secure fashion such as e-mailing them to yourself. Later in this Instructable, I will show you where to place those files on the client device. 

Step 7: Create Server VPN Scripts

Picture of Create Server VPN Scripts

The server needs some VPN Scripts bring up the VPN network, and to bring the VPN network back down. In a terminal on the server, create the 'up' script by entering:

sudo nano /etc/openvpn/

A blank document will open in the temrinal. Copy and paste this text into the document:

/sbin/ifconfig $DEV mtu $MTU promisc up
/sbin/brctl addif $BR $DEV

Once finished press Control + O to save changes and Control + X to exit. Now we need to create the 'down' script. In the same terminal enter:

sudo nano /etc/openvpn/

A blank document will open in the temrinal. Copy and paste this text into the document:

/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down

Once finished press Control + O to save changes and Control + X to exit.

Finally we need to make the scripts executable.  In terminal, enter:

sudo chmod 755 /etc/openvpn/


sudo chmod 755 /etc/openvpn/

This completes the up and down scripts for OpenVPN

Step 8: Configure OpenVPN Settings

Picture of Configure OpenVPN Settings

This is a very confusing part for most people, so this is a very important step. We are going to configure the proper settings for the VPN server. There are many different things we have to change in this configuration file. In the file, a semicolon at the beginning of a line means that the line is commented out, meaning it does not apply. To uncomment a line, simply remove the semicolon and the line will become active. I will demonstrate this with as many pictures as I can. Please look at those pictures for the proper configurations if you do not understand the text. I am just going to tell you what to do in the text, so the pictures are extremely important.

Copy the sample configuration files to our openVPN server directory. In a terminal enter:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
sudo gzip -d /etc/openvpn/server.conf.gz

Then, open the Configuration file. In a terminal enter:

sudo nano /etc/openvpn/server.conf

Make these changes in the file:

Comment out the dev tun line.
Uncomment the dev tap line and add a 0 to the end. It should now say 'dev tap0'

Comment out server

Uncomment the ;server-bridge line. 
Change that line to something like: server-bridge
The first IP address is the local address of the server. The second set of numbers is the subnet mask, match it to your IP address. In most cases this value will not need to be changed, The third set of numbers is the beginning range IP address you would like to assign to devices that connect to your VPN. The fourth set of numbers is the ending range IP address you assign to client VPN devices. When a device connects to the VPN, it will be assigned a local IP address defined in the final two sets of numbers in this line. It is important that you do not assign IP addresses in this file that are already in use by other devices on the local network.

Uncomment the ;push "route" line.
Change the IP address to match that of your default gateway. In my example it is:

Uncomment the ;push "redirect-gateway def1 bypass-dhcp" line.

Uncomment the ;push "dhcp-option DNS" and ;push "dhcp-option DNS" lines. If you would like to point the point the server to your own DNS servers, change the DNS server IP addresses. If not, you can leave this addresses alone as they are OpenVPN's DNS Servers.

Uncomment the ;tls-auth ta.key 0 # This file is secret line.

Uncomment the ;cipher AES-128-CBC line. 

Uncomment the ;user nobody and ;group nogroup lines

Add these next three lines to the bottom of the file:

up "/etc/openvpn/ br0"
down "/etc/openvpn/ br0"
push "explicit-exit-notify 3"

Reboot your server to restart all networking equipment. 
This completes the VPN server configuration, now we need to configure our client. 

Step 9: Install and Configure OpenVPN on Ubuntu Linux

Picture of Install and Configure OpenVPN on Ubuntu Linux

This step will explain how to install and configure the OpenVPN client on Ubuntu Linux. If you are using Windows, I have created a configuration guide in the next step. I would head over there now.

In a terminal on the client device enter:

sudo apt-get install network-manager-openvpn-gnome

Copy the certificates from Step 6 into the home directory.

Open the network manager by clicking System Settings > Network.

Press the + button at the bottom of the page and create a VPN Interface. Choose OpenVPN as the connection type and click Create.

Name your VPN in the Connection Name field. 
Enter the server's domain name you registered earlier in the gateway field. 
Open your client.crt file in the user certificate field.
Open the ca.crt file in the CA Certificate field.
Open the client.key file in the Private Key field. 

Click Advanced

In the general tab:

Check the Use LZO Data Compression checkbox
Check the Use a TAP device checkbox

In the security tab:

From the drop-down list in the cipher field, select AES-128-CBC.

In the TLS Authentication tab:

Check the Use additional TLS authentication checkbox.
Open the ta.key file from your home directory
Set the key direction to 1

Click Ok to save the Advanced Settings.

In the general tab:

Uncheck the All users may connect to this network checkbox.

Click Save to save your VPN settings. 
Turn the VPN connection on and you should be good to connect to your VPN. 


Step 10: Install and Configure OpenVPN on Windows

Picture of Install and Configure OpenVPN on Windows

Now I will show the Windows users how to configure OpenVPN on the client PC. First, visit this link and download the OpenVPN client for your version of Windows.

Next, open My Computer and click on your C: drive. Navigate to Program Files> OpenVPN>sample-config. If you are using Windows Vista/7/8, open My Computer as administrator.

Copy the client file.
Go back one directory and click the config folder. Paste the client file in this directory. Also, paste the files you copied from the server earlier in this guide into this folder.

Open the client.ovpn file with notepad. Edit the following lines just like in the server.conf file.

Comment out the dev tun line
Uncomment the dev tap line and add a 0 to the end. The line should now say 'dev tap0'.

In the remote server line, enter the domain name of your server. Do not remove the remote word or the 1194. See the picture for clarification.

In the SSL/TLS section. Enter the names of your keys and certificates. In my example I enter:

Please see my picture for further clarification on this step.

Uncomment the tls-auth ta.key 1 line.

Uncomment the cipher line and replace the x with AES-128-CBC. The line should now look like 'cipher AES-128-CBC'

Save the client file.

There should be a OpenVPN GUI icon on your desktop. Open this program. If you are using Windows Vista/7/8 open this program as administrator. The program will load the configuration file. To connect to your VPN, find the icon in the system tray. Right click it and click connect. The program should now connect you to your VPN server. 


Mayakloze (author)2017-01-23

Great tutorial, right now i don't have much time to configure this in our 50 machines but i did it at home and it worked great. Btw do you think i should just buy a subscription from some mainstream vpn service to save me the time of installing this in all our computers at work?

VPNNut (author)Mayakloze2017-11-01

I don't think it's feasible to host a VPN server for 50 machines. You might want to consider a VPN appliance (Cisco comes to mind) and a commercial VPN service.

oscarascal (author)2017-08-02

Does it have a user limit, like using OpenVPN Access Server?

FildaO (author)2017-07-30

HI, pls I am really knew with all this stuff but really want to try hosting my own vpn. pls is there any way this configuration can be done on a virtual machine hosted on my main laptop.

Navster (author)2017-02-11

How can properly root my lg ls665. Ive been trying so hard yet evrrythings jus been a flook

NathanielJS1541 (author)2017-01-25

I got as far as step 4 and thought that i'd finished, but when I ping the server IP all i get is "Request timed out.". Can you please suggest where I went wrong? Thanks!

ColinN8 (author)2016-12-07

Nice instructable!

I want to setup a cloud on Linux Mint that is only accessible at home. I don't need it to be accessible over the net. We use iOSX, windows and Linux on the tv streaming computer. Is this an easy setup? How do I do this?

sagar72 made it! (author)2016-05-14

how can i made it for all ip&all ip show

kevink145 (author)2016-04-23

please update the steps. Took a day and a lot of hair tearing out to get this up and running. Specifacly steps 5 and 6

Paul Weicker (author)2016-04-19

I was wondering if i can setup an isp server call to my cell phone and establish a data connection. PJ

vandan131 (author)2016-03-19

Great Info

metalinspired (author)2015-11-18

Great tutorial.

Do you have any update on how to tunnel IPv6?

HaroldK2 (author)2015-06-17

Great job on the site. In the event that you need to wind up unknown online then you have to look at this

nickhui (author)2015-02-15

I have gone through all of the instructions exactly as described, but ran in to a couple of problems. What do I need to do to fix these problems?

1) After I update the /etc/network/interfaces file, the server is no longer able to connect to the router and/or Internet.

2) Error messages appear when generating client keys.

3) There's no instructions regarding what to do with the Client Certificate Files and where to place them (Windows)

----- Original: /etc/network/interfaces -----

Able to pin the router connect to the Internet (to install things); Other devices can access server by going to ServerIP:Port via web browser.

----- BEGINING OF FILE -----

# This file describes the network interfaces available on your system

# and how to activate them. For more information, see interfaces(5).

# The loopback network interface

auto lo

iface lo inet loopback

# The primary network interface

auto p1p1

iface p1p1 inet dhcp

----- END OF FILE -----

----- Followed Instructions: /etc/network/interfaces -----

Unable to ping the router and/or Internet; Other devices cannot connect either.

----- BEGINING OF FILE -----

# This file describes the network interfaces available on your system

# and how to activate them. For more information, see interfaces(5).

# The loopback network interface

# The next two lines are the original lines of the file, leave them in here.

auto lo

iface lo inet loopback

#These next lines will create a the bridge for OpenVPN

auto br0

iface br0 inet static


#The IP Address above needs to be the IP address of your server.

#Be sure that this IP address is the Internal IP Address of the

#Server, not the public IP. It should look similair to the IP

#Address above.


#The netmask will probably not need to be changed.


#The gateway column refers to the default gateaway of your router.

#This address will probably be the same as the address used to

#port forward.

bridge_ports eth0

#This command bridges your ethernet connection for OpenVPN

iface eth0 inet manual

up ifconfig $IFACE up

up ip link set $IFACE promisc on

down ip link set $IFACE promisc off

down ifconfig $IFACE down

#I really don't know what these last set of lines do, but they

#still need to be here.

----- END OF FILE -----


GraydonT (author)nickhui2015-05-03

i know in some cases isp will block certain things on a network to keep everyone else bandwidth as fast as possible. comcast does this the most espsesialy on port 80(http)

hakn8t (author)2015-01-31

Novice. Your Cloud 2.0 was easy to follow. I am running into the same issue when I come to Housekeeping as below and nothing posted here or by searching internet has resolved it.

I am getting the could not resolve messages for Easy-rsa does not install so I cannot move the certificates. What am I doing wrong?
Your assistance is greatly appreciated.

MFK DGAF (author)2014-11-23

What I noticed is that after installing OpenVPN on Ubuntu Server 14.04 that when you run the command "sudo mkdir /etc/openvpn/easy-rsa/" it comes back as the directory doesn't exist. Then if you run "sudo mkdir /etc/openvpn/" it creates the directory which therefore means OpenVPN wasn't really installed. So when you try to run the command "sudo cp -R /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/" it can't execute because the directory was never create by the install.

I get this error if I let the OS install OpenVPN when I install the OS or when i manually install OpenVPN by executing the command "sudo apt-get install openvpn bridge-utils".

Maybe it has something to do with the fact that we are trying to do this on the actually Ubuntu Server OS (14.10) and not on the Ubuntu Desktop OS like in the screen shots?

robotterror (author)MFK DGAF2014-12-12

The "mkdir" command is missing the "-p" flag to allow creation of intermediary directories as needed. Example:

$ mkdir one/two/three
mkdir: one/two: No such file or directory
$ mkdir -p one/two/three
ls one/two

So, change the command to:

sudo mkdir -p /etc/openvpn/easy-rsa/

And it will work for you.

MFK DGAF (author)MFK DGAF2014-11-23

I took a closer look and when trying to execute "sudo apt-get install openvpn bridge-utils" it comes back saying it can't find 3 packages at" but if you try to manually put the address in but leave out the "us" in front of it still comes back with not being able to find the files yet if you browse to it in your web browser it does exist, which this was one of the addresses

So i'm not sure what is going on or how to fix it.

Maybe download the files, put them on a usb stick and install them locally? I would have to try and research the commands to do so.

salu203 (author)2014-12-01

i was able to successfully establish VPN connection following this tutorial and I am thankful for that as this is the best tutorial I have seen on net. But I am not able to do get internet connection on client machine as no website opens. I an using ubuntu 14.04 as client machine and my open vpn server is installed on ubuntu server 14.04 which is itself installed in virtualbox. I can post syslog for openvpn if u need but it does not show any errors or warnings . thx

10VPNService (author)2014-11-22

VPN wasn't the main technology to make distant connections. More than a few years ago, the mainly wide-ranging way to attach computers among several offices was by using a leased line. Leased lines, for example integrated services digital network, 128 Kbps, are confidential system relations that a telecommunications corporation could lease to its clientele. Leased lines provide a corporation by way of a way to expand its confidential network more than its instant geographic region. These relations form an individual wide-area network (WAN) for the commerce. Though leased lines are dependable plus safe, the leases are luxurious, by costs increasing since the detachment amid offices increases.

wdmc85 (author)2014-05-24

When i type "sudo cp -R /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/" it says that the file is non existent. When i navigate to examples, there is no easy-rsa file there are "sample-config-files" "sample-keys" and "sample scripts" and they are folders. in none of the folders is there an "easy-rsa" file. Everything else in this was working perfectly for me i tried reinstalling openvpn and its the same. What could be going wrong?

jayredge (author)wdmc852014-05-25

It appears that OpenVPN has upgraded their packages for Linux. Easy-rsa now needs to be installed as a separate package. Because of this, the easy-rsa directory has changed, which is why the folder doesn't exist in the path you are trying. To install easy-rsa, type:
sudo apt-get install easy-rsa

Once that finishes installing, type:

sudo mkdir /etc/openvpn/easy-rsa/

Finally, copy the keys from the easy-rsa directory to the one you just created. The command is the same as the one you are trying, but the first path is different. Type:

sudo cp -R /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/

Hopefully this fixes your issue. If you have any other problems please don't hesitate to leave another comment.

EliyahW (author)jayredge2014-11-16

When I do sudo mkdir /etcopenvpn/easy-rsa/ there is no such file or directory. I just downloaded on my linux computer can you give me instructions on how to install and start this application running?

amarkham1 (author)2014-10-04

With these additional lines added I lose all DNS host name lookups. IP of server... gateway... set corretcly.... reverting file to previous state clears up DNS.

amarkham1 (author)2014-10-04

Ditto... sudo cp -R /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/ returns "cp: cannot stat ‘/usr/share/doc/openvpn/examples/easy-rsa/2.0/*’: No such file or directory"

bestProxy2014 (author)2014-09-30

Internet security should be in the front of every ones mind. If you are travelling any where and using your laptop or mobile device then you need to use a VPN to protect your information and identity. I found a site comparing the best ones

DavidB11 (author)2014-09-02

Good job on the site. If you want to become anonymous online then you need to check this out.

fransmuniz (author)2014-07-10

Brother, very nice and complete tutorial, but it need to be crucially updated at least with 3 points:

1 - easy-rsa is not included by default, as you explain on answers

2 - Diffie Hellman now got 2048 bit key, so the archive is "dh2048.pem" and need to be changed on server.conf

3 - You need to change permissions on server side:
chmod 700 ta.key
chmod 700 client1.key
chmod 700 client1.crt
chmod 700 ca.crt

I got this answers on internet search and it took a long time to clarify!
Using ubuntu server 14.04.

Cheers fom Brazil.

bkronbergs (author)2013-11-29

Hello! I've been trying and trying this set up (I've followed and had some issues with your Cloud set up as well: but it's VPN that I really am interested in). I reached this step, configured and rebooted and the network interface stops working, I get the "the system network services are not compatible with this version" message afterwards. I've isolated that it's the first part of the lines input at this step. What can I do to stop this happening, or is it meant to? My server (physical, Ubuntu 12.04, cabled ethernet connection) loses internet connectivity as a result of this error, which I don't think will help when I want to connect to it for exactly that purpose later! Thanks for any help you can offer!

jayredge (author)bkronbergs2013-11-29

I can tell you for certain that you should not have that error when you add those lines to the file. Are you able to regain Internet connectivity after removing these lines from the file? After some googling about your error, I found this article. Please try to start the network-manager manually and see if that helps.

bkronbergs (author)jayredge2013-12-16

Hello there, thanks for your reply! Unfortunately, just tried to Start the Net.Man. manually, only to get the "Job is already running" message, and no change in the connectivity. I also tried adding the network manager to the rc.local file, which hasn't made any difference either.
The server isn't connected to the router in the background, as it's not showing up on my "Connected Devices" list. If I remove the lines of code from the interfaces file, connectivity is restored.
Any further help you can offer would be fantastic!

bkronbergs (author)bkronbergs2013-12-16

Could it be I'm getting my gateway address wrong? I'm a little hazy on what exactly that should be; I have a Sky router (UK), so should I be putting the address in to the Gateway field that I use to connect to manage that box?

jayredge (author)bkronbergs2013-12-16

Yes, I would check to see if the gateway IP address is correct. Make sure you are using the gateway address of your specific router/network. This address could be different from the one I use in my example configuration. The gateway IP address is generally the same address you use to connect to manage the router. If that still does not work, let me know and I will try to think of something else.

About This Instructable




More by jayredge:How to Host Your Own Cloud v2.0Host Your Own Virtual Private Network (VPN) with OpenVPNHow to Access your Media from Anywhere by Hosting your Own Cloud!
Add instructable to: