How to Install OpenVPN on Ubuntu 24.04

OpenVPN is an open-source, full-featured VPN solution that enables secure site-to-site and point-to-point connections. OpenVPN creates encrypted tunnels using SSL (Secure Socket Layer) to secure data transmission over untrusted networks such as the Internet between clients and servers. It supports multiple encryption algorithms, including AES-256, to encrypt and authenticate client devices, protecting network traffic from man-in-the-middle and eavesdropping attacks.

This article explains how to install OpenVPN on Ubuntu 24.04 and configure it to create secure end-to-end encrypted connections between the VPN server and client devices.

Prerequisites

Before you begin, you need to:

Have access to an Ubuntu 24.04 server as a non-root user with sudo privileges.

Install OpenVPN

OpenVPN is available in the default package repositories on Ubuntu 24.04. Follow the steps below to update the APT package manager index and install OpenVPN on your server.

Update the APT package index.
console
```
$ sudo apt update
```
Install OpenVPN.
console
```
$ sudo apt install openvpn -y
```

Verify the installed OpenVPN version.

console

$ openvpn --version

Your output should be similar to the one below.

OpenVPN 2.6.12 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
library versions: OpenSSL 3.0.13 30 Jan 2024, LZO 2.10
DCO version: N/A
Originally developed by James Yonan
.................................................................

OpenVPN 2.6.12 is installed based on the above output.

Create the OpenVPN Server Private Key, Certificate, and TLS Encryption Files

OpenVPN requires a server certificate, private key, and encryption files signed by a trusted certificate authority (CA) to enable VPN tunnel connections. Easy-RSA is a certificate authority management tool for applications like OpenVPN that issues digital certificates, including the server certificates and private key pairs. Follow the steps below to install Easy-RSA, create the public key infrastructure (PKI), build a certificate authority, and generate a new server certificate and private key.

Install Easy-RSA.
console
```
$ sudo apt install easy-rsa -y
```
Navigate to your user's home directory.
console
```
$ cd
```
Create a new easy-rsa directory.
console
```
$ mkdir easy-rsa
```
Link the /usr/share/easy-rsa directory to easy-rsa to access the Easy-RSA script and package files.
console
```
$ ln -s /usr/share/easy-rsa/* easy-rsa/
```
List the easy-rsa directory and verify the linked files.
console
```
$ ls easy-rsa
```
Output:
```
easyrsa  openssl-easyrsa.cnf  vars.example  x509-types
```
Change to the easy-rsa directory.
console
```
$ cd easy-rsa
```
Create a new vars configuration using a text editor such as nano.
console
```
$ nano vars
```

Add the following certificate authority configurations to the file.

                            ini
                            
                        
set_var EASYRSA_REQ_COUNTRY    "US"
set_var EASYRSA_REQ_PROVINCE   "Georgia"
set_var EASYRSA_REQ_CITY       "Atlanta"
set_var EASYRSA_REQ_ORG        "Vultr Docs"
set_var EASYRSA_REQ_EMAIL      "linuxuser@example.com"
set_var EASYRSA_REQ_OU         "Community"
set_var EASYRSA_ALGO           "ec"
set_var EASYRSA_DIGEST         "sha512"

Save and close the file.

The above configuration specifies the organization information for building your CA, including the country, city, administrative email, and unit details.

Initialize the PKI using the easy-rsa script.

console

$ ./easyrsa init-pki

Output:

Notice
------
'init-pki' complete; you may now create a CA or requests.

Your newly created PKI dir is:
* /home/linuxuser/easy-rsa/pki

Using Easy-RSA configuration:
* /home/linuxuser/easy-rsa/vars

Build the CA to generate the root public certificate and private key pair.
console
```
$ ./easyrsa build-ca
```
- Enter a strong passphrase for signing certificate requests and repeat it when prompted to secure the CA.
```
...
Enter New CA Key Passphrase: 
```
- Enter a common name for the CA, such as OpenVPN-CA.
```
...
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
```
- Verify the generated ca.crt CA certificate path.
```
Notice
------
CA creation complete. Your new CA certificate is at:
* /home/linuxuser/easy-rsa/pki/ca.crt
```

Generate a new server certificate request. Replace vpnserver with your desired server common name.

                            console
                            
$ ./easyrsa gen-req vpnserver nopass

Press Enter when prompted to verify the common name.

...
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [vpnserver]:

Verify the generated public certificate request and private key paths when successful.

Notice
------
Private-Key and Public-Certificate-Request files created.
Your files are:
* req: /home/linuxuser/easy-rsa/pki/reqs/vpnserver.req
* key: /home/linuxuser/easy-rsa/pki/private/vpnserver.key

Sign the server certificate request using the CA.

                            console
                            
$ ./easyrsa sign-req server vpnserver

Enter yes and press Enter when prompted to verify the certificate request.

Using Easy-RSA 'vars' configuration:
* /home/linuxuser/easy-rsa/vars
...
Type the word 'yes' to continue, or any other input to abort.
  Confirm request details:

Enter your CA passphrase when prompted to sign the server certificate request.

Using configuration from /home/linuxuser/easy-rsa/pki/openssl-easyrsa.cnf
Enter pass phrase for /home/linuxuser/easy-rsa/pki/private/ca.key:

Your output should look like the one below when successful.

...
Notice
------
Certificate created at:
* /home/linuxuser/easy-rsa/pki/issued/vpnserver.crt

List the pki/issued directory to verify the generated server certificate.
console
```
$ ls pki/issued
```
Output:
```
vpnserver.crt
```
Generate a ta.key HMAC signature file to enable TLS verification and authentication on the OpenVPN server.
console
```
$ sudo openvpn --genkey secret ta.key
```

List your working directory files to verify the generated ta.key file.

console

$ ls

Output:

df.pem easyrsa  openssl-easyrsa.cnf  pki  ta.key  vars  vars.example  x509-types

Create a strong Diffie-Hellman parameters file to secure key exchange for encrypted OpenVPN sessions.

console

$ ./easyrsa gen-dh

Output:

Generating DH parameters, 2048 bit long safe prime
.....................
DH parameters appear to be ok.

Notice
------

DH parameters of size 2048 created at:
* /home/linuxuser/easy-rsa/pki/dh.pem

List the pki directory to verify the generated dh.pem file.
console
```
$ ls pki/
```
Output:
```
ca.crt           dh.pem     .....................
```

Copy the ca.crt, vpnserver.key, vpnserver.crt, ta.key, and dh.pem files to the /etc/openvpn directory.

                            console
                            
$ sudo cp ta.key pki/ca.crt pki/private/vpnserver.key pki/issued/vpnserver.crt pki/dh.pem /etc/openvpn/

Configure OpenVPN

OpenVPN uses server and client configurations in the /etc/openvpn directory to create tunnel interfaces and the respective systemd services. /etc/openvpn contains the server configurations you can manage with the openvpn@ service, while /etc/openvpn/server contains additional configurations manageable with the openvpn-server@ service. Follow the steps below to create a new OpenVPN server configuration in the /etc/openvpn directory to enable a VPN tunnel interface on your server.

Copy the sample /usr/share/doc/openvpn/examples/sample-config-files/server.conf OpenVPN server configuration template to the /etc/openvpn directory.
console
```
$ sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/
```
Navigate to the /etc/openvpn directory.
console
```
$ cd /etc/openvpn
```
Open the copied server.conf file.
console
```
$ sudo nano server.conf
```
- Optional: Remove ; to uncomment the local directive and replace a.b.c.d with the server IP address OpenVPN should use to listen for incoming connections. Replace 192.0.2.100 with your server's actual public IP address.
  ini
  local 192.0.2.100
- Find the dev directive and verify the default OpenVPN tunnel type.
  ini
  dev tun
  tun creates routed IP tunnels, while tap creates Ethernet tunnels.
- Find the ca, cert, and key options, then replace the default ca.crt,server.crt, and server.key values with the actual paths to your certificate authority, server certificate, and server private key files.
  ini
  ca /etc/openvpn/ca.crt cert /etc/openvpn/vpnserver.crt key /etc/openvpn/vpnserver.key
  Within the above configuration:
  - ca: Specifies the certificate authority (CA) path.
  - cert: Specifies the server's public certificate path.
  - key: Specifies the private key used to verify the server's public certificate and establish secure VPN connections.
- Find the dh directive and replace dh2048.pem with your actual Diffie-Hellman file path.
  ini
  dh /etc/openvpn/dh.pem
- Find the data-ciphers directive, remove ; to uncomment it to enable OpenVPN to use strong, modern ciphers for encryption, then add data-ciphers-fallback AES-256-CBC as a fallback.
  ini
  data-ciphers AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305:AES-256-CBC data-ciphers-fallback AES-256-CBC
- Add the following auth directive below data-ciphers to specify the HMAC digest algorithm, such as SHA512, for authenticating each packet.
  ini
  auth SHA512
- Find the server directive and specify the VPN subnet to assign client addresses. For example, change the default 10.8.0.0 subnet to 10.10.10.0.
  ini
  server 10.10.10.0 255.255.255.0
- Find the ;push "redirect-gateway def1 bypass-dhcp" directive and remove ; to uncomment it, redirecting all traffic through the VPN.
  ini
  push "redirect-gateway def1 bypass-dhcp"
- Find the dhcp-option directives and replace the default addresses with your preferred DNS servers, such as 8.8.8.8 and 1.1.1.1, to enable faster name resolution, then remove ; to uncomment the options.
  ini
  push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 1.1.1.1"
- Find the tls-auth directive, uncomment it, replace ta.key with your actual key path, and keep 0 as the direction.
  ini
  tls-auth /etc/openvpn/ta.key 0 # This file is secret
- Find the user and group pair, replace openvpn with nobody and nogroup respectively to run OpenVPN with reduced privileges, then remove ; to uncomment the options.
  ini
  user nobody group nogroup
  Save and close the server.conf file.
- Your modified server.conf file should look like the one below.
  ini
  port 1194 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/vpnserver.crt key /etc/openvpn/vpnserver.key dh /etc/openvpn/dh.pem data-ciphers AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305:AES-256-CBC data-ciphers-fallback AES-256-CBC auth SHA512 topology subnet server 10.10.10.0 255.255.255.0 ifconfig-pool-persist /var/log/openvpn/ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 1.1.1.1" keepalive 10 120 tls-auth /etc/openvpn/ta.key 0 user nobody group nogroup persist-key persist-tun status /var/log/openvpn/openvpn-status.log verb 3 explicit-exit-notify 1

Test the OpenVPN server configuration and verify it runs without errors.

                            console
                            
$ sudo openvpn --config /etc/openvpn/server.conf

Your output should be similar to the one below when the configuration test is successful.

...
2025-07-10 22:21:00 IFCONFIG POOL IPv4: base=10.10.10.2 size=253
2025-07-10 22:21:00 IFCONFIG POOL LIST
2025-07-10 22:21:00 Initialization Sequence Completed

Press Ctrl + C to stop the configuration test.

Enable IP Forwarding

Follow the steps below to enable IP forwarding on the server, which will allow OpenVPN clients to access the Internet through the VPN.

Open the /etc/sysctl.conf file to enable IP forwarding on the server.
console
```
$ sudo nano /etc/sysctl.conf
```
Find the # net.ipv4.ip_forward=1 directive and remove # to uncomment it.
ini
```
net.ipv4.ip_forward=1
```
Save and close the file.

The above net.ipv4.ip_forward=1 configuration enables IP forwarding, allowing OpenVPN clients to route traffic through the VPN.
Apply the /etc/sysctl.conf configuration changes.
console
```
$ sudo sysctl -p
```
Output:
```
net.ipv4.ip_forward = 1
```
Run the following command to verify the public network interface on your server.
console
```
$ ip route | grep default
```
Note the public interface name like enp1s0 in your output, similar to the one below.
```
default via 192.0.2.1 dev enp1s0 proto dhcp src 192.0.2.100 metric 100
```
Check the UFW status and verify that it's installed.
console
```
$ sudo ufw status
```
- Run the following command to install UFW and allow SSH traffic if it's not installed.
  console
  $ sudo apt install ufw -y && sudo ufw allow ssh
Open the /etc/ufw/before.rules file to enable NAT through the firewall.
console
```
$ sudo nano /etc/ufw/before.rules
```
Add the following POSTROUTING policy configuration before the *filter section. Replace enp1s0 with your actual public interface name.
ini
```
*nat
:POSTROUTING ACCEPT [0:0]

-A POSTROUTING -s 10.10.10.0/24 -o enp1s0 -j MASQUERADE

COMMIT
```
Save and close the file.

The above firewall configuration modifies the default POSTROUTING policy in the nat table to masquerade all traffic from the 10.10.10.0/24 VPN subnet through the server's enp1s0 public network interface.
Open the /etc/ufw/sysctl.conf file to enable IP forwarding through UFW.
console
```
$ sudo nano /etc/ufw/sysctl.conf
```
Find the #net/ipv4/ip_forward=1 directive and remove # to uncomment it.
ini
```
net/ipv4/ip_forward=1
```
Save and close the file.

The above net/ipv4/ip_forward=1 configuration enables IP forwarding through the firewall to route packets between the OpenVPN tun interface and other interfaces on the server.
Open the /etc/default/ufw file to allow forwarded packets through UFW.
console
```
$ sudo nano /etc/default/ufw
```
Find the DEFAULT_FORWARD_POLICY directive and change the default value from DROP to ACCEPT.
ini
```
DEFAULT_FORWARD_POLICY="ACCEPT"
```
Save and close the file.

The above configuration enables UFW to allow forwarded packets through the firewall.
Reload UFW to apply the firewall configuration changes.
console
```
$ sudo ufw reload
```

Secure the OpenVPN Server

Follow the steps below to allow connections to the OpenVPN server through the default firewall configuration.

Allow incoming connections to the tun0 OpenVPN interface.
console
```
$ sudo ufw allow in on tun0
```
Allow outgoing connections from the tun0 interface.
console
```
$ sudo ufw allow out on tun0
```
Allow network connections to the 1194 OpenVPN server port.
console
```
$ sudo ufw allow 1194/udp
```
Reload UFW to apply the firewall configuration changes.
console
```
$ sudo ufw reload
```

Check the UFW status to verify the active firewall rules.

                            console
                            
$ sudo ufw status

Output:

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere                  
Anywhere on tun0           ALLOW       Anywhere                  
1194/udp                   ALLOW       Anywhere                  
22/tcp (v6)                ALLOW       Anywhere (v6)             
Anywhere (v6) on tun0      ALLOW       Anywhere (v6)             
1194/udp (v6)              ALLOW       Anywhere (v6)             

Anywhere                   ALLOW OUT   Anywhere on tun0          
Anywhere (v6)              ALLOW OUT   Anywhere (v6) on tun0

Manage the OpenVPN Server

OpenVPN uses systemd to manage the VPN interfaces based on the server configurations in the /etc/openvpn directory. Follow the steps below to manage the OpenVPN service based on your server configuration and verify the VPN tunnel interface details.

Enable the OpenVPN service to start automatically at boot.

                            console
                            
$ sudo systemctl enable openvpn@server.service

Output:

Created symlink /etc/systemd/system/multi-user.target.wants/openvpn@server.service → /usr/lib/systemd/system/openvpn@.service.

Start the OpenVPN service.

                            console
                            
$ sudo systemctl start openvpn@server.service

View the OpenVPN service status and verify that it runs without errors.

                            console
                            
$ sudo systemctl status openvpn@server.service

Output:

● openvpn@server.service - OpenVPN connection to server
 Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; preset: enabled)
 Active: active (running) since Thu 2025-07-10 22:27:07 UTC; 6s ago
...

Verify that the tun0 OpenVPN interface is activated based on your server configuration.

                            console
                            
$ ip addr show dev tun0

Output:

4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq state UNKNOWN group default qlen 500
    link/none 
    inet 10.10.10.1/24 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::42ab:ad8b:dd59:baf4/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

Create a Client Certificate and Private Key Pair

OpenVPN requires a valid client certificate and private key pair to connect to the VPN server. Follow the steps below to create a new client certificate and private key to use in your VPN client configuration.

Create a new keys directory in /etc/openvpn/client to store the client encryption keys.
console
```
$ sudo mkdir -p /etc/openvpn/client/keys
```
Navigate to the easy-rsa directory.
console
```
$ cd ~/easy-rsa
```

Generate a new certificate request using the easyrsa script. Replace vpnclient1 with your desired client name.

                            console
                            
$ ./easyrsa gen-req vpnclient1 nopass

Press Enter when prompted to verify your client's common name.

...
Common Name (eg: your user, host, or server name) [vpnclient1]:

Verify the generated private key and public certificate request paths in your output similar to the one below.

Notice
------
Private-Key and Public-Certificate-Request files created.
Your files are:
* req: /home/linuxuser/easy-rsa/pki/reqs/vpnclient1.req
* key: /home/linuxuser/easy-rsa/pki/private/vpnclient1.key

Import the signing request to generate a new client certificate.

                            console
                            
$ ./easyrsa sign-req client vpnclient1

Enter yes and press Enter when prompted to verify the client's common name to sign the certificate.

You are about to sign the following certificate:
...
subject=
    commonName                = vpnclient1

Type the word 'yes' to continue, or any other input to abort.
  Confirm request details:

Enter your CA passphrase to sign the certificate.

Using configuration from /home/linuxuser/easy-rsa/pki/openssl-easyrsa.cnf
Enter pass phrase for /home/linuxuser/easy-rsa/pki/private/ca.key:

Verify the generated client certificate path in your output similar to the one below.

...
Notice
------
Certificate created at:
* /home/linuxuser/easy-rsa/pki/issued/vpnclient1.crt

Copy the vpnclient1.crt client certificate to the /etc/openvpn/client/keys directory.
console
```
$ sudo cp pki/issued/vpnclient1.crt /etc/openvpn/client/keys
```
Move the vpnclient1.key private key to the /etc/openvpn/client/keys directory.
console
```
$ sudo cp pki/private/vpnclient1.key /etc/openvpn/client/keys
```

Create OpenVPN Client Configuration Files

Follow the steps below to create a new client configuration to connect to the OpenVPN server.

Copy the sample /usr/share/doc/openvpn/examples/sample-config-files/client.conf OpenVPN client configuration to /etc/openvpn/client.
console
```
$ sudo cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/client
```
Navigate to the /etc/openvpn/client directory.
console
```
$ cd /etc/openvpn/client
```
Rename the client.conf configuration to vpnclient1.ovpn.
console
```
$ sudo mv client.conf vpnclient1.ovpn
```
Choose the OpenVPN client configuration format based on:
- ovpn: For client configurations compatible with GUI OpenVPN clients for Windows, macOS, Android, or IOS devices.
- conf: For client configurations compatible with scripts and CLI tools like systemd. Depending on your configuration, you can start the client configuration using a systemd service like openvpn-client@vpnclient.service.
Open the vpnclient1.ovpn configuration.
console
```
$ sudo nano vpnclient1.ovpn
```
Verify the following directives:
- client: OpenVPN configuration type.
- proto udp: Client protocol. Value should match the server's configuration.
Find the remote directive and replace my-server-1 1194 with your OpenVPN server's IP address and port. Replace 192.0.2.100 with your actual server IP.
ini
```
remote 192.0.2.100 1194
```
Find the ca, cert, and key options, then add # before each option to comment them.
ini
```
#ca ca.crt
#cert client.crt
#key client.key
```
Find the data-ciphers directive, remove ; to uncomment it, and verify that the cryptographic values match the OpenVPN server configuration.
ini
```
data-ciphers AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305:AES-256-CBC
```

Add the following auth directive on a new line to match the OpenVPN server configuration.

ini

auth SHA512

Save and close the vpnclient1.ovpn file.

Your modified vpnclient1.ovpn file should look like the one below.

                            ini
                            
                        
client
dev tun
proto udp
remote 192.0.2.100 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
auth SHA512
verb 3

Run the following command to append values from the ca.crt, vpnclient.crt, vpnclient.key, and ta.key files to vpnclient1.ovpn.

                            console
                            
                        
$ sudo bash -c 'cat <<EOF >> vpnclient1.ovpn
<ca>
$(< /etc/openvpn/ca.crt)
</ca>
<cert>
$(< keys/vpnclient1.crt)
</cert>
<key>
$(< keys/vpnclient1.key)
</key>
<tls-auth>
$(< /etc/openvpn/ta.key)
</tls-auth>
key-direction 1
EOF'

View the vpnclient1.ovpn file and verify your configuration's appended ca, certificate,private key, and tls values.
console
```
$ cat vpnclient1.ovpn
```
Copy the vpnclient1.ovpn configuration to your user's home directory.
console
```
$ cp vpnclient1.ovpn ~/vpnclient1.ovpn
```

Optional: Revoke OpenVPN Clients

Follow the steps below to revoke OpenVPN clients.

Navigate to the easy-rsa directory.
console
```
$ cd ~/easy-rsa
```
Run the following command to revoke a client certificate.
console
```
$ ./easyrsa revoke <client-name>
```
- Verify the client certificate details, enter yes and press <kbd class="key">Enter</kbd> when prompted to revoke the client certificate.
```
  Reason: None given

Type the word 'yes' to continue, or any other input to abort.
    Continue with revocation: 
```
- Enter your CA's passphrase when prompted to revoke the client.

Generate a crl.pem certificate revocation list that includes all revoked clients.

console

$ ./easyrsa gen-crl

Enter your CA passphrase when prompted and verify the generated crl.pem path.

Using configuration from /home/linuxuser/easy-rsa/pki/openssl-easyrsa.cnf
Enter pass phrase for /home/linuxuser/easy-rsa/pki/private/ca.key:

Notice
------
An updated CRL has been created:
* /home/linuxuser/easy-rsa/pki/crl.pem

Copy the crl.pem file from the pki directory to /etc/openvpn.
console
```
$ sudo cp pki/crl.pem /etc/openvpn/server/
```
Open the OpenVPN server configuration.
console
```
$ sudo nano /etc/openvpn/server.conf
```
Add the following crl-verify directive at the end of the file.
ini
```
crl-verify /etc/openvpn/server/crl.pem
```
Save and close the file.

The above crl-verify configuration enables the OpenVPN server to load the crl.pem and deny all listed clients from connecting to the VPN server.
Restart the OpenVPN service to apply the server configuration changes.
console
```
$ sudo systemctl restart openvpn@server.service
```

Check the OpenVPN service status.

                            console
                            
$ sudo systemctl status openvpn@server.service

Test the OpenVPN Server

Follow the steps below to test the VPN server using the OpenVPN Connect application for GUI devices.

Download and install OpenVPN Connect for your device from the official website. For example, OpenVPN Connect for Windows.
Open a new terminal session on your local workstation.
Change the working directory to your user's home directory.
console
```
$ cd
```
Connect to the OpenVPN server using SFTP. Replace linuxuser with your actual user.
console
```
$ sftp linuxuser@SERVER-IP
```
List the directory files and verify that the vpnclient1.ovpn client configuration is available.
console
```
sftp> ls
```

Download the vpnclient1.ovpn file to your local workstation.

console

sftp> get vpnclient1.ovpn

Output:

Fetching /home/linuxuser/vpnclient1.ovpn to vpnclient1.ovpn
vpnclient1.ovpn                                                                           100% 8281   539.1KB/s   00:00

Launch OpenVPN Connect from your applications menu.
Click UPLOAD FILE on the Get Connected page.
Click Browse to find and open the downloaded vpnclient1.ovpn client configuration in your filesystem.
Verify that the Server Hostname matches your OpenVPN IP and click Connect.
Verify that your OpenVPN profile changes to Connected and monitor the connection statistics.
Run the following command in your terminal and verify that the VPN server IP is your OpenVPN server's active public IP address.
console
```
$ curl ifconfig.me
```

Test the connection to any network attached to the VPN server or the Internet using a domain like google.com to verify that it is successful.

console

$ ping google.com

Output:

Pinging google.com [172.217.170.174] with 32 bytes of data:
Reply from 172.217.170.174: bytes=32 time=26ms TTL=108
Reply from 172.217.170.174: bytes=32 time=28ms TTL=108
Reply from 172.217.170.174: bytes=32 time=36ms TTL=108
Reply from 172.217.170.174: bytes=32 time=29ms TTL=108

Ping statistics for 172.217.170.174:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 26ms, Maximum = 36ms, Average = 29ms

Troubleshooting

OpenVPN may return connection errors depending on your server and client configurations. Follow the steps below to troubleshoot common OpenVPN errors.

Connection Timeout: Error Connecting to the OpenVPN Server

Follow the steps below to fix the connection timeout error displayed in your OpenVPN Connect application.

OpenVPN Connection Timeout Error

Open the OpenVPN client configuration file using your desired text editor, such as VS Code.
console
```
$ code vpnclient1.ovpn
```
Verify that the remote configuration points to your OpenVPN server's public IP address and port.
ini
```
remote 192.0.2.100 1194
```
Check the server's UFW status and verify that the OpenVPN port is allowed through the firewall.
console
```
$ sudo ufw status
```
- Allow the OpenVPN server port if it's missing in your firewall table.
  console
  $ sudo ufw allow 1194/tcp
- Reload UFW to apply the firewall configuration changes.
  console
  $ sudo ufw reload
Connect to the OpenVPN server again and verify the connection is success.

Authenticate/Decrypt packet error: packet HMAC authentication failed

Follow the steps below to fix the authentication/decrypt packet error displayed in the OpenVPN server logs.

Jul 06 02:04:17 Openserver ovpn-server[1767]: Authenticate/Decrypt packet error: packet HMAC authentication failed
Jul 06 02:04:17 Openserver ovpn-server[1767]: TLS Error: incoming packet authentication failed from [AF_INET]192.0.2.200:59864
Jul 06 02:04:18 Openserver ovpn-server[1767]: Authenticate/Decrypt packet error: packet HMAC authentication failed
Jul 06 02:04:18 Openserver ovpn-server[1767]: TLS Error: incoming packet authentication failed from [AF_INET]192.0.2.200:59864

Check the OpenVPN server logs and verify additional information about the TLS client connection error.
console
```
$ sudo journalctl -xeu openvpn-server@server.service
```

View the OpenVPN server ta.key file and note the TLS values in your output.

                            console
                            
$ sudo cat /etc/openvpn/ta.key

Your output should look like the one below.

                            ini
                            
                        
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
1ba01f852d75016a3fd1b3b88aef9609
d52f7dd4e7858f0a219f5b9ec65b37c1
efe9458fe0e06b2ae4d1f9fee3aee929
959bd0e9e260588023fed611d803a769
108dfd5157dd95f6a627c486361e7c6d
753d65f6c25fd2278a44a872e5178f0f
58b2fddb9f3b223dc0ebc0ff95e4a58e
a2cc037f8ebaad2f56bd2cafc07a57ae
04e637dfda193c37a91833eeebd664b4
60e9d6a04a86f0407ad7ca6e458d5573
9163933ecc29b567d26f5b70789fe2f5
d523f0ab7c667929a1023d5098d517f3
17f7b227a8eafaf9804fcf2713d753c7
ff35d5c36e035a123ac68a49bc67473d
fba57989354045fe4305a705d5effa3d
36d447f62b9ef46e2aec61562c2900eb
-----END OpenVPN Static key V1-----
</tls-auth>

Open the server.conf OpenVPN server configuration.
console
```
$ sudo nano /etc/openvpn/server.conf
```

Verify your configuration's data-ciphers and auth values.

                            ini
                            
                        
data-ciphers AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305:AES-256-CBC
auth SHA512

Close the file.

Open the OpenVPN client configuration file.

console

$ nano /etc/openvpn/client/vpnclient1.ovpn

Compare the tls-auth values and verify that they match your OpenVPN server's ta.key file.

                            ini
                            
                        
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
1ba01f852d75016a3fd1b3b88aef9609
d52f7dd4e7858f0a219f5b9ec65b37c1
efe9458fe0e06b2ae4d1f9fee3aee929
959bd0e9e260588023fed611d803a769
108dfd5157dd95f6a627c486361e7c6d
753d65f6c25fd2278a44a872e5178f0f
58b2fddb9f3b223dc0ebc0ff95e4a58e
a2cc037f8ebaad2f56bd2cafc07a57ae
04e637dfda193c37a91833eeebd664b4
60e9d6a04a86f0407ad7ca6e458d5573
9163933ecc29b567d26f5b70789fe2f5
d523f0ab7c667929a1023d5098d517f3
17f7b227a8eafaf9804fcf2713d753c7
ff35d5c36e035a123ac68a49bc67473d
fba57989354045fe4305a705d5effa3d
36d447f62b9ef46e2aec61562c2900eb
-----END OpenVPN Static key V1-----
</tls-auth>

Verify that the key-direction configuration is set to 1.
ini
```
key-direction 1
```
Verify that the data-ciphers and auth values match the OpenVPN server configuration.
ini
```
data-ciphers AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305:AES-256-CBC
auth SHA512
```

Transfer the OpenVPN client configuration to your client device and test the connection again.

Conclusion

You have installed OpenVPN on Ubuntu 24.04, created a server configuration, and connected a VPN client to the server. You can use OpenVPN to connect multiple clients using different VPN tunnels and server configurations with unique port numbers. For more information, visit the OpenVPN documentation.

How to Install OpenVPN on Ubuntu 24.04

Prerequisites

Install OpenVPN

Create the OpenVPN Server Private Key, Certificate, and TLS Encryption Files

Configure OpenVPN

Enable IP Forwarding

Secure the OpenVPN Server

Manage the OpenVPN Server

Create a Client Certificate and Private Key Pair

Create OpenVPN Client Configuration Files

Test the OpenVPN Server

Troubleshooting

Conclusion

Comments

Products

Features

Solutions

Marketplace

Resources

Company

Tech Talks

Vultr Blogs