Installing and Configuring OpenVPN on Your Ubuntu Server

Australians have become accustomed to working from kitchen tables in Brisbane, shared workspaces in Melbourne, and beachside cafés along the NSW coast. That mobility comes with risk: every time a laptop joins an unfamiliar wireless network, the traffic it produces becomes a relatively easy target for anyone running a packet sniffer. Running your own virtual private network on an Ubuntu server gives you a private tunnel that follows you from Sydney to Perth without relying on a third-party provider whose logging practices you cannot audit.

The Australian government's data retention scheme obliges local ISPs such as Telstra, Optus, and TPG to keep metadata for at least two years, and the Notifiable Data Breaches scheme sits underneath that layer. Plenty of small businesses and self-employed professionals in the country prefer to handle their own encryption rather than trust yet another intermediary. Ubuntu's long-term support releases make a sensible platform for a self-hosted VPN, and OpenVPN has been the workhorse tunnel of choice for Linux administrators for nearly two decades.

Preparing the Ubuntu Server Environment

Before installing any packages, the server needs a few essentials in place. Start with a fresh instance of Ubuntu 24.04 LTS or 22.04 LTS, both of which are supported through 2029 and 2027 respectively on the server channel. If you rent the machine from a cloud provider, choose a data centre inside Australia so the latency from Perth, Adelaide, or Hobart stays sensible. AWS, DigitalOcean, Linode, and Vultr all operate regions in Sydney and Melbourne, and a $6 AUD per month VPS is plenty of capacity for a personal tunnel serving a handful of devices.

Give the server a fully qualified domain name and a static public IP address, then point an A record at it from your DNS provider. Some Australian registrars like VentraIP and Crazy Domains let you manage DNS through a control panel, while others defer to Cloudflare for authoritative resolution. Whether you use a domain or just the raw IP matters less than keeping the address stable, since certificates will be bound to whatever value you choose today and an unexpected IP swap will silently break those bindings.

Update the package index and upgrade any existing packages before adding new software. Open a UDP port on your hosting provider's firewall panel, since port 1194 is the OpenVPN default and UDP is preferred over TCP to avoid the TCP-over-TCP meltdown that happens when congestion control stacks on itself. Inside Ubuntu itself, ufw will also be configured later, and layering both the cloud firewall and the in-host firewall is sensible belt-and-braces practice.

Installing OpenVPN and Easy-RSA

OpenVPN itself ships in Ubuntu's universe repository, and the Easy-RSA toolkit handles the public key infrastructure that authenticates each end of the tunnel. Install both with apt install openvpn easy-rsa and verify the versions that arrive, because Ubuntu occasionally lags behind upstream and you want to know which feature flags to expect when reading documentation.

The package list pulls in a handful of dependencies, including openssl and a couple of supporting libraries. If you have never worked with PKI before, expect to spend a few minutes reading the Easy-RSA documentation. The tool is unforgiving about working directory locations, and it expects you to source a shell script before invoking any commands. A useful primer on the broader command-line toolkit you will lean on throughout this process is available in this walkthrough of essential command-line utilities for Ubuntu, which covers the likes of grep, sed, and jq that show up repeatedly in VPN troubleshooting.

Decide where your certificate authority will live. A common pattern is /etc/openvpn/easy-rsa, owned by root with permissions set to 700 so only the administrator can read the private keys. Avoid placing any of this material inside a home directory, since the keys inside are still functional credentials, and a compromised account at the user level should not expose your entire certificate authority.

Building the Certificate Authority and Server Keys

Easy-RSA uses a small shell script to set its environment, and from there every command runs against the same working directory. Initialise the PKI structure, build the certificate authority, and generate a Diffie-Hellman parameter set before doing anything else. The DH step is the slowest part of the install. On a small VPS it can take anywhere from two to ten minutes, with no progress bar, so patience pays off and running the command inside a screen or tmux session prevents an accidental dropped shell from ruining the build.

Generate the server certificate with a descriptive common name such as ubuntu-server-au. The build process prompts for a challenge password and an optional company name, and both can be left blank on a self-hosted setup. Never leave the certificate's basic constraints or key usage unset, since OpenVPN rejects a key that lacks the right flags and the error is cryptic when it happens.

Two additional pieces round out the server's credentials. The TLS-auth key is a shared secret that signs every packet and protects the server against unauthenticated floods, while a separate certificate revocation list keeps revoked clients off the network. Australians running small studios or consultancies sometimes share a single OpenVPN instance across several staff, so building the CRL infrastructure now saves a scramble later when a contractor finishes a project and a key needs to be retired cleanly.

Configuring the OpenVPN Server

The default server configuration that ships with the package is heavily commented and useful as a reference, even though it is not intended to run as-is. Copy it to /etc/openvpn/server/server.conf and pare it back to the essentials: the dev tun directive, the topology subnet line, the server 10.8.0.0 network, and a sensible push of DNS resolvers. Quad9 and Cloudflare's 1.1.1.1 are both reachable from Australian IP ranges, and Cloudflare maintains a presence in Sydney and Melbourne which keeps DNS resolution snappy even on a constrained NBN uplink.

Enable IP forwarding by editing /etc/sysctl.conf and uncommenting net.ipv4.ip_forward=1, then run sysctl -p to apply the change. Inside the OpenVPN configuration, add a route-up snippet that adjusts NAT rules through iptables so traffic exiting the tunnel appears to come from the server's public IP. Forgetting this step means clients will connect but every request will fail with a routing error, a classic gotcha that bites almost everyone on their first build.

Enable and start the service with systemctl enable --now openvpn-server@server and check journalctl -u openvpn-server@server for any complaints. Open the UDP port through ufw and repeat the change on the cloud provider's security group. A quick test from another machine with nc -uvz your.server 1194 confirms whether the listening socket is reachable from the outside world, which is often the missing piece when an Australian technician is debugging from a corporate network that has egress restrictions on the provider's IP ranges.

Connecting Clients and Keeping Things Healthy

With the server up, the next job is producing client configuration files. Easy-RSA's build-client-full command creates both the certificate and the matching private key, and you can inline those into a single .ovpn file so users can drop the file onto a laptop running the GNOME Network Manager plugin, an iPhone with the OpenVPN Connect app, or an Android device without juggling several loose assets. Password-protect each client key during generation so a leaked .ovpn file is not immediately usable by anyone who finds it.

The Australian Cyber Security Centre publishes the Essential Eight maturity model, and while OpenVPN does not appear in that list directly, encrypting remote access fits the spirit of application control and patching cadence. Logging into the server weekly to run apt update && apt upgrade closes off CVEs, and a small script aliased to summarise journalctl --since "1 week ago" produces a quick health report suitable for filing away or forwarding to a managed service provider.

A common failure on Australian home networks is the NBN modem running in router mode and quietly blocking UDP 1194 without telling anyone. If you can connect to the server from a Telstra 4G hotspot but not from your home NBN connection, that almost always points to double NAT or CGNAT, and the fix is either a port-forward on the modem or a relay through a provider that hands out a routable address. Workarounds aside, the real defence is keeping client config files offline, rotating keys annually, and revoking any old certificate before it leaks into a backup tarball you forgot to encrypt.

Generate your first client certificate with easy-rsa and assemble a single .ovpn profile. Import that file into your laptop's network manager, hit connect, and tail the OpenVPN log on the server while you do it. Watch for the TLS handshake to complete and a virtual address from the 10.8.0.0/24 range to appear in the client interface, then run curl ifconfig.me to confirm the public IP now matches your server rather than your home router.