OpenVPN Server on Debian: Step-by-Step Setup

This guide walks you through installing and configuring an OpenVPN server on Debian. You’ll end up with a secure VPN that lets you connect from remote locations, encrypting all traffic between your devices and your server. You’ll need a Debian server (Debian 11 or 12) with root or sudo access, and a client device (Windows, macOS, Linux, or mobile) to test the connection.

What You’ll Need

A Debian server (Debian 11 Bullseye or Debian 12 Bookworm) with a public IP address.
Root or sudo access to the server.
OpenVPN and Easy-RSA packages (we’ll install them).
A client machine to test the VPN connection.
Optional: a domain name pointing to your server (not required, but useful).

Step-by-Step

Update the system
Log into your Debian server and run:
sudo apt update && sudo apt upgrade -y
Install OpenVPN and Easy-RSA
Run: sudo apt install openvpn easy-rsa -y
Set up the Easy-RSA directory
Copy the Easy-RSA scripts to a working directory:
make-cadir ~/easy-rsa
Then change into it: cd ~/easy-rsa

Configure the PKI variables
Edit the vars file: nano vars
Uncomment and set the following (adjust to your details):

set_var EASYRSA_REQ_COUNTRY    "US"
set_var EASYRSA_REQ_PROVINCE   "California"
set_var EASYRSA_REQ_CITY       "San Francisco"
set_var EASYRSA_REQ_ORG        "MyOrg"
set_var EASYRSA_REQ_EMAIL      "admin@example.com"
set_var EASYRSA_REQ_OU         "IT"

Initialize the PKI and build the CA
Run: ./easyrsa init-pki
Then: ./easyrsa build-ca nopass
You’ll be asked for a Common Name (e.g., “MyVPN-CA”). This creates the CA certificate and key.
Generate the server certificate and key
Run: ./easyrsa gen-req server nopass
Then sign it: ./easyrsa sign-req server server
Generate Diffie-Hellman parameters and a TLS key
Run: ./easyrsa gen-dh (this may take a few minutes)
Then: openvpn --genkey secret ta.key
Generate a client certificate (for testing)
Run: ./easyrsa gen-req client1 nopass
Then: ./easyrsa sign-req client client1

Copy the necessary files to the OpenVPN directory
Run:

sudo cp pki/ca.crt /etc/openvpn/server/
sudo cp pki/issued/server.crt /etc/openvpn/server/
sudo cp pki/private/server.key /etc/openvpn/server/
sudo cp pki/dh.pem /etc/openvpn/server/
sudo cp ta.key /etc/openvpn/server/

Create the server configuration file
Create /etc/openvpn/server/server.conf with:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
cipher AES-256-GCM
auth SHA256
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1

Enable IP forwarding
Edit /etc/sysctl.conf and uncomment or add: net.ipv4.ip_forward=1
Apply it: sudo sysctl -p
Configure firewall (if using UFW)
If you use UFW, allow OpenVPN and forwarding:
```
sudo ufw allow 1194/udp
sudo ufw allow OpenSSH
sudo ufw enable
```
Then edit /etc/default/ufw and set DEFAULT_FORWARD_POLICY="ACCEPT". Also add NAT rules to /etc/ufw/before.rules (see tips).
Start and enable the OpenVPN service
Run: sudo systemctl start openvpn-server@server
Then: sudo systemctl enable openvpn-server@server

Create client configuration files
On the server, create a directory ~/client-configs and generate a client.ovpn file with the following content (replace SERVER_IP with your server’s public IP):

client
dev tun
proto udp
remote SERVER_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
key-direction 1
verb 3
<ca>
[contents of ca.crt]
</ca>
<cert>
[contents of client1.crt]
</cert>
<key>
[contents of client1.key]
</key>
<tls-auth>
[contents of ta.key]
</tls-auth>

Test the connection
Copy the client.ovpn to your client machine, install OpenVPN client, and connect. You should get an IP in the 10.8.0.x range and be able to browse the internet through the VPN.

Common Mistakes

Forgetting to enable IP forwarding – without it, the server won’t route traffic between VPN clients and the internet.
Wrong file permissions – OpenVPN will refuse to start if the server key is world-readable. Ensure server.key is readable only by root.
Firewall blocking port 1194 – even if UFW allows it, your cloud provider’s security group may block UDP 1194. Check both.
Missing NAT rule – without masquerading, clients can connect but won’t reach the internet.
Using the wrong TLS direction – the tls-auth direction must be 0 on the server and 1 on the client, or vice versa.

Tips

Use a static IP for your server, or a dynamic DNS service if your IP changes.
For better security, disable password authentication for SSH and use key-based auth only.
Keep your CA private key offline – it’s the master key for issuing certificates.
Set up a cron job to renew your Let’s Encrypt certificate if you use a domain for the VPN.
Test the connection from a different network (like your phone’s hotspot) to ensure the VPN works outside your LAN.

Troubleshooting

Service fails to start – Run sudo systemctl status openvpn-server@server and sudo journalctl -u openvpn-server@server -f to see errors. Common issues: missing files, wrong permissions, or invalid config lines.
Client connects but no internet – Check IP forwarding (sysctl net.ipv4.ip_forward should return 1) and the NAT rule. Also verify that the client’s DNS is set correctly (push DNS in config).
Connection times out – Check firewall rules on the server and ensure UDP 1194 is open. Also check that the server’s public IP is correct in the client config.
Certificate verification failed – Ensure the client config includes the correct CA cert and that the client certificate is signed by the same CA.
Slow performance – Try using TCP instead of UDP in both server and client configs (change proto udp to proto tcp and adjust firewall).

Frequently Asked Questions

Can I use the same certificate for multiple clients?
Technically yes, but it’s not recommended. Each client should have its own certificate so you can revoke individual access if needed.
How do I revoke a client certificate?
Run ./easyrsa revoke client1 and then ./easyrsa gen-crl. Copy the CRL file to the server and add crl-verify crl.pem to the server config.
Is it safe to use the default port 1194?
Yes, it’s fine. Changing it to a non-standard port may reduce automated attacks, but security comes from the TLS encryption, not obscurity.
Can I run OpenVPN on port 443 to bypass firewalls?
Yes, you can change the port to 443 and the protocol to TCP, which often works on networks that block UDP. Some setups even use TLS over 443.
Do I need a static IP for my server?
Not strictly, but it makes client configs simpler. If your IP changes, you’d need to update the client configs or use a dynamic DNS service.
How do I make the VPN start automatically on boot?
The systemctl enable command in step 13 does that. If it doesn’t start, check that the service name is correct (openvpn-server@server).

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →