[{"data":1,"prerenderedAt":197},["ShallowReactive",2],{"seo-verification":3,"blog-openvpn-on-a-vps-private-controlled-remote-access-ma-en":6,"promo-bar-likely":196},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-openvpn-on-a-vps-private-controlled-remote-access-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":32,"intro":35,"sections":36,"ctaTitle":130,"ctaBody":131,"ctaButton":132,"ctaUrl":133,"relatedPosts":134},140,"openvpn-on-a-vps-private-controlled-remote-access",{"fr":12,"en":10,"ar":13,"es":14},"installer-openvpn-serveur-vps","openvpn-على-خادم-vps-وصول-عن-بعد-خاص-ومضبوط","openvpn-en-un-vps-acceso-remoto-privado","OpenVPN on VPS: install, harden and troubleshoot","Install OpenVPN Server on your VPS: prerequisites, Easy-RSA, server.conf, .ovpn profiles, fail2ban, ufw and common error troubleshooting.",8,0,false,"2026-02-05T00:00:00+00:00","2026-09-30T11:20:33+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":26},"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[28],{"id":17,"name":23,"slug":24,"color":25,"icon":26},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Finstaller-openvpn-serveur-vps-poster.svg",{"categorySlug":33,"appSlug":34},"securite","openvpn-server","OpenVPN remains a reference when you need to connect teams, contractors or remote sites with controlled profiles. On a ServOrbit VPS, you administer the server, the certificates and the access rules without going through a consumer VPN. This guide covers the full installation via the community route (openvpn package + Easy-RSA), server and client profile configuration, essential security settings and troubleshooting the most common errors.",[37,41,51,54,73,76,79,82,85,88,91,123,127],{"type":38,"title":39,"body":40},"h2","Why host OpenVPN Server on a VPS?","Shared commercial VPN solutions require trusting a third-party provider that can log, resell or expose your connection data. By hosting OpenVPN Server on your own VPS, you are the sole administrator: you choose the level of logging, the authorized users and the encryption protocols (TLS 1.3, AES-256-GCM). It is also the ideal solution to interconnect distributed teams, secure access to your internal services or bypass the network restrictions of a corporate environment, all at a controlled cost.",{"type":42,"title":43,"items":44},"ul","What you can do with OpenVPN Server",[45,46,47,48,49,50],"Secure the connections of your remote-working staff with an encrypted tunnel to your internal network","Expose your internal services (databases, back office, monitoring tools) only via VPN, without opening them to the Internet","Interconnect several sites or offices in a site-to-site virtual private network","Protect your communications on public or untrusted Wi-Fi networks","Finely manage access rights per user thanks to the OpenVPN certificate system","Audit and log connections coming into your infrastructure from a centralized point under your control",{"type":38,"title":52,"body":53},"Prerequisites: server and network","Before starting, check these points on your VPS.\n\n**Minimum resources:** 1 vCPU and 512 MB of RAM are enough for personal use or up to 10 simultaneous users. Beyond 50 active connections, plan for 2 vCPU and 1 GB of RAM to absorb encryption without bandwidth degradation.\n\n**Operating system:** Ubuntu 22.04 LTS or Debian 12 (both supported by the official OpenVPN repository). AlmaLinux 9 and Rocky Linux 9 also work with EPEL packages.\n\n**Network port:** UDP 1194 (default) or TCP 443 to pass through restrictive firewalls. On your ServOrbit VPS, open this port in the security rules before starting the installation. A single port is enough.\n\n**Root access:** required to create virtual network interfaces (`tun0`), modify `iptables` rules and enable IP forwarding.\n\n**IP forwarding:** enable it before continuing:\n\n```bash\necho 'net.ipv4.ip_forward=1' >> \u002Fetc\u002Fsysctl.conf\nsysctl -p\n```",{"type":55,"title":56,"steps":57},"steps","Install OpenVPN and Easy-RSA (community route)",[58,61,64,67,70],{"title":59,"body":60},"Update the system and install packages","```bash\napt update && apt upgrade -y\napt install -y openvpn easy-rsa\n```\nThis approach has no client limit and requires no commercial license. Easy-RSA manages your local certificate authority (CA).",{"title":62,"body":63},"Initialize the certificate authority with Easy-RSA","```bash\nmake-cadir \u002Fetc\u002Fopenvpn\u002Feasy-rsa\ncd \u002Fetc\u002Fopenvpn\u002Feasy-rsa\n.\u002Feasyrsa init-pki\n.\u002Feasyrsa build-ca nopass\n```\n`build-ca nopass` creates the CA without a passphrase — convenient for non-interactive production use. For more sensitive use, remove `nopass` and store the passphrase off the server.",{"title":65,"body":66},"Generate the server certificate and Diffie-Hellman parameters","```bash\n.\u002Feasyrsa gen-req server nopass\n.\u002Feasyrsa sign-req server server\nopenssl dhparam -out \u002Fetc\u002Fopenvpn\u002Fdh.pem 2048\nopenvpn --genkey secret \u002Fetc\u002Fopenvpn\u002Fta.key\n```\nThe `ta.key` key (TLS Auth) protects against DoS attacks on the UDP port before the TLS handshake even begins.",{"title":68,"body":69},"Generate a client certificate","```bash\n.\u002Feasyrsa gen-req client1 nopass\n.\u002Feasyrsa sign-req client client1\n```\nRepeat this operation for each user. The pair `client1.crt` + `client1.key` + `ca.crt` + `ta.key` makes up the `.ovpn` profile to distribute.",{"title":71,"body":72},"Copy the necessary files to \u002Fetc\u002Fopenvpn","```bash\ncp pki\u002Fca.crt pki\u002Fissued\u002Fserver.crt pki\u002Fprivate\u002Fserver.key \u002Fetc\u002Fopenvpn\u002F\n```\nKeep the `pki\u002Fprivate\u002F` files with `600` permissions: they should only be readable by root.",{"type":38,"title":74,"body":75},"Configure server.conf","Create `\u002Fetc\u002Fopenvpn\u002Fserver.conf` with the following content. Each directive is commented.\n\n```bash\nport 1194\nproto udp\ndev tun\n\nca   \u002Fetc\u002Fopenvpn\u002Fca.crt\ncert \u002Fetc\u002Fopenvpn\u002Fserver.crt\nkey  \u002Fetc\u002Fopenvpn\u002Fserver.key\ndh   \u002Fetc\u002Fopenvpn\u002Fdh.pem\n\ntls-auth \u002Fetc\u002Fopenvpn\u002Fta.key 0\nkey-direction 0\n\nserver 10.8.0.0 255.255.255.0\nifconfig-pool-persist \u002Fvar\u002Flog\u002Fopenvpn\u002Fipp.txt\n\n# Push default route (full tunnel)\npush \"redirect-gateway def1 bypass-dhcp\"\npush \"dhcp-option DNS 9.9.9.9\"\npush \"dhcp-option DNS 149.112.112.112\"\n\nkeepalive 10 120\ncipher AES-256-GCM\ntls-version-min 1.2\n\nuser nobody\ngroup nogroup\npersist-key\npersist-tun\n\nstatus  \u002Fvar\u002Flog\u002Fopenvpn\u002Fopenvpn-status.log\nlog-append \u002Fvar\u002Flog\u002Fopenvpn\u002Fopenvpn.log\nverb 3\n```\n\nEnable and start the service:\n\n```bash\nmkdir -p \u002Fvar\u002Flog\u002Fopenvpn\nsystemctl enable --now openvpn@server\nsystemctl status openvpn@server\n```",{"type":38,"title":77,"body":78},"Full tunnel or split tunneling: choosing the right mode","**Full tunnel (`redirect-gateway def1`)**: all client traffic goes through the VPN. Useful for protecting users on untrusted networks or for unifying Internet exits. Downside: the VPS bandwidth becomes the bottleneck for all flows.\n\n**Split tunneling**: only traffic destined for your private network (e.g. `10.8.0.0\u002F24`) goes through the VPN. The rest exits directly from the client. To enable it, replace the `redirect-gateway` line with specific routes in `server.conf`:\n\n```bash\npush \"route 192.168.1.0 255.255.255.0\"\n```\n\nThis reduces load on the server and improves overall performance, but connections outside the VPN are no longer protected.",{"type":38,"title":80,"body":81},"Create and distribute a .ovpn client profile","A standalone `.ovpn` file embeds all certificates. Generate it as follows:\n\n```bash\ncat > \u002Ftmp\u002Fclient1.ovpn \u003C\u003C EOF\nclient\ndev tun\nproto udp\nremote \u003CYOUR-VPS-IP> 1194\nresolv-retry infinite\nnobind\npersist-key\npersist-tun\nremote-cert-tls server\ncipher AES-256-GCM\nverb 3\nkey-direction 1\n\u003Cca>\n$(cat \u002Fetc\u002Fopenvpn\u002Feasy-rsa\u002Fpki\u002Fca.crt)\n\u003C\u002Fca>\n\u003Ccert>\n$(cat \u002Fetc\u002Fopenvpn\u002Feasy-rsa\u002Fpki\u002Fissued\u002Fclient1.crt)\n\u003C\u002Fcert>\n\u003Ckey>\n$(cat \u002Fetc\u002Fopenvpn\u002Feasy-rsa\u002Fpki\u002Fprivate\u002Fclient1.key)\n\u003C\u002Fkey>\n\u003Ctls-auth>\n$(cat \u002Fetc\u002Fopenvpn\u002Fta.key)\n\u003C\u002Ftls-auth>\nEOF\n```\n\nTransfer this file to the client via a secure channel (SCP or a single-use link). Then simply import it into OpenVPN Connect (Windows, macOS, Android, iOS) or NetworkManager (Linux) to establish the connection.",{"type":38,"title":83,"body":84},"Security: fail2ban, ufw and disabling IPv6","**ufw firewall — open only what is necessary:**\n\n```bash\nufw allow ssh\nufw allow 1194\u002Fudp\nufw enable\n```\n\nIf you use TCP 443 instead of UDP 1194, adapt the rule.\n\n**fail2ban for the OpenVPN port:**\n\nCreate `\u002Fetc\u002Ffail2ban\u002Fjail.d\u002Fopenvpn.conf`:\n\n```bash\n[openvpn]\nenabled  = true\nport     = 1194\nprotocol = udp\nfilter   = openvpn\nlogpath  = \u002Fvar\u002Flog\u002Fopenvpn\u002Fopenvpn.log\nmaxretry = 5\nbantime  = 3600\n```\n\nThen create the filter `\u002Fetc\u002Ffail2ban\u002Ffilter.d\u002Fopenvpn.conf`:\n\n```bash\n[Definition]\nfailregex = .*TLS Error: TLS key negotiation failed.*\u003CHOST>.*\n            .*VERIFY ERROR:.*\u003CHOST>.*\n```\n\nActivate:\n\n```bash\nsystemctl restart fail2ban\nfail2ban-client status openvpn\n```\n\n**Disable IPv6 if not needed:** an unprotected IPv6 interface can bypass your tunnel. If your infrastructure does not need IPv6:\n\n```bash\necho 'net.ipv6.conf.all.disable_ipv6=1' >> \u002Fetc\u002Fsysctl.conf\necho 'net.ipv6.conf.default.disable_ipv6=1' >> \u002Fetc\u002Fsysctl.conf\nsysctl -p\n```",{"type":38,"title":86,"body":87},"Performance: MTU and cipher choice","**MTU and fragmentation:** OpenVPN encryption adds headers. By default the tunnel MTU (`tun-mtu`) is 1500, but UDP encapsulation can cause fragmentation on some networks. To avoid this, add to `server.conf`:\n\n```bash\ntun-mtu 1400\nmssfix 1360\n```\n\nIf you observe slow transfers or drops on connections with a low MTU (mobile networks, some corporate VPNs), reduce `tun-mtu` to 1300.\n\n**Cipher choice:** `AES-256-GCM` is recommended for modern Linux kernels, which benefit from AES-NI hardware instructions (check with `grep -m1 'aes' \u002Fproc\u002Fcpuinfo`). For highly CPU-constrained servers, `AES-128-GCM` halves the encryption cost without significant security reduction for common use cases.\n\n**UDP or TCP:** UDP 1194 is the default and most performant mode. TCP 443 is useful to bypass restrictive corporate firewalls, but introduces the \"TCP over TCP\" problem (redundant retransmissions) which degrades performance under packet loss.",{"type":38,"title":89,"body":90},"Troubleshooting: common errors","**TLS Error: TLS key negotiation failed**\n\nThis error appears when the client cannot reach the server on the configured port. Check that the port is open (`ss -ulnp | grep 1194`), that the firewall rule is active, and that the `ta.key` key is identical on the server side (`key-direction 0`) and the client side (`key-direction 1`).\n\n**Routes not applied after connection**\n\nIf traffic does not pass through the tunnel despite an established connection, check that IP forwarding is active (`cat \u002Fproc\u002Fsys\u002Fnet\u002Fipv4\u002Fip_forward` must return `1`) and that a NAT rule is in place:\n\n```bash\niptables -t nat -A POSTROUTING -s 10.8.0.0\u002F24 -o eth0 -j MASQUERADE\n```\n\nReplace `eth0` with the main interface of your VPS (`ip route get 8.8.8.8` to identify it).\n\n**Connections dropping regularly**\n\nIf the tunnel disconnects every 2 minutes, check the `keepalive` in `server.conf` (`keepalive 10 120`: ping every 10 s, timeout at 120 s). On the client side, add `ping-restart 60` to the `.ovpn` profile to force a clean reconnection before the server timeout.\n\n**VERIFY ERROR: depth=0, error=certificate is not yet valid**\n\nThe server or client clock is out of sync. Synchronize NTP: `timedatectl set-ntp true`.",{"type":92,"title":93,"headers":94,"rows":98},"comparison","OpenVPN vs WireGuard: which to choose?",[95,96,97],"Criterion","OpenVPN","WireGuard",[99,103,107,111,115,119],[100,101,102],"Protocol","TLS\u002FSSL (OpenSSL)","ChaCha20-Poly1305 (modern cryptography)",[104,105,106],"Performance","Good, slightly slower","Very high, lower latency",[108,109,110],"Configuration","Detailed .conf files, learning curve","Simpler, public\u002Fprivate key pairs",[112,113,114],"Compatibility","All OS, restrictive firewalls (TCP 443)","Excellent on Linux, less universal",[116,117,118],"Certificate revocation","Built-in CRL, fine-grained per-user management","Remove public key only",[120,121,122],"Ideal use case","Teams, site-to-site, corporate environments","Personal access, mobility, performance",{"type":124,"title":125,"body":126},"tip","A ServOrbit VPS as your private OpenVPN server","A ServOrbit VPS with root access, dedicated IPv4 and OS choice is the ideal platform for an OpenVPN server: you retain full control over certificates, logs and access rules. The OpenVPN Server template is available in the Marketplace for a quick start, or follow this guide for a complete manual installation via the community route. To get started: \u003Ca href=\"\u002Fvps-cloud\">\u002Fvps-cloud\u003C\u002Fa>.",{"type":124,"title":128,"body":129},"The official documentation","For advanced configuration, tool-specific options and version changes, refer to the \u003Ca href=\"https:\u002F\u002Fopenvpn.net\u002Fcommunity-docs\u002Fhow-to.html\" target=\"_blank\" rel=\"noopener noreferrer\">official OpenVPN Community documentation\u003C\u002Fa>. This guide covers going live on a ServOrbit VPS; the vendor documentation remains the reference for fine-tuning.","Deploy OpenVPN Server in minutes on a ServOrbit Cloud VPS","Order your Cloud VPS, install OpenVPN Server in 1 click via the Marketplace and take back full control over the security of your connections starting today.","Launch my Cloud VPS","\u002Fvps-cloud",[135,154,177],{"id":136,"slug":137,"slugs":138,"title":142,"excerpt":143,"readTime":144,"views":145,"isPinned":19,"noindex":19,"publishedAt":146,"updatedAt":147,"category":148,"categories":149,"featuredImage":29,"bgImage":30,"posterImage":151,"relatedSolution":152},141,"wireguard-on-a-vps-a-fast-lean-and-private-vpn",{"fr":139,"en":137,"ar":140,"es":141},"installer-wireguard-vps","wireguard-على-خادم-vps-شبكة-vpn-سريعة-ومبسطة-وخاصة","wireguard-en-un-vps-vpn-rapido-y-privado","WireGuard on a VPS: a fast, lean and private VPN","Deploy WireGuard on a ServOrbit VPS: fast tunnels, readable configuration, client QR codes and private remote access.",7,2,"2026-02-04T00:00:00+00:00","2026-11-08T01:13:12+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":26},[150],{"id":17,"name":23,"slug":24,"color":25,"icon":26},"\u002Fblog\u002Fcovers\u002Finstaller-wireguard-vps-poster.svg",{"categorySlug":33,"appSlug":153},"wireguard-server",{"id":155,"slug":156,"slugs":157,"title":161,"excerpt":162,"readTime":17,"views":163,"isPinned":19,"noindex":19,"publishedAt":164,"updatedAt":165,"category":166,"categories":171,"featuredImage":29,"bgImage":30,"posterImage":173,"relatedSolution":174},39,"deploy-your-applications-with-caddy-on-a-vps",{"fr":158,"en":156,"ar":159,"es":160},"deployer-avec-caddy","انشر-تطبيقاتك-باستخدام-caddy-على-خادم-vps","desplegar-con-caddy","Caddy as a reverse proxy on VPS: complete guide","Install and configure Caddy as a reverse proxy on your VPS: automatic Let's Encrypt HTTPS, multi-app setup, security hardening and common error troubleshooting.",4,"2026-05-12T00:00:00+00:00","2026-09-25T23:43:04+00:00",{"id":167,"name":168,"slug":169,"color":170,"icon":169},3,"Deployment","deploiement","bg-success\u002F10 text-success",[172],{"id":167,"name":168,"slug":169,"color":170,"icon":169},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-caddy-poster.svg",{"categorySlug":175,"appSlug":176},"application-deployment-devops","caddy",{"id":178,"slug":179,"slugs":180,"title":184,"excerpt":185,"readTime":17,"views":186,"isPinned":19,"noindex":19,"publishedAt":187,"updatedAt":188,"category":189,"categories":190,"featuredImage":29,"bgImage":30,"posterImage":192,"relatedSolution":193},142,"haproxy-on-a-vps-load-balancing-and-high-availability",{"fr":181,"en":179,"ar":182,"es":183},"deployer-avec-haproxy-vps","haproxy-على-خادم-vps-موازنة-الأحمال-والتوافر-العالي","haproxy-en-un-vps-balanceo-de-carga","HAProxy on a VPS: load balancing and high availability","Install HAProxy on a VPS to distribute traffic, monitor backends and prepare a more resilient web architecture.",1,"2026-02-03T00:00:00+00:00","2026-10-13T14:10:29+00:00",{"id":167,"name":168,"slug":169,"color":170,"icon":169},[191],{"id":167,"name":168,"slug":169,"color":170,"icon":169},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-haproxy-vps-poster.svg",{"categorySlug":194,"appSlug":195},"infra","haproxy",true,1794270464125]