Set Up an OpenVPN Server on Ubuntu 18.04 with EasyRSA and UFW

Running your own VPN gives you full control over your traffic, privacy, and connection security. It encrypts your data on untrusted public networks, lets you bypass geographic restrictions, and gives remote workers a secure tunnel into your internal network without relying on a commercial VPN provider that may log your activity.

This guide covers how to set up an OpenVPN server on Ubuntu 18.04 using EasyRSA for PKI and certificate management, and UFW for firewall rules and NAT.

Prerequisites:

• An Ubuntu 18.04 server with sudo access and UFW running
• A separate CA machine (a second server or your local machine) for signing certificates

Why a separate CA machine? If an attacker reaches your OpenVPN server and the CA private key is stored there, they can sign new certificates and access the VPN. Keeping the CA offline or on a dedicated machine limits that risk.

Configure an OpenVPN Server on Ubuntu: PKI, CA, and Certificates

On your CA machine. Download and extract EasyRSA 3.0.5, initialize a new PKI, and build the Certificate Authority:

bashcd && wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.5/EasyRSA-nix-3.0.5.tgztar xzf EasyRSA-nix-3.0.5.tgzcd ~/EasyRSA-3.0.5/./easyrsa init-pki./easyrsa build-ca

Set a strong passphrase for the CA key and choose a common name when prompted. The script creates ca.crt (public certificate) and ca.key (private key — guard this carefully).

On your OpenVPN server. Install OpenVPN, download EasyRSA, and initialize a second PKI — this one generates certificate requests for the CA to sign:

bashsudo apt update && sudo apt install openvpncd && wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.5/EasyRSA-nix-3.0.5.tgztar xzf EasyRSA-nix-3.0.5.tgz && cd ~/EasyRSA-3.0.5/./easyrsa init-pki

Generate a Diffie-Hellman key, a HMAC signature file, and the server certificate request:

bash./easyrsa gen-dhopenvpn --genkey --secret ta.key./easyrsa gen-req server1 nopass

Copy dh.pem and ta.key to /etc/openvpn/. Transfer server1.req to the CA machine via scp, sign it with ./easyrsa sign-req server server1, then transfer server1.crt and ca.crt back to /etc/openvpn/ on the server.

Configure the OpenVPN Service, systemd, and UFW

Extract the sample OpenVPN server config to /etc/openvpn/server1.conf and edit it to reference your certificate and key files, set push redirect-gateway def1 to route client traffic through the VPN, set your DNS resolvers, uncomment user nobody and group nogroup, and append auth SHA256.

Start and enable the service using the config filename as the systemd instance name:

bashsudo systemctl start openvpn@server1sudo systemctl enable openvpn@server1

Verify with sudo systemctl status openvpn@server1 and ip a show tun0 to confirm the tunnel interface is up.

Enable IP forwarding by setting net.ipv4.ip_forward=1 in /etc/sysctl.conf, then apply with sudo sysctl -p.

Configure UFW masquerading. Set DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw. Add a NAT MASQUERADE rule in /etc/ufw/before.rules for the 10.8.0.0/16 subnet on your public network interface. Open the OpenVPN port:

bashsudo ufw allow 1194/udpsudo ufw disable && sudo ufw enable

Generate Client Certificates and Connect to the VPN

On the server, generate a client key and certificate request with ./easyrsa gen-req client1 nopass. Transfer the request to the CA, sign it with ./easyrsa sign-req client client1, and return the signed client1.crt to the server.

Create a script that bundles the base client config, ca.crt, ta.key, and the client certificate and key into a single .ovpn file. Transfer the .ovpn file to each client device.

Connecting by platform:

• Linux: sudo openvpn --config client1.ovpn
• macOS: Install Tunnelblick and import the .ovpn file
• Windows: Install the OpenVPN client, copy .ovpn to the config folder, connect from the system tray
• Android / iOS: Install OpenVPN Connect and import the .ovpn file

To revoke a client certificate, run ./easyrsa revoke client1 on the CA machine, generate a CRL with ./easyrsa gen-crl, upload crl.pem to /etc/openvpn/, and add crl-verify crl.pem to server1.conf. Restart the service to apply.

Your OpenVPN server on Ubuntu 18.04 is now running and ready for client connections. Visit the OpenVPN community wiki for advanced topics including multi-factor authentication, split tunneling, and routing configurations. Leave a comment below if you run into any issues.