2026 Latest: Setting Up an OpenVPN Server on Ubuntu 26.04 LTS with Cross-Platform Client Configuration

Summary: This tutorial walks you through deploying an OpenVPN server on Ubuntu 26.04 LTS from scratch, and configuring clients on Android, iOS, Windows, and macOS. All commands are copy-paste ready, with certificate management, firewall hardening, and security best practices — get a stable, secure self-hosted VPN in 30 minutes.

Table of Contents

• Introduction
• Server Configuration (Ubuntu 26.04)
  • Install OpenVPN and Easy-RSA
  • Set Up PKI and Generate Certificates
  • Create Server Configuration File
  • Enable IP Forwarding and Firewall
  • Start the OpenVPN Service
• Generating Client Configuration Files
  • Linux / Universal Client .ovpn Generation Script
• Cross-Platform Client Configuration
  • Android Client
  • iOS Client
  • Windows Client
  • macOS Client
• Verification and Troubleshooting
• Frequently Asked Questions (FAQ)
• Conclusion

---

Introduction

OpenVPN is a mature, stable open-source VPN solution that supports multiple encryption algorithms and flexible networking modes. Compared to WireGuard's simplicity, OpenVPN excels at penetrating complex network environments and providing enterprise-grade authentication. This tutorial uses Ubuntu 26.04 LTS as the server OS, builds a certificate authentication system with easy-rsa, and gets you from zero to a working server in 30 minutes — with Android, iPhone, Windows, and macOS clients all securely connected.

---

Server Configuration (Ubuntu 26.04)

Environment: Ubuntu 26.04 LTS, with root or sudo privileges.
All commands are executed with sudo by default.

Install OpenVPN and Easy-RSA

sudo apt update
sudo apt install openvpn easy-rsa -y

After installation, easy-rsa is located at /usr/share/easy-rsa/ by default. Copy it to a working directory:

mkdir ~/openvpn-ca
cp -r /usr/share/easy-rsa/* ~/openvpn-ca/
cd ~/openvpn-ca

Set Up PKI and Generate Certificates

1. Initialize the PKI directory

./easyrsa init-pki

2. Create the CA (Certificate Authority)

./easyrsa build-ca nopass

The system will prompt for a Common Name (e.g., OpenVPN-CA). Press Enter to accept the default.

3. Generate server certificate and key

./easyrsa gen-req server nopass
./easyrsa sign-req server server

4. Generate Diffie-Hellman parameters

./easyrsa gen-dh

5. Generate tls-crypt pre-shared key (enhances anti-attack capability)

openvpn --genkey secret ta.key

Create Server Configuration File

Copy all generated certificates and keys to the OpenVPN directory:

sudo cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem ta.key /etc/openvpn/server/

Create the server configuration file /etc/openvpn/server/server.conf:

sudo nano /etc/openvpn/server/server.conf

Fill in the following content:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-crypt ta.key
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-GCM
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
explicit-exit-notify 1

Key parameter explanations:

• push "redirect-gateway def1" routes all client traffic through the VPN.
• DNS uses Google Public DNS; replace as needed.
• cipher AES-256-GCM uses modern, strong encryption.

Enable IP Forwarding and Firewall

Enable IP forwarding:

echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Configure UFW firewall to allow OpenVPN port and set up NAT:

sudo ufw allow 1194/udp
sudo ufw allow OpenSSH   # Ensure SSH access is not lost

Edit /etc/ufw/before.rules and add NAT rules before the *filter section:

sudo nano /etc/ufw/before.rules

Insert at the top of the file:

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT

Replace eth0 with your primary network interface name (check with ip route show default).

Enable UFW:

sudo ufw enable
sudo ufw status

Start the OpenVPN Service

sudo systemctl start openvpn-server@server
sudo systemctl enable openvpn-server@server

Check service status:

sudo systemctl status openvpn-server@server

---

Generating Client Configuration Files

Linux / Universal Client .ovpn Generation Script

Create a script ~/client-config.sh on the server:

#!/bin/bash
KEY_DIR=~/openvpn-ca
OUTPUT_DIR=~/client-configs
CLIENT=$1
mkdir -p $OUTPUT_DIR

cat > $OUTPUT_DIR/$CLIENT.ovpn <<EOF
client
dev tun
proto udp
remote <SERVER_PUBLIC_IP> 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
verb 3
<ca>
$(cat $KEY_DIR/pki/ca.crt)
</ca>
<cert>
$(sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' $KEY_DIR/pki/issued/$CLIENT.crt)
</cert>
<key>
$(cat $KEY_DIR/pki/private/$CLIENT.key)
</key>
<tls-crypt>
$(cat /etc/openvpn/server/ta.key)
</tls-crypt>
EOF

echo "Client configuration file generated: $OUTPUT_DIR/$CLIENT.ovpn"

Generate a certificate for the client:

cd ~/openvpn-ca
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Then run the script:

chmod +x ~/client-config.sh
~/client-config.sh client1

The generated client1.ovpn file can now be distributed to clients.

---

Cross-Platform Client Configuration

Android Client

1. Install OpenVPN Connect or OpenVPN for Android from Google Play.
2. Transfer the .ovpn file to your phone (preferably over an encrypted channel).
3. Open the app → tap Import Profile → select the file → connect.
4. On first connection, you will be prompted to authorize the VPN; allow it.

iOS Client

1. Install OpenVPN Connect from the App Store.
2. Import the .ovpn file into the app via iTunes File Sharing, AirDrop, or email.
3. Open the app → the profile will be auto-detected → tap ADD → enter a password (if set) → connect.

Windows Client

1. Download OpenVPN Connect for Windows from the official website.
2. After installation, right-click the system tray icon → Import → Import Profile → select the .ovpn file.
3. Click Connect to establish the connection.

macOS Client

1. Download OpenVPN Connect for macOS from the App Store or the official website.
2. After installation, click the OpenVPN icon in the menu bar → Import Profile → select the .ovpn file.
3. Click Connect to establish the connection.

---

Verification and Troubleshooting

Check server status

sudo tail -f /var/log/openvpn.log

When the connection is successful, you will see Initialization Sequence Completed.

Client verification
Visit https://ip.sb or run curl ifconfig.me; the displayed IP should match your server's public IP.

Common troubleshooting

Symptom	Possible Cause	Solution
Client cannot connect	Firewall not allowing UDP 1194	Allow the port in both cloud security group and UFW
Connected but no internet	IP forwarding not enabled	Check sysctl net.ipv4.ip_forward is 1
TLS handshake failure	Certificate time mismatch	Sync time between client and server with ntpdate
Authentication failure	Certificate Common Name mismatch	Check server client-config-dir setting or re-issue the certificate

---

Frequently Asked Questions (FAQ)

Q: OpenVPN vs WireGuard — which one should I choose?
A: If you want minimal setup, high performance, and your network allows direct UDP connections, WireGuard is better. If you need to penetrate complex firewalls (e.g., corporate networks), use TCP mode, or require mature certificate management, OpenVPN is the better choice.

Q: How do I change the VPN subnet?
A: Edit the server line in /etc/openvpn/server/server.conf, e.g., change it to server 172.16.0.0 255.255.255.0, then restart the service.

Q: How do I revoke a client certificate?
A: Go to ~/openvpn-ca, run ./easyrsa revoke client1, then ./easyrsa gen-crl. Copy the generated pki/crl.pem to /etc/openvpn/server/, add crl-verify crl.pem to server.conf, and restart the service.

Q: Can I use TCP instead of UDP?
A: Yes, change proto udp to proto tcp and optionally change the port to 443 to disguise traffic as HTTPS. The client configuration must also be updated accordingly.

Q: Is distributing the configuration file secure?
A: The .ovpn file contains a private key and must be transferred over an encrypted channel (e.g., Signal, end-to-end encrypted email). Using a one-time link or offline USB transfer is recommended.

---

Conclusion

You now have a fully deployed OpenVPN service based on Ubuntu 26.04, with all major client platforms able to connect securely. OpenVPN's flexibility and strong penetration capabilities make it a reliable choice for enterprise remote work and cross-border access.