redhat
+
+
+
+
+
vscode
∫
+
pascal
clj
elasticsearch
+
scheme
+
≈
goland
+
<=
<=
+
express
notepad++
+
cassandra
+
+
fauna
nim
webpack
+
elm
jasmine
?
+
+
∑
+
+
+
+
+
+
+
+
+
ionic
+
+
wsl
gitlab
+
rocket
bundler
marko
+
+
^
->
actix
+
groovy
+
lisp
cargo
atom
soap
+
+
+
+
+
+
+
+
+
+
+
+
+
dask
c++
+
symfony
+
jax
+
+
+
=>
Back to Blog
🔐 AlmaLinux VPN Server: Complete OpenVPN & WireGuard Setup Guide
AlmaLinux VPN OpenVPN

🔐 AlmaLinux VPN Server: Complete OpenVPN & WireGuard Setup Guide

Published Sep 18, 2025

Master VPN servers on AlmaLinux! Learn OpenVPN and WireGuard setup, client configuration, security hardening, and performance optimization. Complete guide with real examples.

58 min read
0 views
Table of Contents

🔐 AlmaLinux VPN Server: Complete OpenVPN & WireGuard Setup Guide

Hey there, privacy champion! 🛡️ Ready to build your own secure VPN server that protects your data, bypasses restrictions, and gives you secure remote access from anywhere? Today we’re setting up both OpenVPN and WireGuard on AlmaLinux – two powerful VPN solutions that will make your internet traffic as secure as Fort Knox! 🚀

Whether you’re protecting your privacy on public WiFi, accessing your home network remotely, or securing your business communications, this guide will turn your AlmaLinux server into a VPN powerhouse! 💪

🤔 Why is a VPN Server Important?

Imagine sending sensitive data over public WiFi – it’s like shouting your credit card number in a crowded mall! 😱 Without a VPN, your data is exposed to anyone watching. A VPN creates an encrypted tunnel that keeps your data safe!

Here’s why running your own VPN on AlmaLinux is game-changing:

  • 🔒 Military-Grade Encryption - Protect all your internet traffic
  • 🌍 Remote Access - Securely connect to your network from anywhere
  • 🚫 Bypass Restrictions - Access content from different locations
  • 👁️ Privacy Protection - Hide your activities from ISPs and trackers
  • 🛡️ Public WiFi Security - Stay safe on untrusted networks
  • 💼 Business Security - Secure remote work connections
  • 🎮 Gaming Benefits - Reduce lag and protect against DDoS
  • 📱 Multi-Device Support - Protect phones, tablets, and computers

🎯 What You Need

Before we start building your VPN fortress, let’s make sure you have everything ready:

✅ AlmaLinux 9.x server (with public IP address) ✅ Root or sudo access for configuration ✅ Open ports (UDP 1194 for OpenVPN, UDP 51820 for WireGuard) ✅ Basic networking knowledge (IP addresses, routing) ✅ Client devices to connect (phone, laptop, etc.) ✅ Domain name (optional but recommended) ✅ Patience for configuration (it’s worth it!) ✅ Security mindset 🔐

📝 Step 1: Install and Configure OpenVPN

Let’s start with OpenVPN, the battle-tested VPN solution! 🎯

# Install EPEL repository for OpenVPN
sudo dnf install -y epel-release

# Install OpenVPN and Easy-RSA
sudo dnf install -y openvpn easy-rsa iptables-services

# Create Easy-RSA directory
make-cadir ~/easy-rsa
cd ~/easy-rsa

# Initialize PKI
./easyrsa init-pki

# Build Certificate Authority
./easyrsa build-ca nopass

# Generate server certificate and key
./easyrsa gen-req server nopass
./easyrsa sign-req server server

# Generate Diffie-Hellman parameters (this takes a while)
./easyrsa gen-dh

# Generate TLS authentication key
openvpn --genkey --secret ta.key

# Copy certificates to OpenVPN directory
sudo cp pki/ca.crt /etc/openvpn/server/
sudo cp pki/issued/server.crt /etc/openvpn/server/
sudo cp pki/private/server.key /etc/openvpn/server/
sudo cp pki/dh.pem /etc/openvpn/server/
sudo cp ta.key /etc/openvpn/server/

Create OpenVPN server configuration:

# Create server configuration
sudo tee /etc/openvpn/server/server.conf << 'EOF'
# OpenVPN Server Configuration
port 1194
proto udp
dev tun

# Certificates and keys
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0

# Network configuration
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

# Client configuration
client-to-client
duplicate-cn
keepalive 10 120

# Security
cipher AES-256-GCM
auth SHA256
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384

# Compression
compress lz4-v2
push "compress lz4-v2"

# Logging
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3

# User and group
user nobody
group nobody

# Persist options
persist-key
persist-tun

# Connection limit
max-clients 100
EOF

# Enable IP forwarding
echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Perfect! OpenVPN server is configured! 🎉

🔧 Step 2: Configure Firewall and NAT

Now let’s set up the firewall rules for VPN traffic:

# Configure firewall for OpenVPN
sudo firewall-cmd --permanent --add-service=openvpn
sudo firewall-cmd --permanent --add-port=1194/udp
sudo firewall-cmd --permanent --add-masquerade

# Get your main network interface name
MAIN_NIC=$(ip route | grep default | awk '{print $5}')

# Add NAT rules for OpenVPN
sudo firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 -o $MAIN_NIC -j MASQUERADE
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i tun0 -o $MAIN_NIC -j ACCEPT
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -i $MAIN_NIC -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Reload firewall
sudo firewall-cmd --reload

# Start and enable OpenVPN
sudo systemctl enable openvpn-server@server
sudo systemctl start openvpn-server@server

# Check status
sudo systemctl status openvpn-server@server

Create client certificate generation script:

# Create client certificate script
cat > ~/easy-rsa/generate-client.sh << 'EOF'
#!/bin/bash
# OpenVPN Client Certificate Generator

CLIENT_NAME="$1"

if [ -z "$CLIENT_NAME" ]; then
    echo "Usage: $0 <client-name>"
    exit 1
fi

cd ~/easy-rsa

# Generate client certificate
./easyrsa gen-req "$CLIENT_NAME" nopass
./easyrsa sign-req client "$CLIENT_NAME"

# Create client config directory
CLIENT_DIR="/etc/openvpn/client-configs/$CLIENT_NAME"
sudo mkdir -p "$CLIENT_DIR"

# Copy certificates
sudo cp pki/ca.crt "$CLIENT_DIR/"
sudo cp pki/issued/"$CLIENT_NAME".crt "$CLIENT_DIR/"
sudo cp pki/private/"$CLIENT_NAME".key "$CLIENT_DIR/"
sudo cp ta.key "$CLIENT_DIR/"

# Get server public IP
SERVER_IP=$(curl -s ifconfig.me)

# Create client configuration
sudo tee "$CLIENT_DIR/$CLIENT_NAME.ovpn" << CONFIG
client
dev tun
proto udp
remote $SERVER_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
compress lz4-v2
verb 3

<ca>
$(sudo cat "$CLIENT_DIR/ca.crt")
</ca>

<cert>
$(sudo cat "$CLIENT_DIR/$CLIENT_NAME.crt")
</cert>

<key>
$(sudo cat "$CLIENT_DIR/$CLIENT_NAME.key")
</key>

<tls-auth>
$(sudo cat "$CLIENT_DIR/ta.key")
</tls-auth>
key-direction 1
CONFIG

echo "✅ Client configuration created: $CLIENT_DIR/$CLIENT_NAME.ovpn"
echo "📤 Transfer this file to your client device securely"
EOF

chmod +x ~/easy-rsa/generate-client.sh

# Generate first client
~/easy-rsa/generate-client.sh client1

Excellent! OpenVPN is ready with client support! 🌟

🌟 Step 3: Install and Configure WireGuard

Now let’s set up WireGuard for modern, fast VPN connections:

# Install WireGuard
sudo dnf install -y wireguard-tools

# Generate server keys
wg genkey | sudo tee /etc/wireguard/server_private.key
sudo chmod 600 /etc/wireguard/server_private.key
sudo cat /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

# Get server public key for later
SERVER_PUBLIC_KEY=$(sudo cat /etc/wireguard/server_public.key)
echo "Server Public Key: $SERVER_PUBLIC_KEY"

# Create WireGuard configuration
sudo tee /etc/wireguard/wg0.conf << EOF
[Interface]
Address = 10.9.0.1/24
ListenPort = 51820
PrivateKey = $(sudo cat /etc/wireguard/server_private.key)
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o $MAIN_NIC -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o $MAIN_NIC -j MASQUERADE
SaveConfig = true

# Client configurations will be added here
EOF

# Configure firewall for WireGuard
sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --reload

# Enable and start WireGuard
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

# Check status
sudo wg show

Create WireGuard client configuration script:

# Create WireGuard client generator
cat > ~/generate-wireguard-client.sh << 'EOF'
#!/bin/bash
# WireGuard Client Configuration Generator

CLIENT_NAME="$1"
CLIENT_NUMBER="$2"

if [ -z "$CLIENT_NAME" ] || [ -z "$CLIENT_NUMBER" ]; then
    echo "Usage: $0 <client-name> <client-number>"
    echo "Example: $0 laptop 2"
    exit 1
fi

# Generate client keys
CLIENT_PRIVATE=$(wg genkey)
CLIENT_PUBLIC=$(echo "$CLIENT_PRIVATE" | wg pubkey)

# Get server public key and IP
SERVER_PUBLIC=$(sudo cat /etc/wireguard/server_public.key)
SERVER_IP=$(curl -s ifconfig.me)

# Client IP address
CLIENT_IP="10.9.0.$CLIENT_NUMBER/32"

# Create client config directory
CLIENT_DIR="/etc/wireguard/clients/$CLIENT_NAME"
sudo mkdir -p "$CLIENT_DIR"

# Create client configuration
sudo tee "$CLIENT_DIR/$CLIENT_NAME.conf" << CONFIG
[Interface]
PrivateKey = $CLIENT_PRIVATE
Address = $CLIENT_IP
DNS = 8.8.8.8, 8.8.4.4

[Peer]
PublicKey = $SERVER_PUBLIC
Endpoint = $SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
CONFIG

# Add client to server configuration
sudo tee -a /etc/wireguard/wg0.conf << SERVER
[Peer]
# $CLIENT_NAME
PublicKey = $CLIENT_PUBLIC
AllowedIPs = $CLIENT_IP
SERVER

# Reload WireGuard with new peer
sudo wg syncconf wg0 <(sudo wg-quick strip wg0)

# Generate QR code for mobile clients
if command -v qrencode &> /dev/null; then
    qrencode -t ansiutf8 < "$CLIENT_DIR/$CLIENT_NAME.conf"
    qrencode -o "$CLIENT_DIR/$CLIENT_NAME.png" < "$CLIENT_DIR/$CLIENT_NAME.conf"
    echo "📱 QR code saved to: $CLIENT_DIR/$CLIENT_NAME.png"
fi

echo "✅ WireGuard client configuration created!"
echo "📁 Configuration file: $CLIENT_DIR/$CLIENT_NAME.conf"
echo "🔑 Client Public Key: $CLIENT_PUBLIC"
echo "🌐 Client IP: $CLIENT_IP"
EOF

chmod +x ~/generate-wireguard-client.sh

# Install QR code generator for mobile clients
sudo dnf install -y qrencode

# Generate first WireGuard client
~/generate-wireguard-client.sh mobile 2

Fantastic! WireGuard is configured and ready! 🎯

✅ Step 4: VPN Management and Monitoring

Let’s create comprehensive management tools:

# Create VPN management script
sudo tee /usr/local/bin/vpn-manager << 'EOF'
#!/bin/bash
# VPN Server Management Tool

show_menu() {
    echo "========================================="
    echo "       🔐 VPN Server Manager"
    echo "========================================="
    echo "1. Show OpenVPN status"
    echo "2. Show WireGuard status"
    echo "3. List OpenVPN clients"
    echo "4. List WireGuard peers"
    echo "5. Monitor VPN traffic"
    echo "6. Revoke OpenVPN client"
    echo "7. Remove WireGuard peer"
    echo "8. Show VPN logs"
    echo "9. Restart VPN services"
    echo "0. Exit"
    echo "========================================="
}

show_openvpn_status() {
    echo "📊 OpenVPN Server Status:"
    sudo systemctl status openvpn-server@server --no-pager
    echo ""
    echo "Connected Clients:"
    sudo cat /var/log/openvpn-status.log 2>/dev/null | grep "^CLIENT_LIST" | awk -F',' '{print $2 " - " $3}'
}

show_wireguard_status() {
    echo "📊 WireGuard Status:"
    sudo wg show
}

list_openvpn_clients() {
    echo "📋 OpenVPN Clients:"
    ls -la /etc/openvpn/client-configs/ 2>/dev/null
}

list_wireguard_peers() {
    echo "📋 WireGuard Peers:"
    sudo wg show wg0 peers
}

monitor_traffic() {
    echo "📈 VPN Traffic Monitor (Press Ctrl+C to stop):"
    sudo watch -n 1 'echo "=== OpenVPN ===" && netstat -anp | grep :1194 && echo -e "\n=== WireGuard ===" && wg show wg0 transfer'
}

revoke_openvpn_client() {
    read -p "Enter client name to revoke: " CLIENT_NAME
    cd ~/easy-rsa
    ./easyrsa revoke "$CLIENT_NAME"
    ./easyrsa gen-crl
    sudo cp pki/crl.pem /etc/openvpn/server/
    sudo systemctl restart openvpn-server@server
    echo "✅ Client $CLIENT_NAME revoked"
}

remove_wireguard_peer() {
    read -p "Enter peer public key to remove: " PEER_KEY
    sudo wg set wg0 peer "$PEER_KEY" remove
    sudo wg-quick save wg0
    echo "✅ Peer removed"
}

show_logs() {
    echo "📝 Recent VPN Logs:"
    echo "=== OpenVPN ==="
    sudo tail -n 20 /var/log/openvpn.log
    echo -e "\n=== WireGuard ==="
    sudo journalctl -u wg-quick@wg0 -n 20 --no-pager
}

restart_services() {
    echo "🔄 Restarting VPN services..."
    sudo systemctl restart openvpn-server@server
    sudo systemctl restart wg-quick@wg0
    echo "✅ Services restarted"
}

# Main loop
while true; do
    show_menu
    read -p "Enter choice: " choice

    case $choice in
        1) show_openvpn_status ;;
        2) show_wireguard_status ;;
        3) list_openvpn_clients ;;
        4) list_wireguard_peers ;;
        5) monitor_traffic ;;
        6) revoke_openvpn_client ;;
        7) remove_wireguard_peer ;;
        8) show_logs ;;
        9) restart_services ;;
        0) echo "Goodbye!"; exit 0 ;;
        *) echo "Invalid option!" ;;
    esac

    echo ""
    read -p "Press Enter to continue..."
    clear
done
EOF

sudo chmod +x /usr/local/bin/vpn-manager

Perfect! Your VPN management system is ready! 🌊

🎮 Quick Examples

Example 1: Advanced OpenVPN Security Configuration

# Create hardened OpenVPN configuration
cat > /etc/openvpn/server/server-hardened.conf << 'EOF'
# Ultra-Secure OpenVPN Configuration

port 443
proto tcp
dev tun

# Enhanced security
tls-version-min 1.3
cipher AES-256-GCM
auth SHA512
dh none
ecdh-curve secp384r1
tls-crypt ta.key

# Certificate settings
ca ca.crt
cert server.crt
key server.key
crl-verify crl.pem

# Network
server 10.8.0.0 255.255.255.0
topology subnet

# DNS and routing
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
push "block-outside-dns"

# Security policies
client-cert-not-required
verify-client-cert require
username-as-common-name
auth-user-pass-verify /etc/openvpn/scripts/auth.sh via-env
script-security 2

# Rate limiting
connect-freq 3 10
max-clients-per-ip 2

# Logging
status /var/log/openvpn-status.log 30
log-append /var/log/openvpn.log
verb 3
mute 20

# Performance
sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"

# Persistence
persist-key
persist-tun
user nobody
group nobody
EOF

# Create authentication script
sudo mkdir -p /etc/openvpn/scripts
sudo tee /etc/openvpn/scripts/auth.sh << 'SCRIPT'
#!/bin/bash
# Two-factor authentication for OpenVPN

USERNAME="$username"
PASSWORD="$password"

# Add your authentication logic here
# Example: Check against a database or LDAP

if [ "$USERNAME" == "admin" ] && [ "$PASSWORD" == "secure_password" ]; then
    exit 0
else
    exit 1
fi
SCRIPT

sudo chmod +x /etc/openvpn/scripts/auth.sh

This creates military-grade VPN security! 🔒

Example 2: WireGuard Site-to-Site VPN

# Configure site-to-site WireGuard VPN
cat > setup-site-to-site.sh << 'EOF'
#!/bin/bash
# WireGuard Site-to-Site VPN Setup

# Site A Configuration (Main Office)
SITE_A_PRIVATE=$(wg genkey)
SITE_A_PUBLIC=$(echo "$SITE_A_PRIVATE" | wg pubkey)
SITE_A_NETWORK="192.168.1.0/24"
SITE_A_ENDPOINT="site-a.example.com:51820"

# Site B Configuration (Branch Office)
SITE_B_PRIVATE=$(wg genkey)
SITE_B_PUBLIC=$(echo "$SITE_B_PRIVATE" | wg pubkey)
SITE_B_NETWORK="192.168.2.0/24"
SITE_B_ENDPOINT="site-b.example.com:51820"

# Create Site A configuration
cat > /etc/wireguard/site-a.conf << SITE_A
[Interface]
Address = 10.200.0.1/30
PrivateKey = $SITE_A_PRIVATE
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT

[Peer]
# Site B
PublicKey = $SITE_B_PUBLIC
Endpoint = $SITE_B_ENDPOINT
AllowedIPs = 10.200.0.2/32, $SITE_B_NETWORK
PersistentKeepalive = 25
SITE_A

# Create Site B configuration
cat > /etc/wireguard/site-b.conf << SITE_B
[Interface]
Address = 10.200.0.2/30
PrivateKey = $SITE_B_PRIVATE
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT

[Peer]
# Site A
PublicKey = $SITE_A_PUBLIC
Endpoint = $SITE_A_ENDPOINT
AllowedIPs = 10.200.0.1/32, $SITE_A_NETWORK
PersistentKeepalive = 25
SITE_B

echo "✅ Site-to-Site VPN configurations created!"
echo "📁 Deploy site-a.conf to Site A server"
echo "📁 Deploy site-b.conf to Site B server"
EOF

chmod +x setup-site-to-site.sh
./setup-site-to-site.sh

This connects multiple offices securely! 🏢

Example 3: VPN Performance Monitoring

# Create VPN performance monitoring script
cat > /usr/local/bin/vpn-monitor.sh << 'EOF'
#!/bin/bash
# VPN Performance and Health Monitor

LOG_DIR="/var/log/vpn-monitor"
mkdir -p "$LOG_DIR"

# Function to check OpenVPN performance
check_openvpn() {
    echo "=== OpenVPN Performance ==="

    # Connection count
    CONNECTIONS=$(grep -c "^CLIENT_LIST" /var/log/openvpn-status.log 2>/dev/null || echo 0)
    echo "Active connections: $CONNECTIONS"

    # Bandwidth usage
    BANDWIDTH=$(vnstat -i tun0 --oneline 2>/dev/null | cut -d';' -f9)
    echo "Today's bandwidth: $BANDWIDTH"

    # CPU usage
    CPU=$(ps aux | grep "[o]penvpn" | awk '{print $3}')
    echo "CPU usage: $CPU%"

    # Memory usage
    MEM=$(ps aux | grep "[o]penvpn" | awk '{print $4}')
    echo "Memory usage: $MEM%"

    # Error count
    ERRORS=$(grep -c "ERROR" /var/log/openvpn.log 2>/dev/null || echo 0)
    echo "Errors in log: $ERRORS"
}

# Function to check WireGuard performance
check_wireguard() {
    echo -e "\n=== WireGuard Performance ==="

    # Peer count
    PEERS=$(sudo wg show wg0 peers | wc -l)
    echo "Active peers: $PEERS"

    # Transfer statistics
    sudo wg show wg0 transfer | while read peer rx tx; do
        RX_MB=$(echo "scale=2; $rx/1048576" | bc 2>/dev/null || echo "0")
        TX_MB=$(echo "scale=2; $tx/1048576" | bc 2>/dev/null || echo "0")
        echo "Peer ${peer:0:8}... - RX: ${RX_MB}MB, TX: ${TX_MB}MB"
    done

    # Handshake status
    sudo wg show wg0 latest-handshakes | while read peer timestamp; do
        NOW=$(date +%s)
        DIFF=$((NOW - timestamp))
        if [ $DIFF -lt 180 ]; then
            STATUS="✅ Active"
        else
            STATUS="⚠️ Inactive"
        fi
        echo "Peer ${peer:0:8}... - $STATUS (${DIFF}s ago)"
    done
}

# Function to check network health
check_network() {
    echo -e "\n=== Network Health ==="

    # Packet loss test
    LOSS=$(ping -c 10 -q 8.8.8.8 | grep -oP '\d+(?=% packet loss)')
    echo "Packet loss: $LOSS%"

    # Latency test
    LATENCY=$(ping -c 4 8.8.8.8 | tail -1 | awk -F'/' '{print $5}')
    echo "Average latency: ${LATENCY}ms"

    # DNS resolution
    DNS_TIME=$(dig google.com | grep "Query time" | awk '{print $4}')
    echo "DNS resolution: ${DNS_TIME}ms"
}

# Function to generate alerts
check_alerts() {
    echo -e "\n=== Alert Status ==="

    # Check if services are running
    if ! systemctl is-active --quiet openvpn-server@server; then
        echo "🚨 ALERT: OpenVPN is not running!"
    fi

    if ! systemctl is-active --quiet wg-quick@wg0; then
        echo "🚨 ALERT: WireGuard is not running!"
    fi

    # Check disk space
    DISK_USAGE=$(df /var/log | tail -1 | awk '{print $5}' | sed 's/%//')
    if [ "$DISK_USAGE" -gt 80 ]; then
        echo "⚠️ WARNING: Disk usage is at ${DISK_USAGE}%"
    fi

    # Check for failed authentication attempts
    FAILED_AUTH=$(grep -c "AUTH_FAILED" /var/log/openvpn.log 2>/dev/null || echo 0)
    if [ "$FAILED_AUTH" -gt 10 ]; then
        echo "⚠️ WARNING: $FAILED_AUTH failed authentication attempts detected"
    fi
}

# Main monitoring loop
while true; do
    clear
    echo "🔍 VPN Server Monitor - $(date)"
    echo "========================================="

    check_openvpn
    check_wireguard
    check_network
    check_alerts

    echo "========================================="
    echo "Refreshing in 30 seconds... (Press Ctrl+C to exit)"
    sleep 30
done
EOF

sudo chmod +x /usr/local/bin/vpn-monitor.sh

This provides comprehensive VPN monitoring! 📊

🚨 Fix Common Problems

Problem 1: VPN Clients Can’t Access Internet

Symptoms: Connected to VPN but no internet access

# Fix NAT and routing issues

# 1. Verify IP forwarding is enabled
sudo sysctl net.ipv4.ip_forward
# Should be 1, if not:
echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# 2. Fix firewall NAT rules
sudo firewall-cmd --permanent --add-masquerade
sudo firewall-cmd --reload

# 3. Add explicit NAT rules
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o eth0 -j MASQUERADE

# 4. Save iptables rules
sudo iptables-save > /etc/iptables/rules.v4

# 5. Check DNS resolution
echo "nameserver 8.8.8.8" | sudo tee -a /etc/resolv.conf

Problem 2: WireGuard Handshake Failures

Symptoms: WireGuard peers not connecting

# Debug WireGuard connection issues

# 1. Check peer configuration
sudo wg show

# 2. Verify keys match
# On server:
sudo cat /etc/wireguard/server_public.key

# 3. Test connectivity
sudo tcpdump -i any -n port 51820

# 4. Check firewall
sudo firewall-cmd --list-all

# 5. Debug with verbose logging
echo "module wireguard +p" | sudo tee /sys/kernel/debug/dynamic_debug/control
sudo dmesg | grep wireguard

# 6. Re-sync configuration
sudo wg syncconf wg0 <(sudo wg-quick strip wg0)

Problem 3: OpenVPN Certificate Issues

Symptoms: Certificate verification errors

# Fix certificate problems

# 1. Check certificate dates
openssl x509 -in /etc/openvpn/server/server.crt -noout -dates

# 2. Verify certificate chain
openssl verify -CAfile /etc/openvpn/server/ca.crt /etc/openvpn/server/server.crt

# 3. Regenerate certificates if expired
cd ~/easy-rsa
./easyrsa renew server nopass
sudo cp pki/issued/server.crt /etc/openvpn/server/
sudo systemctl restart openvpn-server@server

# 4. Fix time synchronization
sudo systemctl restart chronyd
timedatectl status

Problem 4: Poor VPN Performance

Symptoms: Slow speeds through VPN

# Optimize VPN performance

# 1. For OpenVPN - adjust MTU
echo "tun-mtu 1420" >> /etc/openvpn/server/server.conf
echo "mssfix 1420" >> /etc/openvpn/server/server.conf

# 2. For WireGuard - optimize MTU
sudo ip link set dev wg0 mtu 1420

# 3. Enable TCP optimizations
cat >> /etc/sysctl.conf << 'EOF'
net.core.netdev_max_backlog = 5000
net.ipv4.tcp_congestion_control = bbr
net.core.default_qdisc = fq
net.ipv4.tcp_notsent_lowat = 16384
EOF
sudo sysctl -p

# 4. Use faster cipher (OpenVPN)
# Replace AES-256-GCM with CHACHA20-POLY1305

# 5. Monitor bandwidth
iftop -i tun0  # For OpenVPN
iftop -i wg0   # For WireGuard

📋 Simple Commands Summary

CommandPurpose
sudo systemctl status openvpn-server@serverCheck OpenVPN status
sudo wg showShow WireGuard status
~/easy-rsa/generate-client.sh <name>Generate OpenVPN client
~/generate-wireguard-client.sh <name> <number>Generate WireGuard client
sudo journalctl -u openvpn-server@server -fView OpenVPN logs
sudo wg-quick up wg0Start WireGuard
sudo tcpdump -i tun0Monitor OpenVPN traffic
sudo wg syncconf wg0 <(sudo wg-quick strip wg0)Reload WireGuard
vpn-managerOpen VPN management tool
sudo iptables -t nat -LCheck NAT rules

💡 Tips for Success

🎯 Security First: Use strong keys and keep them secret

🔍 Monitor Regularly: Check logs for suspicious activity

📊 Test Thoroughly: Verify all client connections work

🛡️ Update Often: Keep VPN software updated for security

🚀 Optimize Performance: Tune MTU and cipher settings

📝 Document Everything: Keep records of client configurations

🔄 Backup Keys: Store certificates and keys securely

⚡ Plan Capacity: Monitor bandwidth and connection limits

🏆 What You Learned

Congratulations! You’ve successfully mastered VPN servers on AlmaLinux! 🎉

✅ Installed and configured OpenVPN server ✅ Set up WireGuard for modern VPN connections ✅ Created client configurations for both protocols ✅ Implemented security hardening measures ✅ Configured firewall and NAT rules ✅ Built management tools for administration ✅ Established monitoring and alerting ✅ Learned troubleshooting techniques

🎯 Why This Matters

Running your own VPN server gives you complete control over your privacy and security! 🌟 With your AlmaLinux VPN server, you now have:

  • Complete privacy control without trusting third-party VPN providers
  • Secure remote access to your network from anywhere
  • Protection on public WiFi against hackers and snoopers
  • Bypass capabilities for geographic restrictions
  • Business-grade security for remote work scenarios

You’re now equipped to provide secure, private internet access for yourself, your family, or your entire organization! Your VPN expertise puts you in control of your digital privacy! 🚀

Keep securing, keep protecting, and remember – in the digital age, privacy is power! You’ve got this! ⭐🙌

Share this article

Buy me a coffee
mvn
sails
kotlin
ractive
★
weaviate

Related Articles

🔐 AlmaLinux VPN Server Setup: Complete OpenVPN & WireGuard Guide
AlmaLinux VPN

🔐 AlmaLinux VPN Server Setup: Complete OpenVPN & WireGuard Guide

Master AlmaLinux VPN server configuration with OpenVPN and WireGuard! Learn secure remote access, client setup, certificate management, and enterprise-grade network tunneling for bulletproof connectivity.

Read more
🔐 OpenVPN Server Setup on AlmaLinux: Your Own Private Internet
AlmaLinux OpenVPN

🔐 OpenVPN Server Setup on AlmaLinux: Your Own Private Internet

Build a secure OpenVPN server on AlmaLinux. Configure certificates, client profiles, routing, and advanced security features with step-by-step beginner instructions.

Read more
🛡️ GDPR Compliance on AlmaLinux Systems: Complete Privacy Protection Guide
AlmaLinux GDPR

🛡️ GDPR Compliance on AlmaLinux Systems: Complete Privacy Protection Guide

Master GDPR compliance on AlmaLinux! Learn data protection, encryption, access controls, audit logging, right to be forgotten implementation, and privacy-by-design. Essential for EU business operations.

Read more