🔐 Setting Up VPN Server on AlmaLinux: OpenVPN Installation Guide

Ready to take control of your online privacy and security? 🛡️ Today we’ll build your own private VPN server on AlmaLinux using OpenVPN! Whether you’re working remotely, traveling, or just want to keep your internet browsing private, having your own VPN server gives you complete control and security! 🚀

🤔 Why is a Private VPN Server Important?

Running your own VPN server delivers incredible benefits:

• 📌 Complete privacy control - Your data stays on your server, not third-party companies
• 🔧 Secure remote access - Connect safely to your home/office network from anywhere
• 🚀 Bypass geo-restrictions - Access content as if you’re at your server location
• 🔐 Encrypted traffic - Protect your data on public Wi-Fi and untrusted networks
• ⭐ Cost-effective - No monthly VPN subscription fees

🎯 What You Need

Before building your VPN server:

• ✅ AlmaLinux 9 server with public IP address
• ✅ Root or sudo access
• ✅ At least 1GB RAM and stable internet connection
• ✅ Domain name (optional but recommended)
• ✅ UDP port 1194 accessible from internet

📝 Step 1: Prepare AlmaLinux System

Let’s prepare your server for OpenVPN installation! 🛠️

Update System and Install Prerequisites

# Update AlmaLinux system
sudo dnf update -y

# Install EPEL repository for additional packages
sudo dnf install -y epel-release

# Install required packages
sudo dnf install -y wget curl nano unzip tar

# Install network tools
sudo dnf install -y net-tools iptables-services

# Check your server's public IP
curl -4 icanhazip.com

# Save your public IP for later use
echo "Your server IP: $(curl -s -4 icanhazip.com)"

echo "✅ System prepared for VPN server setup!"

Configure Firewall

# Enable and start firewalld
sudo systemctl enable firewalld
sudo systemctl start firewalld

# Allow OpenVPN through firewall
sudo firewall-cmd --permanent --add-service=openvpn
sudo firewall-cmd --permanent --add-port=1194/udp

# Allow SSH (make sure you don't lock yourself out!)
sudo firewall-cmd --permanent --add-service=ssh

# Reload firewall rules
sudo firewall-cmd --reload

# Check firewall status
sudo firewall-cmd --list-all

echo "✅ Firewall configured for VPN server!"

Pro tip: 💡 Always keep SSH access open when configuring firewalls remotely!

🔧 Step 2: Install OpenVPN Server

Now let’s install and configure OpenVPN:

Install OpenVPN and Easy-RSA

# Install OpenVPN server
sudo dnf install -y openvpn

# Install Easy-RSA for certificate management
sudo dnf install -y easy-rsa

# Verify OpenVPN installation
openvpn --version

# Check if OpenVPN service is available
systemctl list-unit-files | grep openvpn

echo "✅ OpenVPN installed successfully!"

Set Up Certificate Authority

# Create Easy-RSA directory
mkdir -p ~/openvpn-ca
cd ~/openvpn-ca

# Copy Easy-RSA scripts
cp -r /usr/share/easy-rsa/3/* ~/openvpn-ca/

# Create vars file for certificate settings
cat > ~/openvpn-ca/vars << 'EOF'
set_var EASYRSA_REQ_COUNTRY     "US"
set_var EASYRSA_REQ_PROVINCE    "California"
set_var EASYRSA_REQ_CITY        "San Francisco"
set_var EASYRSA_REQ_ORG         "MyVPN"
set_var EASYRSA_REQ_EMAIL       "[email protected]"
set_var EASYRSA_REQ_OU          "MyVPN Server"
set_var EASYRSA_KEY_SIZE        2048
set_var EASYRSA_ALGO            rsa
set_var EASYRSA_CA_EXPIRE       7300
set_var EASYRSA_CERT_EXPIRE     365
EOF

# Initialize PKI
./easyrsa init-pki

# Build Certificate Authority
./easyrsa build-ca nopass

# Generate server certificate request
./easyrsa gen-req server nopass

# Sign server certificate
./easyrsa sign-req server server

# Generate Diffie-Hellman parameters
./easyrsa gen-dh

# Generate shared secret key
openvpn --genkey secret pki/ta.key

echo "✅ Certificates and keys generated!"

Configure OpenVPN Server

# Create OpenVPN server configuration directory
sudo mkdir -p /etc/openvpn/server

# Copy certificates and keys to OpenVPN directory
sudo cp ~/openvpn-ca/pki/ca.crt /etc/openvpn/server/
sudo cp ~/openvpn-ca/pki/issued/server.crt /etc/openvpn/server/
sudo cp ~/openvpn-ca/pki/private/server.key /etc/openvpn/server/
sudo cp ~/openvpn-ca/pki/dh.pem /etc/openvpn/server/
sudo cp ~/openvpn-ca/pki/ta.key /etc/openvpn/server/

# Create server configuration file
sudo tee /etc/openvpn/server/server.conf << 'EOF'
# OpenVPN Server Configuration
port 1194
proto udp
dev tun

# Certificates and keys
ca ca.crt
cert server.crt
key server.key
dh dh.pem

# Network configuration
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt

# Push routes to clients
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

# Client configuration
client-to-client
duplicate-cn

# Security
tls-auth ta.key 0
cipher AES-256-CBC
auth SHA256

# Connection settings
keepalive 10 120
compress lz4-v2
push "compress lz4-v2"

# Privileges and logging
user nobody
group nobody
persist-key
persist-tun

status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
mute 20

# Explicit exit notify
explicit-exit-notify 1
EOF

# Create log directory
sudo mkdir -p /var/log/openvpn

echo "✅ OpenVPN server configured!"

🌟 Step 3: Enable IP Forwarding and NAT

Configure your server to route VPN traffic:

Enable IP Forwarding

# Enable IP forwarding temporarily
sudo sysctl -w net.ipv4.ip_forward=1

# Make IP forwarding permanent
echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf

# Apply sysctl settings
sudo sysctl -p

# Verify IP forwarding is enabled
cat /proc/sys/net/ipv4/ip_forward
# Should show: 1

echo "✅ IP forwarding enabled!"

Configure NAT with iptables

# Find your main network interface
INTERFACE=$(ip route | grep default | awk '{print $5}')
echo "Main interface: $INTERFACE"

# Add NAT rule for VPN traffic
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o $INTERFACE -j MASQUERADE

# Add forwarding rules
sudo iptables -A FORWARD -i tun0 -o $INTERFACE -j ACCEPT
sudo iptables -A FORWARD -i $INTERFACE -o tun0 -j ACCEPT

# Save iptables rules
sudo iptables-save | sudo tee /etc/iptables/rules.v4

# Create script to restore iptables on boot
sudo tee /etc/systemd/system/iptables-restore.service << 'EOF'
[Unit]
Description=Restore iptables rules
Before=network-pre.target

[Service]
Type=oneshot
ExecStart=/sbin/iptables-restore /etc/iptables/rules.v4

[Install]
WantedBy=multi-user.target
EOF

# Enable iptables restore service
sudo systemctl enable iptables-restore

echo "✅ NAT configured for VPN traffic!"

✅ Step 4: Start OpenVPN Server and Create Client

Let’s get your VPN server running:

Start OpenVPN Service

# Start OpenVPN server
sudo systemctl start openvpn-server@server

# Enable OpenVPN to start at boot
sudo systemctl enable openvpn-server@server

# Check OpenVPN service status
sudo systemctl status openvpn-server@server

# Check if VPN interface was created
ip addr show tun0

# Check server logs
sudo tail -f /var/log/openvpn/openvpn.log

echo "✅ OpenVPN server is running!"

Create Client Certificate

# Go back to Easy-RSA directory
cd ~/openvpn-ca

# Generate client certificate (replace 'client1' with desired name)
./easyrsa gen-req client1 nopass

# Sign client certificate
./easyrsa sign-req client client1

# Create client configuration directory
mkdir -p ~/client-configs/files

# Create base client configuration
cat > ~/client-configs/base.conf << 'EOF'
client
dev tun
proto udp
remote YOUR_SERVER_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
auth SHA256
key-direction 1
compress lz4-v2
verb 3
EOF

# Replace YOUR_SERVER_IP with actual server IP
SERVER_IP=$(curl -s -4 icanhazip.com)
sed -i "s/YOUR_SERVER_IP/$SERVER_IP/" ~/client-configs/base.conf

echo "✅ Client certificate created!"

Generate Client Configuration File

# Create script to generate client config
cat > ~/client-configs/make_config.sh << 'EOF'
#!/bin/bash

# First argument: Client identifier
KEY_DIR=~/openvpn-ca/pki
OUTPUT_DIR=~/client-configs/files
BASE_CONFIG=~/client-configs/base.conf

cat ${BASE_CONFIG} \
    <(echo -e '<ca>') \
    ${KEY_DIR}/ca.crt \
    <(echo -e '</ca>\n<cert>') \
    ${KEY_DIR}/issued/${1}.crt \
    <(echo -e '</cert>\n<key>') \
    ${KEY_DIR}/private/${1}.key \
    <(echo -e '</key>\n<tls-auth>') \
    ${KEY_DIR}/ta.key \
    <(echo -e '</tls-auth>') \
    > ${OUTPUT_DIR}/${1}.ovpn

echo "Client configuration created: ${OUTPUT_DIR}/${1}.ovpn"
EOF

# Make script executable
chmod +x ~/client-configs/make_config.sh

# Generate client configuration
~/client-configs/make_config.sh client1

# Check if client config was created
ls -la ~/client-configs/files/

echo "✅ Client configuration file created!"
echo "Download: ~/client-configs/files/client1.ovpn"

🎮 Quick Examples

Example 1: Multiple Client Setup 👥

# Create multiple client certificates
cd ~/openvpn-ca

# Create clients for different devices
for client in laptop phone tablet; do
    echo "Creating certificate for $client..."
    ./easyrsa gen-req $client nopass
    ./easyrsa sign-req client $client
    ~/client-configs/make_config.sh $client
done

# List all client configurations
ls -la ~/client-configs/files/

# Copy configurations to web directory for download
sudo mkdir -p /var/www/html/vpn-configs
sudo cp ~/client-configs/files/*.ovpn /var/www/html/vpn-configs/
sudo chmod 644 /var/www/html/vpn-configs/*.ovpn

echo "✅ Multiple client configurations created!"

Example 2: VPN Server Monitoring 📊

# Create monitoring script
cat > ~/vpn-monitor.sh << 'EOF'
#!/bin/bash

echo "=== VPN Server Status ==="
date

echo "OpenVPN Service:"
systemctl is-active openvpn-server@server

echo "Connected Clients:"
if [ -f /var/log/openvpn/openvpn-status.log ]; then
    grep "CLIENT_LIST" /var/log/openvpn/openvpn-status.log | awk '{print $2, $3, $5}'
else
    echo "No client status log found"
fi

echo "Network Interface:"
ip addr show tun0 2>/dev/null || echo "VPN interface not found"

echo "Recent Log Entries:"
tail -n 5 /var/log/openvpn/openvpn.log

echo "Server Load:"
uptime

echo "========================="
EOF

chmod +x ~/vpn-monitor.sh

# Run monitoring script
~/vpn-monitor.sh

# Add to crontab for regular monitoring
echo "*/5 * * * * ~/vpn-monitor.sh >> ~/vpn-monitor.log" | crontab -

echo "✅ VPN monitoring setup complete!"

Example 3: Secure VPN with Custom DNS 🔒

# Configure custom DNS servers
sudo tee /etc/openvpn/server/dns.conf << 'EOF'
# Custom DNS configuration
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
push "dhcp-option DNS 9.9.9.9"
push "dhcp-option DNS 149.112.112.112"
EOF

# Include DNS config in server config
echo "config dns.conf" | sudo tee -a /etc/openvpn/server/server.conf

# Add security hardening
sudo tee -a /etc/openvpn/server/server.conf << 'EOF'

# Security hardening
tls-version-min 1.2
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
ncp-ciphers AES-256-GCM:AES-128-GCM
auth SHA512
EOF

# Restart OpenVPN to apply changes
sudo systemctl restart openvpn-server@server

# Verify configuration
sudo openvpn --config /etc/openvpn/server/server.conf --test-crypto

echo "✅ VPN security hardening applied!"

🚨 Fix Common Problems

Problem 1: VPN Server Won’t Start ❌

Symptoms:

• OpenVPN service fails to start
• Certificate or key errors in logs

Try this:

# Check OpenVPN logs for errors
sudo journalctl -u openvpn-server@server -f

# Verify certificate files exist
ls -la /etc/openvpn/server/

# Test OpenVPN configuration
sudo openvpn --config /etc/openvpn/server/server.conf

# Check file permissions
sudo chmod 600 /etc/openvpn/server/server.key
sudo chmod 644 /etc/openvpn/server/server.crt

# Restart service
sudo systemctl restart openvpn-server@server

Problem 2: Clients Can’t Connect ❌

Try this:

# Check if port 1194 is listening
sudo netstat -ulnp | grep 1194

# Test firewall rules
sudo firewall-cmd --list-all

# Check if IP forwarding is enabled
cat /proc/sys/net/ipv4/ip_forward

# Verify NAT rules
sudo iptables -t nat -L POSTROUTING

# Test from client side
# ping 10.8.0.1  # VPN server IP

Problem 3: No Internet Access Through VPN ❌

Check these things:

# Verify NAT is working
sudo iptables -t nat -L -v

# Check DNS resolution
nslookup google.com 8.8.8.8

# Test routing
ip route show

# Verify server can access internet
ping -c 3 google.com

# Check if clients get correct routes
# From client: ip route show

📋 Simple Commands Summary

💡 Tips for Success

1. Use strong certificates 🌟 - Generate unique certificates for each client
2. Monitor regularly 🔐 - Check logs and connected clients frequently
3. Keep updated 🚀 - Update OpenVPN and certificates regularly
4. Test thoroughly 📝 - Verify connectivity from different networks
5. Backup configs 🔄 - Keep copies of certificates and configuration files

🏆 What You Learned

Congratulations! Now you can:

• ✅ Install and configure OpenVPN server on AlmaLinux
• ✅ Generate and manage SSL certificates for secure connections
• ✅ Create client configuration files for multiple devices
• ✅ Configure firewall and NAT for proper VPN routing
• ✅ Monitor and troubleshoot VPN server issues

🎯 Why This Matters

Your private VPN server provides:

• 🚀 Complete control over your internet privacy and security
• 🔐 Cost savings compared to commercial VPN services
• 📊 Secure remote access to your home or office network
• ⚡ Custom configuration tailored to your specific needs

Remember: Your own VPN server means you control your data completely - no third parties, no logs you can’t access, just pure privacy and security! ⭐

You’ve successfully built your own private VPN server on AlmaLinux! You now have enterprise-grade security and privacy under your complete control! 🙌