How to Deploy an OpenVPN Server on a Public Cloud and Configure Clients

1. Set up OpenVPN server on public cloud

# Install openvpn
yum install openvpn

2. Install Easy RSA suite

Generate keys and certificates

# Download Easy RSA source
wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.2/EasyRSA-3.1.2.tgz
mv EasyRSA-3.1.2 /etc/openvpn/easy-rsa

Modify configuration

# Rename vars.example to vars and edit
# Set EASYRSA_CA_EXPIRE to 365 days
# Set EASYRSA_CERT_EXPIRE as needed

Generate CA and server certificates

# Clean previous keys
./easyrsa clean-all
# Build CA
./easyrsa build-ca
# Build server certificate without password
./easyrsa build-server-full server nopass
# Generate Diffie‑Hellman parameters
./easyrsa gen-dh
# Generate TLS‑auth key
openvpn --genkey --secret ta.key

3. OpenVPN server configuration

Create server.conf

port 1194
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA1
proto tcp
server 10.8.0.0 255.255.255.0
push "route 10.0.8.2 255.255.252.0"
client-to-client
verb 3
persist-key
persist-tun
keepalive 10 120
max-clients 200
ifconfig-pool-persist ipp.txt
duplicate-cn
script-security 3
auth-user-pass-verify /etc/openvpn/check.sh via-env
username-as-common-name

User authentication script

#!/bin/bash
PASSFILE="/etc/openvpn/openvpnfile"
LOG_FILE="/var/log/openvpn-password.log"
TIME_STAMP=$(date "+%Y-%m-%d %T")
# (script body that checks username/password against $PASSFILE and logs results)

Create user password file

/etc/openvpn/openvpnfile
koten 1

Copy keys and start service

cp /etc/openvpn/easy-rsa/pki/ca.crt /etc/openvpn/server/
cp /etc/openvpn/easy-rsa/pki/private/ca.key /etc/openvpn/server/
cp /etc/openvpn/easy-rsa/pki/issued/server.crt /etc/openvpn/server/
cp /etc/openvpn/easy-rsa/pki/private/server.key /etc/openvpn/server/
cp /etc/openvpn/easy-rsa/pki/dh.pem /etc/openvpn/server/
cp /etc/openvpn/easy-rsa/ta.key /etc/openvpn/server/
openvpn --config server.conf

4. Client configuration

Install OpenVPN

yum install openvpn

Generate client certificate

cd /etc/openvpn/easy-rsa
./easyrsa build-client-full client nopass

Create client.conf

client
dev tun
proto tcp
remote <server_ip> 1194
ca ca.crt
cert client.crt
key client.key
nobind
auth SHA1
resolv-retry infinite
verb 3
persist-key
persist-tun
auth-user-pass pass.txt

Create pass.txt with username and password

username
password

Start client

openvpn --config client.conf