How to Set Up an OpenVPN Server on Linux: Step‑by‑Step Guide

Install Required Packages

Install the compiler and OpenSSL development libraries:

# yum -y install gcc gcc-c++ openssl openssl-devel

Compile and Install LZO (compression library)

# wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.03.tar.gz
# tar -xzvf lzo-2.03.tar.gz -C /tmp/
# cd /tmp/lzo-2.03
# ./configure --prefix=/usr/local/lzo-2.0.3
# make && make install

Add Library Search Path

Edit the dynamic linker configuration and refresh:

# vim /etc/ld.so.conf
# ldconfig

Compile and Install OpenVPN

# wget http://www.openvpn.net/release/openvpn-2.0.9.tar.gz
# tar -xzvf openvpn-2.0.9.tar.gz -C /tmp/
# cd /tmp/openvpn-2.0.9
# ./configure --prefix=/usr/local/openvpn-2.0.9 \
    --with-lzo-headers=/usr/local/lzo-2.03/include/ \
    --with-lzo-lib=/usr/local/lzo-2.03/lib/
# make && make install

Create Configuration Environment

# mkdir /etc/openvpn
# cp -R /tmp/openvpn-2.0.9/easy-rsa/ /etc/openvpn/
# cd /etc/openvpn/easy-rsa/2.0

Set Environment Variables

# vim ./vars
export KEY_COUNTRY=CN
export KEY_PROVINCE="SZ"
export KEY_CITY="shenzhen"
export KEY_ORG="OPEN"
export KEY_EMAIL="[email protected]"

Load the variables:

# source ./vars

Generate Certificates

Generate the CA certificate: # ./build-ca Generate Diffie‑Hellman parameters (1024‑bit): # ./build-dh Generate a server certificate (replace servername with your desired name): # ./build-key-serve servername Generate a client certificate (replace clitename with the client identifier):

# ./build-key clitename

Deploy Server Certificates

# cp ca.crt ca.key servername.crt servername.key dh1024.pem /etc/openvpn/

Package Client Files

# tar zcvf client.tar.gz keys/ca.* clientname.* /tmp/openvpn-2.0.9/sample-config-files/client.conf

Modify Server Configuration

Edit /etc/openvpn/openvpn.conf to set parameters such as port, protocol, virtual network interface, paths to certificates and keys, DH file, virtual subnet, server subnet, LZO compression, and log file location.

Start OpenVPN Service

# /usr/local/openvpn/sbin/openvpn --daemon --config /etc/openvpn/openvpn.conf

Adjust Client Configuration

Extract the client package, edit client.conf (rename to .ovpn) and set:

proto tcp

remote VPN‑server‑IP 1194

ca ca.crt

cert clientname.crt

key clientname.key

comp‑lzo

redirect‑gateway def1

When the OpenVPN tray icon turns green, the client is connected.