What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A VPS can be the Internet-reachable hub for a private intranet, but installing OpenVPN alone does not connect private networks. A reliable design uses a routed layer-3 tunnel, a dedicated non-overlapping VPN subnet, certificates for every device, IPv4 forwarding, explicit routes in both directions, and firewall rules limited to the services users actually need.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This guide shows how to build that design on Ubuntu Server, when to use NAT instead, how to connect individual devices or whole sites, and how to diagnose the common case where the VPN connects but internal services do not.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat you are building
The VPS is a rendezvous point with a public IPv4 address or DNS name. OpenVPN creates a private tunnel interface on it, and authenticated clients receive addresses from a separate VPN subnet. The VPS then routes permitted traffic between that tunnel and one or more private service networks.
A typical layout looks like this:
- Public side: the VPS public interface and the UDP port on which OpenVPN listens.
- VPN side: a dedicated range such as
10.8.0.0/24. This is an example only; choose a range that does not occur anywhere on a connected LAN. - Private services: one or more LANs, for example
10.20.0.0/24for headquarters and10.30.0.0/24for a branch. Every LAN must be different from the VPN range and from every other LAN. - Endpoints: laptops and phones, or a router/Linux gateway that represents an entire remote site.
Use routed tun mode for a normal intranet. It carries layer-3 IP packets and is easier to restrict with firewall rules. Bridged mode carries layer-2 broadcasts and DHCP traffic, which is useful only for applications that genuinely require the same broadcast domain and is more difficult to secure.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Routed mode or NAT: choose before configuring
OpenVPN can either preserve the VPN client’s source address and route it through the private network, or hide it behind a translated address. The choice determines whether a private service can initiate a connection back to a VPN client.
| Characteristic | Routed mode | NAT mode |
|---|---|---|
| Source address seen by services | The original VPN client or remote-site subnet | The server-side translated address |
| Return path | Requires a route back to the VPN subnet | Usually simpler because replies return to the translated address |
| Private network initiating connections to clients | Supported when routes and firewall rules allow it | Normally unavailable; OpenVPN documents this as one-way by default |
| Access control and auditing | Per-client and per-subnet identity is visible | Initial deployment is easier, but original source identity is hidden |
| Best fit | Two-way intranet and site-to-site connectivity | Quick client-to-service access when you cannot change LAN routes |
Choose routed mode when a branch office must reach users or devices at another site, when services need the real client address for policy or logs, or when you expect two-way traffic. Choose NAT only for the limited direction that must work when adding return routes is impossible. NAT is not a substitute for a complete routed design.
Free tools Windows power users keep installed
One-click scans. No signup required.
Plan addresses, gateways and trust boundaries
Reserve non-overlapping ranges
Write down every network before installing anything. For example:
| Purpose | Example CIDR | Where it is configured |
|---|---|---|
| OpenVPN tunnel | 10.8.0.0/24 |
OpenVPN server configuration |
| Headquarters services | 10.20.0.0/24 |
HQ router and server route table |
| Branch services | 10.30.0.0/24 |
Branch gateway and server route table |
The values in this table are illustrative. The important rule is that no connected network may overlap. If a traveller’s home router already uses the same range as your office, that client cannot reliably distinguish local destinations from intranet destinations; renumber one side before deployment or provide a carefully designed translation boundary.
Identify every gateway
For each private subnet, identify the router or host that can send traffic toward the VPS tunnel. In a site-to-site design, that device is normally an always-on Linux gateway or branch router running an OpenVPN client. For a single service network located on the same VPS, the host itself may be the gateway. Record which interface connects to the LAN and which interface is tun0; firewall rules depend on those names.
Prepare provider and management access
- Use an Ubuntu Server image and a stable public IPv4 address or DNS record.
- Record the VPS provider’s external firewall or security-group controls. Provider filtering and the host firewall are separate layers and must both permit the intended traffic.
- Restrict SSH to trusted source addresses where practical. Keep a provider console or out-of-band recovery method available before changing firewall policy.
- Decide where backups of the PKI and server configuration will be encrypted and who can retrieve them.
Install OpenVPN and Easy-RSA
On Ubuntu, install the packaged server and certificate tooling:
sudo apt update
sudo apt install openvpn easy-rsaKeep package updates current, but schedule upgrades so you can test the server and at least one client profile afterward. OpenVPN configuration syntax and service-unit behavior can vary between major package versions.
Create a private PKI correctly
Use a private certificate authority (CA), one server certificate, and one client certificate per device or gateway. Do not copy the CA private key onto the running VPS. Store it offline or in a tightly protected administrative environment. A separate certificate for every device lets you revoke one lost laptop without replacing every profile.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Initialize Easy-RSA
Copy the Easy-RSA working directory supplied by the Ubuntu package into an administrator-owned location, enter that directory, and run the following standard workflow. The exact package path can differ between Ubuntu releases, but the easyrsa subcommands are the same:
./easyrsa init-pki
./easyrsa build-ca
./easyrsa gen-req server nopass
./easyrsa gen-dh
./easyrsa sign-req server serverbuild-ca prompts for a CA name and protects the CA key with a passphrase unless you deliberately choose another policy. Keep the resulting CA key out of the VPS. The server request and signed certificate, along with the generated Diffie-Hellman parameters, are copied to the server’s protected OpenVPN configuration directory.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Issue a certificate for each client
Use a unique name that identifies the device or gateway, not a shared label such as employee:
./easyrsa gen-req laptop-alex nopass
./easyrsa sign-req client laptop-alexRepeat this process for every endpoint. Protect each client private key and deliver only that endpoint’s key, certificate, the CA certificate, and the TLS control-channel key in its profile. If a device is lost, revoke its certificate through Easy-RSA and distribute an updated certificate-revocation list according to your server policy.
Protect the control channel
Generate a TLS control-channel key on a trusted administrative system:
sudo openvpn --genkey secret ta.keyReference the same ta.key with tls-crypt in both server and client profiles. Ubuntu’s documentation notes that tls-crypt is available from OpenVPN 2.4; older installations use tls-auth instead. Do not send the CA private key to clients, and do not reuse a client private key on another device.
Configure the OpenVPN server
Start from the sample server configuration installed with the package. For a routed design, the essential settings have these functions:
port 1194
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh /etc/openvpn/server/dh.pem
tls-crypt /etc/openvpn/server/ta.key
server 10.8.0.0 255.255.255.0
keepalive 10 120
persist-key
persist-tun
user nobody
group nogroup
UDP 1194 is OpenVPN’s official default port, but you can choose another port if a provider or restrictive network requires it. The client profile must use the same port and transport protocol. Keep certificate and key paths consistent with the files you actually installed; a correct configuration pointing to a wrong filename fails before any routing is attempted.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Advertise private routes to clients
Add one route directive for each private network that ordinary clients should reach, for example:
push "route 10.20.0.0 255.255.255.0"
push "route 10.30.0.0 255.255.255.0"Only push networks that the client is authorized to access. Pushing an entire private address space when users need one application increases the blast radius of a compromised client. On a site gateway, add the appropriate routes on the gateway itself rather than assuming every LAN host will learn them from OpenVPN.
Recommended Free Tools
Decide how compression is handled
Compression settings must agree between server and clients. A mismatch can prevent a session from completing or produce warnings in the log. Do not enable compression merely because an old sample file contains it; use a deliberate, compatible setting across all profiles and document that choice.
Enable IPv4 forwarding on the VPS
The Linux kernel must be allowed to pass packets between tun0 and the private or public interface. Persist the setting:
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/50-enable-ipv4-forwarding.conf
sudo sysctl -p /etc/sysctl.d/50-enable-ipv4-forwarding.confVerify the effective value with sysctl net.ipv4.ip_forward. A value of 1 is necessary but not sufficient: the firewall must also permit the intended forwarded traffic.
Add routes and return paths
Routing is the part most often omitted. A client can complete TLS and receive a tunnel address while still being unable to reach an internal service because the service’s reply follows a default route to the wrong gateway.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Routes on the VPS
The VPS needs a route for every private LAN that is reachable through a site gateway. If the gateway’s OpenVPN client connection makes that network directly reachable, install the corresponding route through the tunnel. In a multi-site configuration, the server-side OpenVPN configuration must also associate each remote subnet with the correct client or gateway.
Return routes on LAN routers
On the router for 10.20.0.0/24, add a static route for 10.8.0.0/24 via the gateway that owns the OpenVPN tunnel. Do the equivalent on the branch router for 10.30.0.0/24. If a service host uses a different default gateway than the LAN router, add the route on that host or ensure the LAN router is its effective next hop.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
For a laptop connected directly as a client, the VPS can send traffic into the private LAN, but the LAN still needs a route back to 10.8.0.0/24 if you want routed two-way communication. Without that return path, SYN packets may arrive at a service and replies will disappear through the normal Internet gateway.
When adding routes is impossible
Use NAT only for the direction that must work. The private service sees the VPS-side translated address, so its replies return naturally, but it cannot normally initiate a new connection to the original VPN client. Document this limitation so users do not mistake a one-way remote-access setup for a full intranet.
Apply a least-privilege firewall policy
Permit the OpenVPN UDP port at both the provider firewall and the VPS host firewall. Then permit forwarding only from the VPN range to the specific service subnets and ports required by the intranet. Keep SSH and other management services outside a broad VPN allow rule unless they are intentionally part of the design.
Ubuntu documents nftables as its native firewall framework and warns against managing the same rules concurrently through multiple firewall systems. Select one source of truth. If you use UFW as a frontend, do not independently maintain overlapping nftables scripts.
Example UFW approach
The following illustrates the policy shape; substitute your actual interface names, source ranges and service ports:
sudo ufw allow from 198.51.100.25 to any port 22 proto tcp
sudo ufw allow 1194/udp
sudo ufw route allow in on tun0 out on eth0 to 10.20.0.0/24 port 443 proto tcp
sudo ufw route allow in on tun0 out on eth0 to 10.30.0.0/24 port 22 proto tcpThe address 198.51.100.25 is documentation space; replace it with a trusted management address or use your provider’s console while testing. A route rule for TCP 443 does not permit database, file-sharing or administrative ports. Add each service explicitly, and add the reverse path only when your routed design requires it.
Protect the services themselves
Network filtering is not authentication. Keep application-level authentication, TLS, patching and host firewalls enabled on internal services. Bind a service to its intended private interface where possible, and log which client certificates or source addresses access sensitive applications.
Start the named systemd instance
If the server configuration file is named myserver.conf, Ubuntu uses a templated unit whose instance name matches that file:
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
sudo systemctl start openvpn@myserver
sudo systemctl enable openvpn@myserver
sudo systemctl status openvpn@myserver
sudo journalctl -u openvpn@myserver -xesystemctl start openvpn does not start the myserver instance. Use the exact filename-derived unit, then inspect the journal for certificate, permission, protocol and bind errors.
Build and distribute a client profile
A client profile contains the public endpoint, matching transport settings, the CA certificate, that device’s certificate and private key, and the shared tls-crypt key. A minimal external-file profile has this shape:
client
dev tun
proto udp
remote vpn.example.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-crypt ta.key
ca ca.crt
cert laptop-alex.crt
key laptop-alex.keyUse the public DNS name or address that resolves to the VPS, and make sure the client uses the same UDP port, compression decision and routed-versus-bridged mode as the server. Some clients support an inline profile with certificate blocks; others require separate files. In either case, deliver only the files belonging to that device and protect the private key with the operating system’s secure storage.
Test connectivity in layers
Testing from the outside in prevents a routing problem from being confused with a certificate problem. Follow this order:
- Name resolution: confirm the VPN hostname resolves to the VPS public address from the client’s network.
- UDP reachability: verify that the configured UDP port is allowed by the provider firewall, host firewall and any intervening network.
- TLS authentication: confirm the client certificate, key, CA and
tls-cryptkey are valid and that the server accepts the profile. - Tunnel address: confirm the client receives an address from the VPN subnet, such as
10.8.0.0/24. - VPN endpoint: ping or otherwise test an allowed service on the server’s tunnel address, subject to that host’s firewall policy.
- Private service: test the exact permitted protocol and port on a host in
10.20.0.0/24or another authorized subnet. - Return traffic: in routed mode, verify that the private host or its router has a route back to the VPN client subnet and that reverse firewall rules allow the response.
Use the OpenVPN service journal on the VPS, the client log, and route-table tools on each gateway. A successful TLS message proves authentication, not end-to-end reachability.
Troubleshoot the common failure branches
| Symptom | Likely cause | What to check |
|---|---|---|
| No connection attempt reaches the server | DNS, provider firewall, wrong port or blocked UDP | Resolve the hostname, compare the configured port and protocol, and inspect both perimeter and host firewall rules. |
| Server logs show certificate or key errors | Wrong filename, permissions, expired or mismatched certificate | Check each path, file ownership and that the client certificate was signed by the configured CA. |
| TLS starts but the session never completes | Different tls-crypt/tls-auth settings, protocol mismatch or incompatible compression |
Compare server and client profiles line by line and inspect the journal for the first error. |
| Client receives a tunnel address but cannot reach any private host | IPv4 forwarding disabled or FORWARD policy denies traffic | Check sysctl net.ipv4.ip_forward and the active firewall’s tunnel-to-LAN rules. |
| Private host receives packets but client sees no reply | Missing return route or reverse firewall rule | Inspect the private host’s route table and its LAN gateway for a route to 10.8.0.0/24. |
| One site works while another does not | Overlapping ranges or a route associated with the wrong gateway | Compare every CIDR and verify that each remote subnet is installed on the correct side of the tunnel. |
| Client can reach services but services cannot start connections to it | NAT mode or missing routed return path | Use routed mode with explicit routes, or accept that NAT is one-way for this design. |
Capture packets only after checking configuration and routes. A trace on the VPS tunnel interface can show whether a request arrives; a trace on the private service can show whether the reply leaves. Do not weaken every firewall rule as a diagnostic shortcut; temporarily allow one known source, destination and port instead.
Operate the intranet safely after launch
Credential lifecycle
- Keep the CA private key offline or in a tightly controlled administrative environment.
- Issue one client certificate per device or gateway.
- Revoke lost, retired or compromised certificates and distribute the updated revocation list.
- Protect downloaded profiles and private keys with encrypted storage and device access controls.
Backups and recovery
Back up the PKI, server configuration, firewall policy and route inventory in encrypted storage. Keep access to the CA backup separate from routine VPS administration. Test that you can rebuild the server without exposing the CA key or reusing an untracked client certificate.
Monitoring and change control
Monitor the OpenVPN unit status and journal, provider firewall events and service logs. Record every network range, static route, certificate name and firewall exception. When changing the OpenVPN version, transport port or compression setting, test a current client and a site gateway before removing the old configuration.
Capacity expectations
The cited OpenVPN and Ubuntu documentation establishes configuration behavior and prerequisites, not a universal VPS size, latency or bandwidth result. Throughput depends on the VPS CPU, encryption workload, provider network, client hardware, distance and the applications being carried. Size the VPS from measured usage and leave headroom rather than assuming a particular instance guarantees performance.
Extending the design to multiple sites
For a branch-to-office intranet, run OpenVPN on an always-on gateway at each site. Give each gateway its own certificate, advertise the remote site’s subnet through the server configuration, and install reciprocal static routes on both LAN routers. The official site-to-site pattern uses separate headquarters, VPN and branch ranges; those ranges must differ. A gateway must also forward traffic between its LAN interface and the tunnel and apply a firewall policy that permits only the approved site-to-site services.
For many sites, maintain an address registry and a route matrix before adding another gateway. The matrix should identify which source subnet may reach which destination subnet and on which ports. This prevents an accidental broad route from turning every branch into a fully trusted network.
Quick Recap
Final implementation checklist
- Ubuntu VPS has a stable public address or DNS name and separately managed provider and host firewall controls.
- VPN, headquarters and branch CIDRs are distinct and documented.
- CA key is protected away from the running VPS; server and client certificates are separate.
tls-cryptkey is present and matched on both ends, or an intentionally supported oldertls-authdesign is used.- OpenVPN server uses routed
tunmode unless a documented layer-2 requirement justifies bridging. - IPv4 forwarding is enabled persistently.
- Server routes, LAN return routes and gateway forwarding rules are installed.
- Only the OpenVPN port and required intranet service ports are exposed.
- The named systemd instance starts at boot and its journal is monitored.
- Each device has its own profile and a documented revocation process.
- Testing has progressed from public DNS and UDP reachability to TLS, tunnel address, service access and return traffic.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
