Recommended Free Tools
The dependable way to connect two VPS instances privately is a routed, site-to-site OpenVPN tunnel. Run OpenVPN in server mode on one VPS (or on a separate gateway), enroll the other VPS with its own client certificate, assign a tunnel subnet that overlaps none of your existing networks, and install reciprocal routes for the private networks that should cross the tunnel. Permit only the OpenVPN listener and the application flows you actually need.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This design encrypts traffic between the servers while preserving the original source address when both sides have return routes. If you cannot add those routes, source NAT can make the connection work at the cost of hiding the originating host. The sections below show how to choose the topology, build the certificates, configure routing and firewalls, test both directions, and diagnose failures by following the packet path.
As an Amazon Associate I earn from qualifying purchases.
What a VPS-to-VPS OpenVPN tunnel does
A site-to-site VPN joins two private networks over an encrypted tunnel. In a two-server deployment, each VPS can be a one-host “site,” or one VPS can route an entire private subnet behind it. OpenVPN creates a virtual interface (normally tun0 in routed mode), authenticates each peer with TLS certificates, and carries IP packets through that interface.
Assume the following illustrative layout; replace it with your real addresses:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
| Role | Address or network | Purpose |
|---|---|---|
| VPS A, OpenVPN server | Public address plus private network 192.168.70.0/24 |
VPN gateway |
| VPS B, OpenVPN client | Public address plus private network 10.0.60.0/24 |
Peer gateway |
| VPN tunnel | 172.16.0.0/20 |
Dedicated, non-overlapping tunnel subnet |
These CIDRs are examples, not OpenVPN defaults. Every participating network—publicly routed addresses, provider-private networks, container bridges, Kubernetes ranges, and the VPN subnet—must be distinct. Overlap causes the operating system to choose the wrong interface, so packets never reach the tunnel.
Choose the topology before installing software
Routed mode: the normal site-to-site design
Routed mode forwards packets between the two private networks without rewriting their source addresses. VPS A can see the original address of a host on VPS B’s side, and vice versa. Both peers can initiate sessions, provided each side (or its upstream router) has a route back to the other network.
Use routed mode when you control the route tables and need accurate source-IP logging, per-host firewall rules, or two-way service discovery. It is also the clearest design for database replication, internal APIs, and administrative services that should remain addressable by their private IPs.
NAT mode: simpler return paths, less visibility
With source NAT (masquerading), the gateway rewrites packets as they enter the tunnel. The destination sees the gateway’s tunnel address instead of the original client address, so a return route to every remote host is unnecessary. NAT is useful when you cannot change a remote router or when a legacy network has no route-management access.
The trade-off is operational: logs and access-control rules lose the original source address, and inbound connections to hosts behind the NAT gateway need explicit forwarding. Do not use NAT merely because it is familiar; reciprocal routes are preferable whenever you can install them.
VPS endpoint or separate gateway
Putting OpenVPN directly on a VPS is appropriate when only that server, or a small private segment it controls, needs connectivity. A dedicated router or gateway is better when an entire office, cloud subnet, or failover pair must use the tunnel. A gateway adds another system to patch and monitor, but it avoids installing VPN software on every workload and gives you a single place for routing and policy.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Inventory networks and trust boundaries
Write down the following before generating keys:
- Each VPS public address, private address, default gateway, and provider-assigned interface name.
- Every private or service subnet behind each side, including container and orchestration ranges.
- The exact TCP or UDP ports that must cross the tunnel.
- Which hosts may initiate connections and which should accept them.
- Where you can add routes: the VPS itself, an upstream router, or both.
- Which provider security group and host-firewall rules protect each machine.
Select a tunnel CIDR that overlaps none of those networks. Reserve it exclusively for OpenVPN. If either VPS already uses 172.16.0.0/20, choose another private range instead; changing the example to fit your environment is mandatory.
Install OpenVPN and create peer identity
Install the OpenVPN package from your distribution’s supported repository on both VPSs. The package name and service-manager commands vary by Linux distribution, so confirm the current package and service unit for the image you deployed. Install a certificate-authority tool such as the Easy-RSA package if your distribution provides it, or use an existing organizational PKI.
Use TLS mode with mutual authentication:
- Create one offline or tightly protected certificate authority (CA).
- Issue a distinct server certificate and private key for VPS A.
- Issue a distinct client certificate and private key for VPS B.
- Distribute only the certificates and keys needed by each peer; never copy the CA private key to a VPS.
- Protect private-key files with restrictive ownership and permissions, and maintain a documented rotation and revocation process.
OpenVPN’s standard security model uses SSL/TLS for key exchange and peer authentication. A certificate proves which configured peer is connecting; it does not replace firewall policy. Revoke a certificate when a VPS is decommissioned or a private key may have been exposed, then issue a replacement rather than reusing the old identity.
Typical PKI workflow
- Initialize the CA directory on a protected administration host.
- Build the CA and keep its private key offline when practical.
- Generate a server request and sign it for VPS A.
- Generate a client request and sign it for VPS B.
- Copy the signed certificates, corresponding private keys, the CA certificate, and the chosen TLS protection key to the appropriate hosts through an authenticated channel.
- Set ownership so only the OpenVPN service account can read private keys; verify with a permissions audit before starting the service.
Do not paste private keys into tickets or shell histories. Keep a record of certificate common names, issuance dates, expiry dates, and revocation status so a lost VPS can be removed cleanly.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteExpose only the VPN listener
OpenVPN can use UDP or TCP. Select one listener port and allow it in both layers that can filter traffic:
- The VPS provider’s security group, network ACL, or equivalent perimeter control.
- The operating system’s host firewall.
Permit the selected protocol and port only from the peer’s expected public address when that address is stable. If the peer’s address changes, restrict by the narrowest feasible range and monitor authentication logs. Keep SSH and other management ports limited to trusted administrative addresses; do not open them to the entire internet simply because the VPN is not yet working.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
A blocked security-group rule is a common reason a client appears correctly configured but never completes a TLS handshake. Check both counters and logs rather than assuming the host firewall is the only control.
Configure the OpenVPN server in routed mode
The following fragment illustrates the important relationships; adapt paths, certificates, and addresses to your distribution:
port 1194
proto udp
dev tun
server 172.16.0.0 255.255.240.0
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/server.crt
key /etc/openvpn/pki/server.key
# tls protection key and current cryptographic settings go here
client-config-dir /etc/openvpn/ccd
route 10.0.60.0 255.255.255.0
keepalive 10 60
persist-key
persist-tun
user nobody
group nogroupThe server directive allocates tunnel addresses from the dedicated VPN subnet. The route directive tells the OpenVPN server how to reach the client-side network through the connected peer. In a multi-client deployment, use per-client configuration files and unique certificate identities so routes cannot be confused.
OpenVPN configuration syntax and supported cryptographic options change between releases. Use the options documented for the package installed on your VPS, remove obsolete directives, and choose a currently supported cipher and TLS setting rather than copying an old internet example.
Configure the client VPS
On VPS B, create a client profile that names VPS A’s public address and matches the server’s tunnel parameters:
client
dev tun
proto udp
remote vpn-server.example 1194
nobind
persist-key
persist-tun
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/client.crt
key /etc/openvpn/pki/client.key
# matching TLS protection and current cryptographic settings
remote-cert-tls server
route 192.168.70.0 255.255.255.0Replace the example hostname with the server’s real public address or a DNS name you control. The client-side route sends traffic for VPS A’s private network into tun0. If only one host needs access, use a host route (for example, a /32) instead of exposing an entire subnet.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Start the client and server using the service unit supplied by your distribution. Confirm that both processes remain running after a restart and that the profile is enabled at boot. The exact unit name differs between distributions and package layouts, so inspect the installed service definitions rather than assuming one universal command.
Enable forwarding and install reciprocal routes
OpenVPN does not automatically make the Linux kernel route packets between physical and tunnel interfaces. On each gateway, enable IPv4 forwarding persistently through the distribution’s sysctl mechanism, then load the setting:
net.ipv4.ip_forward = 1Apply the setting with your operating system’s sysctl command and verify it with sysctl net.ipv4.ip_forward. If IPv6 traffic is required, design and enable IPv6 forwarding separately; an IPv4-only tunnel does not secure IPv6 flows automatically.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesInstall routes in both directions:
- On VPS A (or its upstream router), route
10.0.60.0/24through the OpenVPN client/tunnel. - On VPS B (or its upstream router), route
192.168.70.0/24through the OpenVPN tunnel.
Use ip route to inspect the resulting table. A route on the VPN gateway alone is insufficient if the destination host’s default gateway sends replies somewhere else. The destination host, or its router, must know that the peer network is reachable through the gateway running OpenVPN.
When NAT is necessary
If you cannot add the return route on the destination network, masquerade only the traffic that must cross the tunnel. Place the rule on the forwarding gateway, restrict it to the peer subnet and required interfaces, and document that logs will show the gateway address. Keep forwarding policy explicit; enabling NAT does not by itself permit packets through a host firewall.
Apply least-privilege firewall policy
Permit the smallest useful set of flows:
- Allow the OpenVPN listener from the peer’s permitted public source.
- Allow tunnel-interface traffic only between the selected tunnel addresses and private subnets.
- Allow the specific application ports, such as an internal API or database port, rather than every port.
- Allow established and related return traffic.
- Reject or log other forwarding attempts.
Keep management services bound to trusted addresses. OpenVPN’s firewall controls can limit users or groups to particular IP addresses or subnets; mirror that principle in the VPS firewall. Avoid a blanket “allow all on tun0” rule unless the tunnel is an intentionally trusted network and every host behind it is controlled.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Validate the tunnel and the real application
Test in layers so a failure has a clear meaning:
- Confirm the OpenVPN process is active and the log reports a completed TLS session.
- On each VPS, inspect
ip addr show tun0and confirm a tunnel address from the selected CIDR. - From VPS A, ping VPS B’s tunnel address; repeat in the opposite direction. Permit ICMP temporarily or permanently only if your policy requires it.
- Ping a private address behind the opposite gateway, if ICMP is allowed there.
- Test the actual service with a protocol-appropriate tool, such as
nc -vz private-host 443for TCP or the application’s own health check. A successful ping does not prove that the service port is reachable. - Check the service log for the expected original client address when using routed mode, or the gateway address when using NAT.
Run tests from both sides. A one-way success often means the forward route exists but the return route or return firewall rule does not.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshoot by following the packet path
The client cannot complete TLS
- Verify the server’s public address, listener port, and UDP/TCP choice in the client profile.
- Check provider security-group rules and host-firewall counters on the server.
- Confirm the OpenVPN service is listening on the intended interface and port.
- Review certificate validity, common names, key permissions, and clock synchronization.
- Capture traffic on the public interface to distinguish “no packet arrived” from “TLS rejected it.”
The tunnel is up, but a private host is unreachable
- Inspect both route tables and confirm the peer CIDR is associated with the tunnel, not the default interface.
- Verify IP forwarding is enabled on every gateway in the path.
- Check forwarding rules, security groups, and destination-host firewalls for the tunnel and private source ranges.
- Confirm the destination host’s default gateway or static route sends replies back through the VPN gateway.
- Look for overlapping CIDRs, including container bridges that were added after the original design.
One direction works only
Capture simultaneously on the sender, the OpenVPN gateway, and the destination. If the request arrives at the destination but no reply returns, fix the destination route or firewall. If the request never leaves the gateway’s tunnel interface, fix the gateway route or forwarding policy. If replies leave the destination but disappear at the gateway, inspect the upstream router and provider filtering.
ICMP fails but the application works
Many host firewalls intentionally block ICMP. Test the application’s TCP or UDP port instead and allow ICMP only when it is part of your monitoring design. Conversely, a successful ping can coexist with a blocked database or API port, so always test the service itself.
Use tcpdump with the correct interfaces while reproducing one connection. A capture on the public interface shows encrypted OpenVPN packets; a capture on tun0 shows decrypted tunnel traffic; a capture on the destination interface shows whether forwarding reached the host. Compare source and destination addresses at each point to identify NAT, a missing route, or a firewall drop.
Operational hardening and maintenance
- Store CA and private keys with restrictive permissions and encrypted backups.
- Use separate certificates for every server or client; never share one client key across VPS instances.
- Revoke lost or retired certificates and issue replacements through the PKI process.
- Patch OpenVPN, the operating system, and the provider image on a defined schedule.
- Monitor handshake failures, certificate expiry, tunnel restarts, and unexpected source addresses.
- Document every route, firewall rule, certificate common name, and owner.
- Test reboot recovery and verify that routes and forwarding return automatically.
- Limit tunnel reachability to required subnets and ports; encryption does not remove the need for authorization.
UDP or TCP: which transport fits?
| Choice | Use it when | Trade-off |
|---|---|---|
| UDP | You control the network and can permit the selected UDP listener. | Usually the cleaner transport for a VPN because it avoids stacking reliable transports. |
| TCP | A restrictive network blocks UDP but permits a reachable TCP port. | Can add transport overhead and interact poorly with congestion when the tunneled application also uses TCP. |
OpenVPN supports both. Pick one deliberately, open the same protocol and port in every firewall layer, and change both server and client together. Do not switch transports to solve a routing problem; transport selection cannot repair a missing return route.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
VPS-only tunnel or gateway for a whole network?
| Requirement | VPS endpoint | Dedicated router or gateway |
|---|---|---|
| Scope | One VPS or a small segment. | Entire private network or multiple workloads. |
| Operations | Fewer components, but VPN configuration lives with the workload. | Centralized policy and routing, with another system to patch and monitor. |
| Failover | Requires a second endpoint and route strategy if the VPS fails. | Can be designed as a redundant pair. |
| Route control | Simple when both VPSs own their routes. | Better when upstream routers must advertise or enforce network-wide paths. |
Practical decision checklist
- Are all tunnel and private CIDRs unique and non-overlapping?
- Does each peer have its own valid certificate and protected private key?
- Is the listener allowed in both the provider security group and host firewall?
- Is forwarding enabled on every gateway?
- Do both sides have reciprocal routes, including the destination host’s return path?
- Are only required subnets and application ports permitted?
- Have you tested the tunnel, a private host, and the real service in both directions?
- Can packet captures identify whether a future failure is at the listener, tunnel, route, firewall, or destination?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
