Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →To configure OpenVPN on a server you control, start with OpenVPN Community’s sample server and client files, then adapt the certificates, network ranges, firewall, forwarding, and NAT to your environment. The standard example creates a routed TUN VPN over UDP port 1194 and assigns clients from 10.8.0.0/24. A client configuration must point to your server’s public hostname or address and to a port that is reachable from the internet.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
The sample is a foundation, not a drop-in production deployment. You still need a certificate authority and client/server certificates, a reachable listener, non-overlapping IP ranges, and routing rules for any private LAN you want to expose.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What this configuration creates
OpenVPN’s server helper expands into TLS server mode, tunnel addressing, a client allocation pool, and routes for the VPN network. In the common sample, the server listens on UDP 1194, creates a layer-3 TUN interface, and allocates addresses from 10.8.0.0/24.
The official guide describes its sample as “an ideal starting point for an OpenVPN server configuration.” Treat each value as an example: choose ranges that do not overlap the physical LAN at the server, any remote client network, or another VPN.
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Prerequisites
- A server with a stable private address and a public hostname or public IP that clients can resolve.
- OpenVPN installed for the server’s operating system.
- A certificate authority, one server certificate and key, and at least one client certificate and key. Keep private keys readable only by the account or service that needs them.
- Permission to open the selected UDP port in the host firewall and, when applicable, in a cloud security group or edge firewall.
- IP forwarding and, if clients must reach the internet or a private LAN through the server, appropriate firewall and NAT rules.
Server configuration example
Save a copy of your distribution’s sample server configuration and edit it rather than inventing every directive from scratch. The following is an illustrative skeleton; paths and service names differ between operating systems.
# server.conf (illustrative skeleton)
port 1194
proto udp
dev tun
server 10.8.0.0 255.255.255.0
topology subnet
ca ca.crt
cert server.crt
key server.key
tls-crypt tls-crypt.key
push "route 192.168.1.0 255.255.255.0"
client-config-dir /etc/openvpn/ccd
persist-key
persist-tun
user nobody
group nogroupReplace the certificate filenames with the files created for your deployment. The example assumes that the server-side LAN is 192.168.1.0/24; change that route if your LAN uses another range, and remove it if clients should not reach a server-side LAN.
What each important directive does
| Directive | Example | Purpose and decisions |
|---|---|---|
port |
1194 |
The UDP listening port used by this example. You may choose another port, but the client, firewall, and any port-forwarding rule must agree. |
proto |
udp |
UDP is the transport in the sample. TCP can be justified by a restrictive network, but it is a different deployment choice and must be configured consistently at both ends. |
dev tun |
tun |
Creates a routed layer-3 tunnel rather than an Ethernet bridge. |
server |
10.8.0.0 255.255.255.0 |
Defines the VPN network and dynamic client allocation pool. |
topology |
subnet |
Uses conventional subnet addressing and is the preferred mode when no obsolete Windows OpenVPN 2.0.9 clients must connect. |
ca, cert, key |
Certificate paths | Authenticate the server and establish the TLS identity used by clients. |
tls-crypt |
tls-crypt.key |
Protects the control channel with a shared key. The matching key must be present in every authorized client profile. |
push "route ..." |
192.168.1.0/24 equivalent |
Instructs clients how to reach a network located behind the VPN server. |
client-config-dir |
/etc/openvpn/ccd |
Enables per-client files for fixed addresses and networks located behind individual clients. |
persist-key and persist-tun |
Enabled | Keep the key and tunnel state across a restart where the platform supports it. |
user and group |
nobody, nogroup |
Drop service privileges after startup when those accounts exist on the host. Use the account names supplied by your operating system. |
Make the listener reachable
- Allow UDP 1194 (or your chosen port) in the server’s local firewall.
- If the server is behind a NAT gateway, forward that UDP port from the gateway’s public address to the server’s private address. A public DNS name should resolve to the gateway’s current public address.
- Permit forwarding between the TUN interface and the networks you intend to serve. A successful TLS connection does not automatically grant access to a LAN.
- Enable IP forwarding on the host when it must pass packets between VPN clients and another interface. Add source NAT (masquerading) only where the receiving network has no return route to the VPN pool; otherwise a routed return path is usually easier to audit.
Do not assume that opening the VPN port also opens a home LAN. The server firewall must allow the desired source and destination ranges, and the LAN’s gateway must know how to return traffic to 10.8.0.0/24 (or apply NAT).
Rank #2
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Client configuration example
Each device needs a profile containing its client certificate and key, the CA certificate, and the same tls-crypt key used by the server. The remote line is the public endpoint that the device can actually reach, not the server’s private address.
# client.ovpn (illustrative skeleton)
client
dev tun
proto udp
remote vpn.example.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
ca ca.crt
cert client1.crt
key client1.key
tls-crypt tls-crypt.keyClient values that commonly break connections
remote: Use your public DNS name or public IP and the externally forwarded port. If DNS changes, use a hostname that tracks the address.protoand port: They must match the listener and every firewall or NAT rule along the path.- Certificate files: The client certificate and private key must belong to that client, while the CA and
tls-cryptfiles must match the server’s trust configuration. remote-cert-tls server: Keep server-certificate verification enabled; do not replace it with a setting that blindly accepts any certificate.
Distribute profiles through a protected channel. A client private key is an identity credential: revoke and replace it if the device is lost or the file is exposed.
Routing a home LAN behind the OpenVPN server
For a LAN physically attached to the VPN server, push a route to every client that should use it. In the example, push "route 192.168.1.0 255.255.255.0" tells clients to send that destination through the VPN interface. The server still needs forwarding and a return path, as described above.
Rank #3
- 【DUAL BAND AX TRAVEL ROUTER】Products with US, UK, EU Plug; Dual band network with wireless speed 574Mbps (2.4G)+2402Mbps (5G); 2.5G Multi-gigabit WAN port and a 1G gigabit LAN port; USB 3.0 port; Wi-Fi 6 offers more than double the total Wi-Fi speed with the MT3000 VPN Router.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Beryl AX automatically encrypts all network traffic within the connected network. Max. VPN speed of 150 Mbps (OpenVPN); 300 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【OpenWrt 21.02 FIRMWARE】The Beryl AX is a portable wifi box and mini router that runs on OpenWrt 21.02 firmware. It supports more than 5,000 ready-made plug-ins for customization. Simply browse, install, and manage packages with our no-code interface within Beryl AX's Admin Panel.
- 【PROTECT YOUR NETWORK SECURITY】Our pocket wifi, unlike other vulnerable portable wifi hotspot for travel purposes supports WPA3 protocol–Preventive measures against password brute-force attacks; DNS over HTTPS & DNS over TLS–Protecting domain name system traffic and preventing data eavesdropping from malicious parties; IPv6–Built-in authentication for privacy protection, eliminating the need for network address translation.
- 【VPN CASCADING AT EASE】Surpassing the mediocre performance of most VPN routers for home usage, the Beryl AX is capable of hosting a VPN server and VPN client at the same time within the same device, enabling users to remote access local network resources like Wi-Fi printers or local web servers, and accessing the public internet as a VPN client simultaneously.
Routing a network behind one VPN client
A different arrangement is a remote home or office LAN behind a particular client. It requires two complementary declarations:
- A main-server
routetells the server operating system that the destination network belongs in the VPN routing table. - An
iroutein that client’s connection-specific directory (CCD) file tells OpenVPN which connected client owns the destination.
For a remote LAN of 10.20.0.0/24 behind client client1, add the following to the main server configuration:
client-config-dir /etc/openvpn/ccd
route 10.20.0.0 255.255.255.0Create a file named exactly for that client’s certificate common name, such as /etc/openvpn/ccd/client1:
Rank #4
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
ifconfig-push 10.8.0.10 255.255.255.0
iroute 10.20.0.0 255.255.255.0ifconfig-push gives that client a predictable VPN address. The iroute associates the remote subnet with the client’s tunnel. The remote LAN itself must route return traffic to the client device, or the client must perform NAT for that LAN. The client device also needs forwarding enabled between its VPN interface and the home-LAN interface.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesAvoid overlapping networks
Do not use the same range for the VPN pool and a physical LAN. For example, a VPN pool of 10.8.0.0/24 cannot safely serve a client whose local LAN is also 10.8.0.0/24. Overlap makes route selection ambiguous and can send packets to the wrong interface. Check every site, including networks used by traveling clients, before choosing the pool.
Choosing subnet or net30 topology
Topology affects client compatibility and address behavior. Subnet mode uses a conventional shared subnet mask and is recommended for current clients when legacy Windows compatibility is not required.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
| Choice | Address behavior | Use it when | Trade-off |
|---|---|---|---|
topology subnet |
Clients participate in the VPN subnet defined by server; static assignments use the subnet mask shown in the CCD example. |
You control the client versions and they support modern subnet topology. | Older clients that only understand net30 may fail or behave unexpectedly. |
| net30 compatibility | Older OpenVPN behavior allocates point-to-point address pairs rather than a conventional shared subnet. | You must support legacy Windows OpenVPN 2.0.9-era clients. | Addressing and static assignments are less intuitive; test every client profile and document the compatibility requirement. |
Do not mix assumptions from the two modes. If legacy support is mandatory, select and test the corresponding topology before assigning fixed addresses or documenting routes.
Selected routes versus sending all traffic
The LAN route shown above is split routing: only the stated destination uses the VPN. It limits exposure and preserves the client’s normal internet path. A full-tunnel policy sends general internet traffic through the server and therefore requires deliberate egress firewall rules, NAT, DNS handling, and capacity planning. Add that policy only when you have decided which traffic should leave through the server; do not infer full tunneling from a single LAN route.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Validation and troubleshooting
Test in layers so a failure has a clear cause.
- Listener: Confirm that OpenVPN starts without certificate, key, or syntax errors and is listening on the configured protocol and port.
- Reachability: From an outside network, verify that the public hostname resolves correctly and that the forwarded port reaches the VPN host. Check both the gateway and host firewalls.
- TLS authentication: A failed handshake usually points to an incorrect CA, client certificate, private key,
tls-cryptkey, hostname, or clock. Replace files from a known-good enrollment rather than weakening certificate checks. - Address assignment: After connection, confirm the client receives an address from the selected VPN pool, or the CCD address intended for that certificate.
- Server-side LAN: Test the pushed LAN route, then inspect forwarding and the LAN gateway’s return route. A connected tunnel with no LAN response is normally a routing or firewall problem.
- Client-side LAN: Check the main-server
route, the matching CCDiroute, the client’s forwarding, and the remote LAN’s return path. The CCD filename must match the certificate identity exactly. - Compatibility: If only old Windows clients fail, verify whether they require net30 behavior and test with a topology they support.
Common symptoms and fixes
| Symptom | Likely cause | Check |
|---|---|---|
| No connection attempt reaches the server | Wrong public endpoint, missing port forwarding, or blocked UDP port | remote, gateway forwarding, cloud rules, and host firewall |
| TLS handshake fails | Certificate, key, CA, or tls-crypt mismatch |
Use the matching files for this server and client; keep certificate verification enabled |
| VPN connects but server LAN is unreachable | Missing pushed route, forwarding rule, or return route | Inspect the client route table and both firewalls |
| Remote client LAN is unreachable | Missing route, iroute, or remote-side forwarding |
Compare the main configuration and the client’s CCD file |
| Intermittent or incorrect destinations | Overlapping VPN and physical LAN ranges | Renumber one network so every routed subnet is unique |
| Legacy client cannot establish usable addressing | Topology mismatch | Use subnet for modern clients or document and test net30 compatibility where required |
Operational checklist before inviting users
- Use unique client certificates and revoke credentials for retired or lost devices.
- Restrict private-key file permissions and protect exported
.ovpnprofiles. - Record the VPN pool, every LAN route, each CCD assignment, and the topology selected.
- Reserve non-overlapping ranges for future sites and roaming clients.
- Apply least-privilege firewall rules instead of allowing the VPN to reach every internal service.
- Back up the certificate authority and server configuration securely, separately from ordinary user files.
- After any change, test one modern client, one legacy client if you support them, a server-side LAN path, and a client-side LAN path.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
