In today's digital world, privacy and security are more important than ever. A Virtual Private Network (VPN) is one of the best ways to encrypt your internet traffic, protect sensitive data, and bypass geo-restrictions. While many commercial VPN services are available, setting up your own VPN on a Linux VPS provides greater control, security, and flexibility.

If you own a VPS, you can configure a VPN to ensure safe browsing and secure remote access to your server. Whether you are a remote worker, business owner, or privacy-conscious individual, running your own VPN eliminates third-party risks and enhances online anonymity.

In this guide, we will walk you through the step-by-step process of setting up and configuring a VPN on a Linux VPS. We’ll explore OpenVPN and WireGuard, two of the most popular VPN solutions, and help you secure your VPS efficiently.

Why Set Up Your Own VPN on a Linux VPS?

Here are some key benefits of setting up a VPN on your Linux VPS:

✅ Enhanced Privacy & Security – Encrypts your internet connection, keeping your data safe from hackers and surveillance.
✅ Bypass Geo-Restrictions – Access blocked websites and services from anywhere in the world.
✅ Remote Access – Securely connect to your VPS from any device, anywhere.
✅ No Third-Party Involvement – Unlike commercial VPNs, you control your own data, eliminating privacy concerns.
✅ Cost-Effective – Hosting your own VPN is cheaper than most premium VPN services.

Here's the next section of your article:

Prerequisites

Before setting up a VPN on your Linux VPS, ensure you have the following:

1. A Linux VPS

You need a Linux-based VPS with root or sudo access. You can use Ubuntu, Debian, or CentOS, but for this guide, we’ll primarily focus on Ubuntu as it’s widely used and well-supported.

If you don’t have a VPS yet, check out 99RDP for reliable Linux VPS hosting with high-speed performance, full root access, and competitive pricing.

2. SSH Access to Your VPS

You'll need SSH access to your VPS to install and configure the VPN. If you're using Windows, you can use PuTTY, while Linux and macOS users can use the built-in Terminal:

ssh root@your-vps-ip

Replace your-vps-ip with your actual VPS IP address.

3. A Static IP or Domain (Optional)

While a static IP is not mandatory, it makes accessing your VPN easier. If your VPS provider gives you a dedicated IP, it’s an advantage. Alternatively, you can set up a domain name (DNS) to point to your VPS for easier access.

4. Basic Linux Command Knowledge

Familiarity with Linux commands will help you navigate the setup process smoothly. You don’t need to be an expert, but basic commands like apt update, cd, and nano will be helpful.

5. Firewall Configuration

Your VPS may have a firewall enabled. Ensure ports required for your VPN are open:

OpenVPN: Uses port 1194 (UDP by default)
WireGuard: Uses port 51820 (UDP)

You can check your firewall status using:

sudo ufw status

If UFW (Uncomplicated Firewall) is active, allow the VPN ports:

sudo ufw allow 1194/udp  # For OpenVPN
sudo ufw allow 51820/udp  # For WireGuard

Now that we have everything ready, let’s move on to choosing the right VPN solution for your Linux VPS. 🚀

Here's the next section of your article:

Choosing a VPN Solution

Before setting up your VPN on a Linux VPS, you need to choose the right VPN solution. There are multiple options available, but the two most popular and widely used VPN protocols are OpenVPN and WireGuard.

Below is a comparison of these two VPN solutions to help you decide which one fits your needs.

1. OpenVPN: A Reliable and Well-Established Choice

OpenVPN is one of the most trusted VPN solutions, known for its security, flexibility, and wide compatibility.

🔹 Pros:
✅ Strong encryption and security (AES-256-bit encryption)
✅ Works with UDP & TCP, making it adaptable to different network conditions
✅ Supported on almost all platforms (Windows, Linux, macOS, Android, iOS, and routers)
✅ Can bypass firewalls and Deep Packet Inspection (DPI) with custom configurations

🔹 Cons:
❌ Slightly more complex setup compared to WireGuard
❌ Slower performance due to overhead from encryption

2. WireGuard: A Faster and Simpler Alternative

WireGuard is a modern VPN protocol that focuses on speed, efficiency, and ease of configuration. It uses advanced cryptographic techniques while maintaining a lightweight codebase.

🔹 Pros:
✅ Faster than OpenVPN due to minimal overhead
✅ Simpler and more efficient codebase (easier to audit and maintain)
✅ Uses cutting-edge cryptography for security
✅ Easy to configure and deploy

🔹 Cons:
❌ Still under development; not as battle-tested as OpenVPN
❌ Limited support on older devices and routers

Which VPN Should You Choose?

Choose OpenVPN if you need broad compatibility and a time-tested, reliable VPN that works in almost any environment.
Choose WireGuard if you prioritize speed, efficiency, and a modern, lightweight VPN setup.

For this guide, we will provide installation and configuration steps for both OpenVPN and WireGuard so that you can choose the best option for your needs.

Now that you've chosen your VPN, let's move on to setting up your Linux VPS for VPN installation. 🚀

Setting Up Your Linux VPS for VPN Installation

Before installing and configuring your VPN, it’s essential to prepare your Linux VPS to ensure a smooth setup. Follow these steps to update your system, configure the firewall, and enable IP forwarding for VPN functionality.

Step 1: Update System Packages

First, update your system’s package list and upgrade existing packages to ensure you have the latest security patches.

For Debian/Ubuntu, run:

sudo apt update && sudo apt upgrade -y

For CentOS/RHEL, use:

sudo yum update -y

Step 2: Install Required Dependencies

Most VPN solutions require some additional packages. Install them using the following command:

For Ubuntu/Debian, install essential networking tools:

sudo apt install -y curl wget nano ufw

For CentOS, use:

sudo yum install -y epel-release curl wget nano firewalld

Step 3: Configure Firewall (UFW or Firewalld)

Firewalls play a crucial role in securing your VPS. Ensure the necessary ports are open for the VPN service.

For Ubuntu/Debian (UFW)

Enable UFW and allow VPN traffic:

sudo ufw allow OpenSSH
sudo ufw allow 1194/udp  # OpenVPN
sudo ufw allow 51820/udp  # WireGuard
sudo ufw enable

For CentOS (Firewalld)

Enable the firewall and open VPN ports:

sudo systemctl start firewalld
sudo systemctl enable firewalld
sudo firewall-cmd --add-service=ssh --permanent
sudo firewall-cmd --add-port=1194/udp --permanent  # OpenVPN
sudo firewall-cmd --add-port=51820/udp --permanent  # WireGuard
sudo firewall-cmd --reload

Step 4: Enable IP Forwarding

To allow traffic to pass through the VPN, IP forwarding must be enabled.

1️⃣ Open the sysctl configuration file:

sudo nano /etc/sysctl.conf

2️⃣ Find the following line and uncomment (remove the # symbol) or add it if missing:

net.ipv4.ip_forward=1

3️⃣ Save the file (CTRL + X, then Y, then Enter).

4️⃣ Apply the changes:

sudo sysctl -p

Step 5: Reboot Your VPS

To ensure all updates and configurations take effect, reboot your VPS:

sudo reboot

Installing and Configuring OpenVPN on a Linux VPS

Now that your Linux VPS is set up, it’s time to install and configure OpenVPN, one of the most widely used VPN solutions. OpenVPN provides strong encryption, stability, and flexibility across multiple platforms.

Step 1: Install OpenVPN and Easy-RSA

OpenVPN requires Easy-RSA, a tool for generating encryption keys and certificates.

For Ubuntu/Debian

Run the following command to install OpenVPN and Easy-RSA:

sudo apt update
sudo apt install -y openvpn easy-rsa

For CentOS/RHEL

Enable the EPEL repository and install OpenVPN:

sudo yum install -y epel-release
sudo yum install -y openvpn easy-rsa

Step 2: Set Up the OpenVPN Server

Copy the OpenVPN example configuration file:

sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/server.conf

Now, open the file for editing:

sudo nano /etc/openvpn/server.conf

Find and modify these key settings:

Uncomment (remove ;) or add these lines:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
cipher AES-256-CBC
auth SHA256
keepalive 10 120
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 3

Save and exit (CTRL + X, then Y, then Enter).

Step 3: Generate Encryption Keys and Certificates

Navigate to the Easy-RSA directory:

make-cadir ~/openvpn-ca
cd ~/openvpn-ca

Initialize the Public Key Infrastructure (PKI):

./easyrsa init-pki

Build the Certificate Authority (CA):

./easyrsa build-ca

You will be prompted to enter a Common Name (CN); you can set it to MyVPN.

Generate the server certificate and key:

./easyrsa build-server-full server nopass

Generate the Diffie-Hellman key exchange:

./easyrsa gen-dh

Move the generated keys to the OpenVPN directory:

sudo cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem /etc/openvpn/

Step 4: Enable and Start OpenVPN

Enable OpenVPN to start at boot:

sudo systemctl enable openvpn@server

Start the OpenVPN service:

sudo systemctl start openvpn@server

Check if OpenVPN is running:

sudo systemctl status openvpn@server

Step 5: Configure Firewall and IP Forwarding

To allow VPN traffic, configure iptables:

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

To make this rule permanent, save it:

sudo iptables-save > /etc/iptables.rules

Step 6: Create VPN Client Configuration File

To connect a client (Windows, macOS, or mobile device), generate a client configuration file:

sudo nano /etc/openvpn/client.ovpn

Add the following configuration:

client
dev tun
proto udp
remote your-vps-ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
cipher AES-256-CBC
auth SHA256
comp-lzo
verb 3

Replace your-vps-ip with your actual VPS IP address.

Download this .ovpn file to your client device and use OpenVPN Client to connect.

Testing Your OpenVPN Connection

To verify if your VPN is working, connect your client and check your IP address:

curl ifconfig.me

If the output shows your VPS IP instead of your actual IP, your VPN is working! 🎉

Here's the next section of your article, covering Installing and Configuring WireGuard on a Linux VPS:

Installing and Configuring WireGuard on a Linux VPS

If you prefer a modern, fast, and lightweight VPN, WireGuard is an excellent choice. It is easier to configure than OpenVPN and provides better performance and security. In this section, we’ll go through the installation and setup process for WireGuard on a Linux VPS.

Step 1: Install WireGuard

For Ubuntu/Debian

Run the following command to install WireGuard:

sudo apt update
sudo apt install -y wireguard

For CentOS/RHEL

Enable the EPEL repository and install WireGuard:

sudo yum install -y epel-release
sudo yum install -y wireguard-tools

Step 2: Generate WireGuard Keys

WireGuard uses public and private keys for authentication. Generate these keys with:

wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey

View your private key:

cat /etc/wireguard/privatekey

View your public key:

cat /etc/wireguard/publickey

Step 3: Configure the WireGuard Server

Create a new WireGuard configuration file:

sudo nano /etc/wireguard/wg0.conf

Add the following configuration:

[Interface]
PrivateKey = YOUR_SERVER_PRIVATE_KEY
Address = 10.0.0.1/24
ListenPort = 51820
SaveConfig = true
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Replace YOUR_SERVER_PRIVATE_KEY with the output of cat /etc/wireguard/privatekey.

Save and exit (CTRL + X, then Y, then Enter).

Step 4: Enable IP Forwarding

Ensure traffic forwarding is enabled by modifying sysctl settings:

sudo nano /etc/sysctl.conf

Find and uncomment (or add) the following line:

net.ipv4.ip_forward=1

Apply the changes:

sudo sysctl -p

Step 5: Start and Enable WireGuard

Start the WireGuard VPN service:

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Check if WireGuard is running properly:

sudo systemctl status wg-quick@wg0

If everything is set up correctly, you should see that WireGuard is active and running.

Step 6: Configure WireGuard Clients

For a client to connect, it needs a public-private key pair. Generate client keys:

wg genkey | tee /etc/wireguard/client_privatekey | wg pubkey > /etc/wireguard/client_publickey

Retrieve the keys:

cat /etc/wireguard/client_privatekey
cat /etc/wireguard/client_publickey

Now, edit the server configuration to add a new peer:

sudo nano /etc/wireguard/wg0.conf

Add this section at the end of the file:

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

Replace CLIENT_PUBLIC_KEY with the key generated for the client (cat /etc/wireguard/client_publickey).

Restart WireGuard for the changes to take effect:

sudo systemctl restart wg-quick@wg0

Step 7: Create Client Configuration File

On the client device, create a WireGuard config file (client.conf):

[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Replace:

CLIENT_PRIVATE_KEY with cat /etc/wireguard/client_privatekey
SERVER_PUBLIC_KEY with cat /etc/wireguard/publickey
YOUR_VPS_IP with your VPS’s public IP address

Save the file and use the WireGuard client (available for Windows, macOS, Linux, Android, and iOS) to import the configuration and connect.

Step 8: Testing Your WireGuard VPN

To verify if the VPN is working, connect and check your IP address:

curl ifconfig.me

If the output shows your VPS IP instead of your real IP, your WireGuard VPN is successfully configured! 🎉

OpenVPN vs. WireGuard: Which One Should You Use?

Choose OpenVPN if you need compatibility with older devices and a more established solution.
Choose WireGuard if you prioritize speed, simplicity, and modern encryption.

Both VPNs are excellent, and 99RDP offers high-performance Linux VPS that can efficiently run either of them.

Troubleshooting and Securing Your VPN on a Linux VPS

Once you’ve set up OpenVPN or WireGuard on your Linux VPS, it’s crucial to troubleshoot common issues and enhance security for optimal performance and protection.

Common VPN Issues and Fixes

1. VPN Not Connecting

Possible Causes & Solutions:
🔹 Firewall is blocking the VPN port

Ensure the correct ports are open:

sudo ufw allow 1194/udp  # For OpenVPN
sudo ufw allow 51820/udp  # For WireGuard
sudo ufw enable

For CentOS, check Firewalld:

sudo firewall-cmd --add-port=1194/udp --permanent
sudo firewall-cmd --add-port=51820/udp --permanent
sudo firewall-cmd --reload

🔹 Service is not running

Check the VPN service status:

sudo systemctl status openvpn@server  # For OpenVPN
sudo systemctl status wg-quick@wg0  # For WireGuard

If it's inactive, restart it:

sudo systemctl restart openvpn@server
sudo systemctl restart wg-quick@wg0

2. VPN Connects, But No Internet Access

Possible Causes & Solutions:
🔹 IP forwarding is disabled

Ensure it’s enabled:

sudo nano /etc/sysctl.conf

Make sure this line is present and uncommented:

net.ipv4.ip_forward=1

Apply the changes:

sudo sysctl -p

🔹 Missing NAT rules (for OpenVPN/WireGuard)

Add the correct iptables rule:

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE  # OpenVPN
sudo iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE  # WireGuard

Save the rule permanently:

sudo iptables-save > /etc/iptables.rules

3. VPN Speed is Slow

Possible Causes & Solutions:
🔹 High encryption overhead (OpenVPN)

Reduce encryption overhead by using UDP instead of TCP:

proto udp

Use optimized cipher settings:

cipher AES-256-GCM

🔹 High latency due to server location

Choose a VPS closer to your location for better speed.
Consider a high-performance Linux VPS from 99RDP with optimized networking.

🔹 Network congestion

Use WireGuard, which has lower overhead and faster performance compared to OpenVPN.

Enhancing VPN Security

Once your VPN is running, securing it is essential to prevent attacks and unauthorized access.

1. Use Strong Encryption and Authentication

For OpenVPN, edit /etc/openvpn/server.conf and set:

cipher AES-256-GCM
auth SHA512
tls-auth ta.key 0

For WireGuard, ensure you’re using modern cryptography (default settings are secure).

2. Enable Fail2Ban to Prevent Brute-Force Attacks

Fail2Ban helps block repeated failed login attempts.

Install it on Ubuntu/Debian:

sudo apt install fail2ban -y

Create a new filter for OpenVPN:

sudo nano /etc/fail2ban/filter.d/openvpn.conf

Add the following content:

[Definition]
failregex = TLS Auth Error
            TLS Error: incoming packet authentication failed
            Authenticate/Decrypt packet error
ignoreregex =

Save and exit, then create a jail configuration file:

sudo nano /etc/fail2ban/jail.local

Add:

[openvpn]
enabled = true
port = 1194
protocol = udp
filter = openvpn
logpath = /var/log/openvpn.log
maxretry = 5

Restart Fail2Ban:

sudo systemctl restart fail2ban

3. Disable Root Login for SSH

To prevent unauthorized SSH access, disable root login:

sudo nano /etc/ssh/sshd_config

Find and change:

PermitRootLogin no

Restart SSH:

sudo systemctl restart ssh

4. Set Up Automatic Security Updates

Enable automatic updates on Ubuntu/Debian:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure unattended-upgrades

For CentOS/RHEL:

sudo yum install yum-cron -y
sudo systemctl enable --now yum-cron

Next Steps

Now that your VPN is troubleshooting-ready and secured, you can:

✅ Automate VPN Start on Reboot (to ensure your VPN runs after a server restart)

Automating VPN Start on Reboot

After setting up OpenVPN or WireGuard, you need to ensure that the VPN service automatically starts on reboot. This is crucial for uninterrupted connectivity, especially if your VPS restarts due to maintenance or unexpected shutdowns.

Step 1: Enable VPN Service on Boot

For OpenVPN

Enable OpenVPN to start automatically at boot:

sudo systemctl enable openvpn@server

Check if it’s enabled correctly:

sudo systemctl is-enabled openvpn@server

To manually restart OpenVPN after a reboot, run:

sudo systemctl restart openvpn@server

For WireGuard

Enable WireGuard to start on reboot:

sudo systemctl enable wg-quick@wg0

Verify it’s enabled:

sudo systemctl is-enabled wg-quick@wg0

Restart WireGuard manually if needed:

sudo systemctl restart wg-quick@wg0

Step 2: Check VPN Status After Reboot

After rebooting your VPS, check if the VPN is running:

For OpenVPN:

sudo systemctl status openvpn@server

For WireGuard:

sudo systemctl status wg-quick@wg0

If the service is inactive, manually start it:

sudo systemctl start openvpn@server  # OpenVPN
sudo systemctl start wg-quick@wg0  # WireGuard

Step 3: Automatically Reconnect Clients

If your VPN disconnects after a server restart, configure your client devices to automatically reconnect.

For OpenVPN clients (Windows, Linux, macOS):

Edit the .ovpn client configuration file and add:
```
keepalive 10 120
auth-retry nointeract
```
On Windows, configure OpenVPN GUI to run on startup:
1. Open Task Scheduler → Create Task
2. Select Run with highest privileges
3. Add OpenVPN executable under Actions → Start a Program

For WireGuard clients (Windows, Linux, macOS, Android, iOS):

Enable automatic connection in the WireGuard app settings.

Step 4: Monitor VPN Connectivity with a Cron Job

To ensure your VPN remains active, you can set up a cron job that periodically checks if the VPN is running and restarts it if necessary.

1️⃣ Open the cron job editor:

sudo crontab -e

2️⃣ Add this line to check OpenVPN every minute and restart it if needed:

* * * * * systemctl is-active --quiet openvpn@server || systemctl restart openvpn@server

For WireGuard, use:

* * * * * systemctl is-active --quiet wg-quick@wg0 || systemctl restart wg-quick@wg0

3️⃣ Save and exit. This ensures that if your VPN stops running, it will automatically restart.

Step 5: Test Automatic VPN Startup

To verify that your VPN starts on boot:

Reboot your VPS:
```
sudo reboot
```

Once the VPS restarts, check if the VPN is running:

sudo systemctl status openvpn@server  # OpenVPN
sudo systemctl status wg-quick@wg0  # WireGuard

If the VPN is active, your auto-start setup is working correctly! 🎉

Next Steps

Now that your VPN is automated and resilient, you can:

✅ Optimize VPN Performance (Compression, DNS, Split Tunneling, etc.)
✅ Set Up a VPN Kill Switch to Prevent Leaks
✅ Configure Multi-User Access for Teams

Optimizing VPN Performance: Speed, Compression, and DNS Settings

After setting up your VPN on a Linux VPS, optimizing its performance is crucial for better speed, reduced latency, and improved stability. Here are some key optimizations for OpenVPN and WireGuard.

1. Using UDP Instead of TCP for Faster Speeds

UDP is generally faster than TCP because it has less overhead and is better suited for VPN traffic.

For OpenVPN

Edit your OpenVPN server configuration file:

sudo nano /etc/openvpn/server.conf

Find the proto line and ensure it is set to UDP:

proto udp

Save the file and restart OpenVPN:

sudo systemctl restart openvpn@server

For WireGuard

WireGuard only uses UDP by default, so no changes are needed.2. Enabling Compression for Faster Data Transfer

If you are dealing with high-bandwidth applications like video streaming or file transfers, enabling compression can help reduce data size.

For OpenVPN

Enable compression by adding the following line in /etc/openvpn/server.conf:

comp-lzo

Restart OpenVPN:

sudo systemctl restart openvpn@server

⚠ Note: WireGuard does not support compression as it prioritizes security over performance.

3. Using a Fast and Secure DNS Provider

To prevent DNS leaks and improve resolution times, configure your VPN clients to use a fast, privacy-focused DNS.

For OpenVPN

Edit your OpenVPN configuration file (server.conf) and add:

push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 9.9.9.9"

These are Cloudflare (1.1.1.1) and Quad9 (9.9.9.9) DNS services, which are fast and secure.

Restart OpenVPN:

sudo systemctl restart openvpn@server

For WireGuard

Modify the client configuration (client.conf) and add:

DNS = 1.1.1.1, 9.9.9.9

This ensures that your VPN clients use fast and secure DNS servers.

4. Enabling MTU Optimization to Reduce Latency

The Maximum Transmission Unit (MTU) determines the largest packet size your VPN can send. Incorrect MTU settings can cause slow speeds or fragmentation.

For OpenVPN

In /etc/openvpn/server.conf, add:

tun-mtu 1400
mssfix 1360

Restart OpenVPN:

sudo systemctl restart openvpn@server

For WireGuard

Modify the server and client configurations and add:

MTU = 1400

Then restart WireGuard:

sudo systemctl restart wg-quick@wg0

5. Enabling Multi-Threading for OpenVPN (AES-NI Support)

If your VPS has multiple CPU cores, enable AES-NI encryption acceleration to reduce CPU load and boost performance.

1️⃣ Install OpenSSL:

sudo apt install -y openssl

2️⃣ Modify OpenVPN’s configuration:

cipher AES-256-GCM
ncp-ciphers AES-256-GCM:AES-128-GCM

3️⃣ Restart OpenVPN:

sudo systemctl restart openvpn@server

WireGuard already optimizes encryption using ChaCha20 and does not need additional CPU tweaks.

6. Enabling Multi-User Access (Allowing More Clients to Connect)

If multiple users need access to the VPN, increase the number of concurrent connections.

For OpenVPN

Edit /etc/openvpn/server.conf and ensure you have:

max-clients 50

Restart OpenVPN:

sudo systemctl restart openvpn@server

For WireGuard

Add multiple client [Peer] sections in the server configuration (/etc/wireguard/wg0.conf):

[Peer]
PublicKey = CLIENT1_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

[Peer]
PublicKey = CLIENT2_PUBLIC_KEY
AllowedIPs = 10.0.0.3/32

Restart WireGuard:

sudo systemctl restart wg-quick@wg0

7. Using Split Tunneling to Route Only Specific Traffic Through the VPN

By default, all internet traffic is routed through the VPN. If you only want to tunnel specific applications or websites, use split tunneling.

For OpenVPN

In the client configuration file (client.ovpn), add:

route-nopull
route 192.168.1.0 255.255.255.0

This routes only 192.168.1.x traffic through the VPN while allowing direct internet access for other sites.

For WireGuard

Modify the client configuration (client.conf) to only send traffic for specific IPs:

AllowedIPs = 192.168.1.0/24

This ensures that only traffic destined for 192.168.1.x is routed through the VPN.

Next Steps

Now that your VPN is optimized for speed, efficiency, and security, you can:

✅ Set Up a VPN Kill Switch to Prevent Leaks
✅ Add Advanced Logging & Monitoring
✅ Configure VPN for Remote Work and Business Teams

How to Set Up a VPN Kill Switch to Prevent Leaks

A VPN Kill Switch ensures that if your VPN connection drops unexpectedly, your internet traffic will not be exposed. Without a kill switch, your real IP address and sensitive data could be leaked if the VPN disconnects.

1. Setting Up a Kill Switch for OpenVPN (Using UFW Firewall)

On Ubuntu/Debian, we can use UFW (Uncomplicated Firewall) to block all non-VPN traffic.

Step 1: Find Your Network Interface

Before configuring the firewall, find your network interface name:

ip route | grep default

You will see output like:

default via 192.168.1.1 dev eth0

In this case, eth0 is your network interface.

Step 2: Configure UFW Rules

Now, block all traffic except VPN traffic.

1️⃣ Allow VPN traffic through the firewall:

sudo ufw allow 1194/udp  # OpenVPN Port

2️⃣ Allow OpenVPN to access the internet:

sudo ufw allow out on tun0

3️⃣ Block all other outgoing traffic except OpenVPN:

sudo ufw default deny outgoing

4️⃣ Enable UFW to apply the rules:

sudo ufw enable

Step 3: Test the Kill Switch

Disconnect from OpenVPN and try accessing the internet.
If the kill switch is working, your connection should be blocked until the VPN reconnects.

2. Setting Up a Kill Switch for WireGuard (Using iptables)

For WireGuard, we’ll use iptables to ensure traffic only flows through the VPN tunnel.

Step 1: Get Your Network Interface

Run:

ip route | grep default

Look for your primary interface, e.g., eth0.

Step 2: Create Firewall Rules for WireGuard

1️⃣ Block all outgoing traffic:

sudo iptables -P OUTPUT DROP

2️⃣ Allow VPN traffic through the WireGuard interface (wg0):

sudo iptables -A OUTPUT -o wg0 -j ACCEPT

3️⃣ Allow local traffic (to avoid blocking system processes):

sudo iptables -A OUTPUT -d 127.0.0.1 -j ACCEPT

4️⃣ Allow DNS resolution:

sudo iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

5️⃣ Save the firewall rules permanently:

sudo iptables-save > /etc/iptables.rules

Step 3: Test the Kill Switch

Disconnect from WireGuard and try browsing the internet.
If the kill switch is working, all internet traffic should be blocked until you reconnect.

3. Making the Kill Switch Permanent (After Reboot)

After a VPS reboot, firewall rules may reset. To ensure the kill switch remains active:

For UFW (OpenVPN)

Enable UFW on startup:

sudo systemctl enable ufw

For iptables (WireGuard)

Restore the rules at startup by adding this to /etc/rc.local:

sudo nano /etc/rc.local

Add this line before exit 0:

iptables-restore < /etc/iptables.rules

Save and exit (CTRL + X, then Y, then Enter).

Make the file executable:

sudo chmod +x /etc/rc.local

4. Additional Kill Switch Protection for Clients

If you're using Windows, macOS, or Linux clients, you can enable the built-in kill switch in your OpenVPN or WireGuard apps.

For OpenVPN Clients

In the OpenVPN client settings:

Enable "Kill Switch" or "Block Internet if VPN Disconnects".

Alternatively, add the following to your OpenVPN client configuration (.ovpn file):

pull-filter ignore "redirect-gateway"
route 0.0.0.0 0.0.0.0 vpn_gateway

For WireGuard Clients

For Windows/macOS/Linux:

Use the built-in Kill Switch in the WireGuard GUI.
On Linux, modify your client configuration (client.conf):
```
AllowedIPs = 0.0.0.0/0, ::/0
```
This forces all traffic through the VPN.

Next Steps

Now that your VPN Kill Switch is enabled, you can:

✅ Set Up Advanced Logging & Monitoring
✅ Configure VPN for Remote Work and Teams
✅ Automate VPN Client Updates for Better Security

Advanced Logging & Monitoring for Your VPN

Once your VPN (OpenVPN or WireGuard) is up and running, monitoring its performance and security is crucial. Logging helps you:

✅ Detect unauthorized access attempts
✅ Troubleshoot connection issues
✅ Monitor VPN traffic and server health

1. Enabling Logging for OpenVPN

By default, OpenVPN logs basic connection information. You can enhance logging for better monitoring.

Step 1: Enable Detailed Logging

Edit the OpenVPN server configuration file:

sudo nano /etc/openvpn/server.conf

Find and modify the logging settings:

status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 3  # Set verbosity level (0-6, higher means more detailed logs)

Verbosity Levels:
- verb 0 – Silent (only fatal errors)
- verb 3 – Standard logs (recommended)
- verb 6 – Detailed debugging logs

Save and exit (CTRL + X, then Y, then Enter).

Restart OpenVPN to apply changes:

sudo systemctl restart openvpn@server

Step 2: View OpenVPN Logs

To check VPN connections and errors:

tail -f /var/log/openvpn.log

To list active clients:

cat /var/log/openvpn-status.log

2. Enabling Logging for WireGuard

WireGuard does not have built-in detailed logging, but you can enable systemd journal logs.

Step 1: Enable WireGuard Logging

Edit the WireGuard configuration file:

sudo nano /etc/wireguard/wg0.conf

Add the following under the [Interface] section:

LogLevel = info

Save and restart WireGuard:

sudo systemctl restart wg-quick@wg0

Step 2: View WireGuard Logs

To see real-time logs for WireGuard:

journalctl -u wg-quick@wg0 -f

3. Monitoring VPN Performance with vnStat

To track VPN bandwidth usage, install vnStat, a network monitoring tool.

Step 1: Install vnStat

For Ubuntu/Debian:

sudo apt install -y vnstat

For CentOS/RHEL:

sudo yum install -y vnstat

Start and enable vnStat:

sudo systemctl start vnstat
sudo systemctl enable vnstat

Step 2: Monitor VPN Traffic

To monitor traffic on your VPN interface:

For OpenVPN (tun0 interface):

vnstat -i tun0

For WireGuard (wg0 interface):

vnstat -i wg0

This will show bandwidth usage, speed, and historical data.

4. Setting Up Fail2Ban to Block Unauthorized VPN Access

Fail2Ban helps prevent brute-force attacks by blocking repeated failed login attempts.

Step 1: Install Fail2Ban

For Ubuntu/Debian:

sudo apt install fail2ban -y

For CentOS/RHEL:

sudo yum install fail2ban -y

Start and enable Fail2Ban:

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

Step 2: Create a Fail2Ban Filter for OpenVPN

Create a new file:

sudo nano /etc/fail2ban/filter.d/openvpn.conf

Add the following rules:

[Definition]
failregex = TLS Auth Error
            TLS Error: incoming packet authentication failed
            Authenticate/Decrypt packet error
ignoreregex =

Save and exit (CTRL + X, then Y, then Enter).

Step 3: Configure Fail2Ban to Protect OpenVPN

Edit the jail configuration file:

sudo nano /etc/fail2ban/jail.local

Add the following section:

[openvpn]
enabled = true
port = 1194
protocol = udp
filter = openvpn
logpath = /var/log/openvpn.log
maxretry = 5

Save and restart Fail2Ban:

sudo systemctl restart fail2ban

Step 4: Check if Fail2Ban is Working

To see banned IP addresses:

sudo fail2ban-client status openvpn

5. Setting Up Real-Time VPN Monitoring with Netdata

Netdata is a free, real-time monitoring tool for tracking CPU, memory, disk, and network usage.

Step 1: Install Netdata

For Ubuntu/Debian:

bash <(curl -Ss https://my-netdata.io/kickstart.sh)

For CentOS/RHEL:

sudo yum install epel-release -y
sudo yum install netdata -y

Step 2: Start and Enable Netdata

sudo systemctl start netdata
sudo systemctl enable netdata

Step 3: Access Netdata Dashboard

Open a web browser and go to:
```
http://your-vps-ip:19999
```
Here, you can monitor real-time CPU, network, and VPN performance.

Conclusion

Now your VPN is fully monitored and secured! 🎉

✅ Logging is enabled to track VPN activity
✅ Fail2Ban protects against unauthorized access
✅ vnStat and Netdata monitor VPN traffic and performance

Next Steps

✅ Configuring VPN for Remote Work & Team Access

Configuring VPN for Remote Work & Team Access

A VPN is a powerful tool for remote teams and businesses that need secure access to company resources. Configuring your OpenVPN or WireGuard to support multiple users ensures seamless collaboration while keeping data safe.

1. Setting Up Multiple Users for OpenVPN

By default, OpenVPN allows multiple users to connect, but each user should have a unique client profile for better security and tracking.

Step 1: Generate Additional User Certificates

1️⃣ Navigate to the Easy-RSA directory:

cd ~/openvpn-ca

2️⃣ Create a new user certificate (replace username1 with the actual username):

./easyrsa build-client-full username1 nopass

3️⃣ Copy the generated files to the OpenVPN directory:

sudo cp pki/issued/username1.crt pki/private/username1.key /etc/openvpn/

Step 2: Create a User-Specific Configuration File

1️⃣ Copy the base client configuration:

sudo cp /etc/openvpn/client.ovpn /etc/openvpn/clients/username1.ovpn

2️⃣ Open the client config file:

sudo nano /etc/openvpn/clients/username1.ovpn

3️⃣ Add the user's unique certificate details:

cert username1.crt
key username1.key

Save and exit (CTRL + X, then Y, then Enter).

Step 3: Distribute Client Files to Team Members

Send the username1.ovpn file to the respective user. They can import it into an OpenVPN client on Windows, macOS, Linux, or mobile devices.

2. Setting Up Multiple Users for WireGuard

Each user connecting to WireGuard needs a unique public-private key pair.

Step 1: Generate a New Key Pair for Each User

1️⃣ Generate keys for a new user (replace user1 with actual username):

wg genkey | tee /etc/wireguard/user1_privatekey | wg pubkey > /etc/wireguard/user1_publickey

2️⃣ Retrieve the keys:

cat /etc/wireguard/user1_privatekey
cat /etc/wireguard/user1_publickey

Step 2: Add the New User to the Server Configuration

Edit the WireGuard server config:

sudo nano /etc/wireguard/wg0.conf

Add a new peer section:

[Peer]
PublicKey = USER1_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

Replace USER1_PUBLIC_KEY with the key from cat /etc/wireguard/user1_publickey.

Step 3: Create a Client Configuration File for the User

On the client’s machine, create a new configuration file (user1.conf):

[Interface]
PrivateKey = USER1_PRIVATE_KEY
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = YOUR_VPS_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Replace:

USER1_PRIVATE_KEY with the output from cat /etc/wireguard/user1_privatekey
SERVER_PUBLIC_KEY with the WireGuard server's public key
YOUR_VPS_IP with the VPS IP address

Step 4: Restart WireGuard for the Changes to Take Effect

sudo systemctl restart wg-quick@wg0

Step 5: Distribute Client Configurations

Share the user1.conf file with the team member, and they can import it into the WireGuard client.

3. Restricting and Monitoring Team Access

For businesses handling sensitive data, it’s important to restrict access based on user roles.

Restrict Access by User in OpenVPN

1️⃣ Edit the OpenVPN server configuration:

sudo nano /etc/openvpn/server.conf

2️⃣ Add the following line:

client-config-dir /etc/openvpn/clients/

3️⃣ Create a directory for per-user configurations:

sudo mkdir -p /etc/openvpn/clients/

4️⃣ Create a user-specific rule file (username1 as an example):

sudo nano /etc/openvpn/clients/username1

5️⃣ Define IP restrictions:

ifconfig-push 10.8.0.10 255.255.255.0

Save and restart OpenVPN:

sudo systemctl restart openvpn@server

Restrict Access in WireGuard

1️⃣ Instead of allowing all traffic (0.0.0.0/0), restrict AllowedIPs for specific users:

AllowedIPs = 192.168.1.0/24

This ensures only company-related traffic is sent through the VPN.

4. Enforcing VPN Usage for Remote Employees

To prevent employees from accessing company resources without the VPN, enforce firewall rules:

For OpenVPN

Block direct SSH access and allow only VPN connections:

sudo ufw deny ssh
sudo ufw allow in on tun0

For WireGuard

Block all non-VPN traffic on the server:

sudo iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j DROP

5. Using a Dedicated VPN Gateway for Remote Teams

If your team frequently accesses office networks, you can set up a dedicated VPN gateway.

1️⃣ Set Up Routing on the VPN Server
Enable routing to forward traffic between VPN users and office network:

echo 1 > /proc/sys/net/ipv4/ip_forward

2️⃣ Define Route Rules for Office Network
Edit OpenVPN’s configuration to push office routes:

push "route 192.168.1.0 255.255.255.0"

For WireGuard, modify AllowedIPs in the client config:

AllowedIPs = 192.168.1.0/24

This ensures all company-related traffic is routed through the VPN.

Next Steps

Now that your VPN is optimized for teams and remote workers, you can:

✅ Set Up Multi-Factor Authentication (MFA) for Extra Security
✅ Automate VPN Client Updates for Security
✅ Integrate VPN with Active Directory for Businesses

Adding Multi-Factor Authentication (MFA) for VPN Security

Multi-Factor Authentication (MFA) adds an extra layer of security to your OpenVPN or WireGuard setup, ensuring that even if credentials are compromised, attackers cannot access your VPN without an additional authentication factor.

1. Setting Up MFA for OpenVPN (Using Google Authenticator)

Step 1: Install Google Authenticator on the VPN Server

On your OpenVPN VPS, install the Google Authenticator PAM module:

sudo apt install libpam-google-authenticator -y  # Ubuntu/Debian
sudo yum install google-authenticator -y  # CentOS/RHEL

Step 2: Configure Google Authenticator for Each User

Each VPN user must generate a unique authentication key.

1️⃣ Switch to the VPN user:

sudo su - username

2️⃣ Run the Google Authenticator setup:

google-authenticator

3️⃣ Answer the setup questions:

"Do you want authentication tokens to be time-based?" → yes
Save the secret key, emergency scratch codes, and QR code.
"Do you want to enforce rate limiting?" → yes

4️⃣ The setup will display a QR code that the user must scan using the Google Authenticator app on their phone.

Step 3: Integrate MFA with OpenVPN

Edit the OpenVPN authentication settings:

sudo nano /etc/pam.d/openvpn

Add the following line:

auth required pam_google_authenticator.so

Save and exit (CTRL + X, then Y, then Enter).

Step 4: Configure OpenVPN to Require MFA

Edit the OpenVPN server configuration file:

sudo nano /etc/openvpn/server.conf

Find the plugin line and add the PAM authentication module:

plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn

Restart OpenVPN:

sudo systemctl restart openvpn@server

Step 5: Test MFA Login

When connecting to the VPN, users will now be prompted to enter their password followed by the MFA code from their Google Authenticator app.

2. Setting Up MFA for WireGuard (Using Public-Key Authentication)

WireGuard does not support password-based authentication, but we can add MFA by requiring client device verification with public keys.

Step 1: Assign Unique Public Keys to Users

Each WireGuard client must generate their own key pair.

1️⃣ On the client’s machine, generate a new key pair:

wg genkey | tee privatekey | wg pubkey > publickey

2️⃣ Retrieve the private key and public key:

cat privatekey
cat publickey

Step 2: Add the Client to the WireGuard Server

Edit the WireGuard server configuration file:

sudo nano /etc/wireguard/wg0.conf

Add the new user’s public key under the [Peer] section:

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

Replace CLIENT_PUBLIC_KEY with the actual client's public key from cat publickey.

Restart WireGuard:

sudo systemctl restart wg-quick@wg0

Step 3: Configure Device-Specific MFA

If you want to ensure only pre-registered devices can connect, enable strict AllowedIPs rules:

AllowedIPs = 192.168.1.0/24

This prevents unknown devices from accessing the VPN.

3. Restricting VPN Access to Only MFA-Verified Users

To further secure both OpenVPN and WireGuard, restrict VPN access only to users who have configured MFA.

For OpenVPN:

1️⃣ Block non-MFA users by modifying the authentication script:

sudo nano /etc/openvpn/auth.sh

2️⃣ Add the following rule:

#!/bin/bash
if [[ ! -f "/home/$1/.google_authenticator" ]]; then
    exit 1
fi
exit 0

3️⃣ Save and make the script executable:

sudo chmod +x /etc/openvpn/auth.sh

4️⃣ Modify server.conf to use the authentication script:

auth-user-pass-verify /etc/openvpn/auth.sh via-env

Restart OpenVPN:

sudo systemctl restart openvpn@server

For WireGuard:

1️⃣ Block all unauthorized users by only allowing predefined public keys in wg0.conf.
2️⃣ Use a monitoring script to detect unknown public keys attempting to connect.

4. Monitoring VPN MFA Usage

To track MFA logins, use logging tools.

For OpenVPN:

Check MFA authentication logs:

sudo cat /var/log/auth.log | grep openvpn

For WireGuard:

Monitor active VPN connections:

sudo wg show

Conclusion

Now, your VPN requires Multi-Factor Authentication for all users, making it significantly more secure! 🎉

✅ Google Authenticator MFA added for OpenVPN
✅ Public-key authentication enforced for WireGuard
✅ Unauthorized access blocked for non-MFA users

Automating VPN Client Updates for Security

Keeping VPN clients up-to-date is essential for maintaining security, improving performance, and fixing vulnerabilities. By automating VPN client updates, you ensure that users always have the latest configurations and security patches without manual intervention.

In this section, we will cover:
✅ Automatically updating OpenVPN client configurations
✅ Distributing updated WireGuard configurations
✅ Using scripts to ensure clients stay secure

1. Automating OpenVPN Client Configuration Updates

In many organizations, OpenVPN configurations change over time, such as server IP updates, certificate renewals, or security improvements. Automating the update process ensures clients don’t have to manually replace their .ovpn files.

Step 1: Host the OpenVPN Configuration on a Secure Server

Store the updated client configuration on a secure web server so users can fetch the latest version automatically.

On the OpenVPN server, create a directory for the configuration file:

sudo mkdir -p /var/www/html/vpn-configs
sudo cp /etc/openvpn/client.ovpn /var/www/html/vpn-configs/

Make the file publicly accessible (only for authenticated users if possible):

sudo chmod 644 /var/www/html/vpn-configs/client.ovpn

Restart the web server (assuming you are using Nginx or Apache):

sudo systemctl restart nginx  # For Nginx
sudo systemctl restart apache2  # For Apache

Step 2: Create an Auto-Update Script on Client Machines

On each client device, create a script to automatically check for updates and replace the old OpenVPN configuration.

Create the script:

nano ~/update-openvpn.sh

Add the following content:

#!/bin/bash

CONFIG_URL="http://your-vps-ip/vpn-configs/client.ovpn"
CONFIG_FILE="$HOME/.openvpn/client.ovpn"

wget -O "$CONFIG_FILE" "$CONFIG_URL"
echo "OpenVPN configuration updated successfully!"

Make the script executable:

chmod +x ~/update-openvpn.sh

Step 3: Automate the Update Process

Schedule the script to run daily using cron:

Edit the crontab:

crontab -e

Add this line to check for updates every day at midnight:

0 0 * * * ~/update-openvpn.sh

Now, the OpenVPN client will always use the latest configuration without manual updates.

2. Automating WireGuard Client Configuration Updates

WireGuard clients rely on static configuration files, but you can automate updates whenever the server changes settings.

Step 1: Store the Updated WireGuard Config on the Server

Create a directory to store the latest WireGuard client configurations:

sudo mkdir -p /var/www/html/wireguard-configs
sudo cp /etc/wireguard/client.conf /var/www/html/wireguard-configs/

Set permissions to allow only authenticated users to access the file:

sudo chmod 644 /var/www/html/wireguard-configs/client.conf

Step 2: Create an Auto-Update Script for WireGuard Clients

On the client machine, create a script to fetch the latest configuration:

nano ~/update-wireguard.sh

Add the following script:

#!/bin/bash

CONFIG_URL="http://your-vps-ip/wireguard-configs/client.conf"
CONFIG_FILE="/etc/wireguard/wg0.conf"

wget -O "$CONFIG_FILE" "$CONFIG_URL"
systemctl restart wg-quick@wg0
echo "WireGuard configuration updated and restarted!"

Make the script executable:

chmod +x ~/update-wireguard.sh

Step 3: Automate the Update Process

Use a cron job to check for updates daily:

crontab -e

Add this line to fetch the latest WireGuard configuration every midnight:

0 0 * * * ~/update-wireguard.sh

Now, WireGuard clients will always stay updated with the latest configurations.

3. Enforcing VPN Updates for Security

To ensure all users are running the latest configuration, you can block outdated clients.

For OpenVPN:

1️⃣ Edit the OpenVPN server configuration:

sudo nano /etc/openvpn/server.conf

2️⃣ Add the following rule to reject old clients:

tls-verify "/etc/openvpn/check-client-cert.sh"

3️⃣ Create the script to validate certificates:

sudo nano /etc/openvpn/check-client-cert.sh

4️⃣ Add the following content:

#!/bin/bash
if [ "$1" != "NEW_CERTIFICATE_NAME" ]; then
    exit 1
fi
exit 0

Make the script executable:

sudo chmod +x /etc/openvpn/check-client-cert.sh

Restart OpenVPN:

sudo systemctl restart openvpn@server

Now, only users with updated client certificates will be able to connect.

For WireGuard:

Restrict access only to updated clients by changing the public keys for authorized users.

1️⃣ When updating a client configuration, generate a new key pair:

wg genkey | tee new_privatekey | wg pubkey > new_publickey

2️⃣ Replace the old public key in the WireGuard server configuration:

sudo nano /etc/wireguard/wg0.conf

Modify the [Peer] section to use the new public key:

[Peer]
PublicKey = NEW_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

3️⃣ Restart WireGuard:

sudo systemctl restart wg-quick@wg0

Now, only updated clients can connect.

4. Monitoring VPN Client Updates

To ensure all clients are running the latest configuration, you can track their connection details.

For OpenVPN:

Check the status log:

sudo cat /var/log/openvpn-status.log

Look for outdated clients and alert them to update.

For WireGuard:

List connected users:

sudo wg show

Compare their public keys with the updated list.

Conclusion

Now your VPN clients automatically update their configurations, ensuring:

✅ Security patches are applied instantly
✅ Clients always have the correct settings
✅ Outdated users are blocked from connecting

Integrating VPN with Active Directory for Businesses

For businesses using Microsoft Active Directory (AD), integrating OpenVPN or WireGuard with AD allows centralized user management. This means:

✅ Users can log in with their existing corporate credentials
✅ Access control is enforced based on AD groups
✅ Easier user management and security compliance

1. Integrating OpenVPN with Active Directory (LDAP Authentication)

OpenVPN supports LDAP (Lightweight Directory Access Protocol), which allows authentication using Active Directory credentials.

Step 1: Install OpenVPN LDAP Plugin

On your OpenVPN server, install the required plugin:

sudo apt install openvpn-auth-ldap -y  # Ubuntu/Debian
sudo yum install openvpn-auth-ldap -y  # CentOS/RHEL

Step 2: Configure OpenVPN to Use LDAP

1️⃣ Edit OpenVPN’s configuration file:

sudo nano /etc/openvpn/server.conf

2️⃣ Add the LDAP authentication plugin:

plugin /usr/lib/openvpn/openvpn-auth-ldap.so "/etc/openvpn/auth-ldap.conf"
auth-user-pass

Save and exit.

Step 3: Configure LDAP Settings

1️⃣ Create an LDAP authentication configuration file:

sudo nano /etc/openvpn/auth-ldap.conf

2️⃣ Add the following settings (modify based on your AD details):

LDAP
    URL ldap://your-ad-server-ip
    BindDN cn=admin,dc=yourdomain,dc=com
    Password your_admin_password
    BaseDN "ou=Users,dc=yourdomain,dc=com"
    Filter "(sAMAccountName=%u)"
    RequireGroup false

Replace:

your-ad-server-ip → Your Active Directory server IP
yourdomain.com → Your company domain
admin → Your LDAP admin user

Step 4: Restart OpenVPN

sudo systemctl restart openvpn@server

Now, users will log in to the VPN using their Active Directory credentials.

2. Integrating WireGuard with Active Directory (Using RADIUS)

WireGuard does not natively support Active Directory, but you can use FreeRADIUS as an authentication layer.

Step 1: Install FreeRADIUS on the VPN Server

sudo apt install freeradius freeradius-ldap -y  # Ubuntu/Debian
sudo yum install freeradius freeradius-ldap -y  # CentOS/RHEL

Step 2: Configure FreeRADIUS to Use LDAP (Active Directory)

1️⃣ Edit the LDAP module configuration file:

sudo nano /etc/freeradius/3.0/mods-available/ldap

2️⃣ Update the LDAP settings:

server = "your-ad-server-ip"
identity = "cn=admin,dc=yourdomain,dc=com"
password = "your_admin_password"
basedn = "dc=yourdomain,dc=com"
filter = "(sAMAccountName=%{User-Name})"

Save and exit.

3️⃣ Enable the LDAP module:

sudo ln -s /etc/freeradius/3.0/mods-available/ldap /etc/freeradius/3.0/mods-enabled/

4️⃣ Restart FreeRADIUS:

sudo systemctl restart freeradius

Step 3: Configure WireGuard to Use RADIUS Authentication

1️⃣ Install Wg-Radius, a plugin that connects WireGuard to FreeRADIUS:

git clone https://github.com/cozybit/wg-radius.git
cd wg-radius
sudo make install

2️⃣ Edit the WireGuard configuration file:

sudo nano /etc/wireguard/wg0.conf

3️⃣ Add the RADIUS authentication section:

[Interface]
Address = 10.0.0.1/24
PrivateKey = SERVER_PRIVATE_KEY
ListenPort = 51820
PostUp = wg-radius -config /etc/wireguard/wg-radius.conf

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

Save and exit.

4️⃣ Configure wg-radius to connect to FreeRADIUS:

sudo nano /etc/wireguard/wg-radius.conf

Add the following:

[Radius]
Server = "127.0.0.1"
Port = 1812
Secret = "your_radius_secret"

Save and restart WireGuard:

sudo systemctl restart wg-quick@wg0

Now, users must authenticate with their AD credentials before WireGuard allows access.

3. Enforcing VPN Access Based on AD Groups

For better security, restrict VPN access to specific Active Directory groups.

For OpenVPN:

Modify the auth-ldap.conf file:

RequireGroup true
Group "CN=VPNUsers,OU=Groups,DC=yourdomain,DC=com"

Now, only members of the VPNUsers group can log in.

For WireGuard (FreeRADIUS + AD Groups):

Edit the RADIUS configuration to enforce group membership:

sudo nano /etc/freeradius/3.0/sites-enabled/default

Add a rule to allow only VPNUsers group:

if (LDAP-Group == "CN=VPNUsers,OU=Groups,DC=yourdomain,DC=com") {
   accept
} else {
   reject
}

Restart FreeRADIUS:

sudo systemctl restart freeradius

Now, only authorized AD users can connect.

4. Monitoring VPN Usage via Active Directory Logs

For compliance and security, businesses often need to track VPN logins.

For OpenVPN:

Check authentication logs:

sudo cat /var/log/auth.log | grep openvpn

For WireGuard (via FreeRADIUS):

View RADIUS authentication logs:

sudo cat /var/log/freeradius/radius.log

To send logs to Active Directory event logs, configure RADIUS logging to Windows Event Viewer.

Conclusion

Now, your VPN is fully integrated with Active Directory, allowing:

✅ Corporate users to log in with their AD credentials
✅ Access control via AD groups
✅ Centralized monitoring and authentication tracking

Next Steps

✅ Setting Up VPN Traffic Logging & Anomaly Detection

✅ Adding VPN Access Policies Based on User Roles
✅ Enforcing Device Compliance (Only Company Laptops Can Connect)

Setting Up VPN Traffic Logging & Anomaly Detection

Once your VPN is fully operational, it's important to track user activity, monitor bandwidth usage, and detect suspicious behavior. This helps:

✅ Identify unauthorized access attempts
✅ Detect unusual bandwidth usage
✅ Prevent VPN abuse (e.g., torrenting, unauthorized file transfers)
✅ Enhance security compliance

In this section, we will set up traffic logging, monitoring, and anomaly detection for OpenVPN and WireGuard.

1. Logging VPN Traffic & Connections in OpenVPN

By default, OpenVPN logs connection events, but we can enable detailed logging for better visibility.

Step 1: Enable Connection Logging

Edit the OpenVPN server configuration file:

sudo nano /etc/openvpn/server.conf

Find and modify the logging settings:

status /var/log/openvpn-status.log
log /var/log/openvpn.log
verb 3  # Increase verbosity (0-6, higher means more detailed logs)

Save and restart OpenVPN:

sudo systemctl restart openvpn@server

Step 2: View VPN Connection Logs

To see connected users:

sudo cat /var/log/openvpn-status.log

To check real-time logs:

tail -f /var/log/openvpn.log

Step 3: Monitor User Bandwidth Usage

Install vnStat, a lightweight network traffic monitor:

sudo apt install vnstat -y  # Ubuntu/Debian
sudo yum install vnstat -y  # CentOS/RHEL

Start and enable vnStat:

sudo systemctl start vnstat
sudo systemctl enable vnstat

Monitor VPN interface traffic (for OpenVPN, it’s tun0):

vnstat -i tun0

2. Logging VPN Traffic & Connections in WireGuard

WireGuard does not log user activity by default, but we can enable basic connection logs.

Step 1: Enable WireGuard Logging

Edit the WireGuard server configuration file:

sudo nano /etc/wireguard/wg0.conf

Add the following line under [Interface]:

LogLevel = info

Save and restart WireGuard:

sudo systemctl restart wg-quick@wg0

Step 2: View WireGuard Connection Logs

To check active connections:

sudo wg show

To see detailed logs:

journalctl -u wg-quick@wg0 -f

Step 3: Monitor WireGuard Bandwidth Usage

Use vnStat to track bandwidth for the WireGuard interface (wg0):

vnstat -i wg0

3. Setting Up Anomaly Detection for VPN Usage

To detect suspicious behavior, we will configure Fail2Ban and custom monitoring scripts.

Step 1: Install & Configure Fail2Ban to Block Suspicious Activity

Fail2Ban helps prevent brute-force attacks and repeated failed login attempts.

1️⃣ Install Fail2Ban:

sudo apt install fail2ban -y  # Ubuntu/Debian
sudo yum install fail2ban -y  # CentOS/RHEL

2️⃣ Create an OpenVPN fail2ban filter:

sudo nano /etc/fail2ban/filter.d/openvpn.conf

Add the following rule:

[Definition]
failregex = TLS Auth Error
            TLS Error: incoming packet authentication failed
            Authenticate/Decrypt packet error
ignoreregex =

Save and exit.

3️⃣ Configure Fail2Ban to monitor OpenVPN logs:

sudo nano /etc/fail2ban/jail.local

Add:

[openvpn]
enabled = true
port = 1194
protocol = udp
filter = openvpn
logpath = /var/log/openvpn.log
maxretry = 5

Restart Fail2Ban:

sudo systemctl restart fail2ban

To see banned IPs:

sudo fail2ban-client status openvpn

Step 2: Detect High Bandwidth Usage

For OpenVPN (Detect Heavy Users)

Create a script to list top bandwidth users:

nano ~/monitor-vpn-usage.sh

Add the following:

#!/bin/bash
echo "Top VPN Users by Bandwidth:"
vnstat -i tun0 -tr 5

Make the script executable:

chmod +x ~/monitor-vpn-usage.sh

Run it:

~/monitor-vpn-usage.sh

For WireGuard (Detect High Usage)

Create a script to monitor WireGuard client traffic:

nano ~/monitor-wg-usage.sh

Add:

#!/bin/bash
echo "WireGuard Traffic Stats:"
sudo wg show wg0 transfer

Make it executable:

chmod +x ~/monitor-wg-usage.sh

Run it:

~/monitor-wg-usage.sh

Step 3: Detect Unusual VPN Connection Patterns

To detect multiple logins from different locations, check the VPN logs.

For OpenVPN:

Run:

grep "Peer Connection Initiated" /var/log/openvpn.log | awk '{print $6}' | sort | uniq -c

This will list the number of connections per user. If a user is logging in from multiple locations in a short period, it may indicate account sharing or hacking attempts.

For WireGuard:

Check active client IPs:

sudo wg show wg0

If the same public key appears with different IPs in a short time, there may be unauthorized access.

4. Setting Up Alerts for VPN Anomalies

To receive email alerts for VPN anomalies, configure Logwatch.

Step 1: Install Logwatch

sudo apt install logwatch -y  # Ubuntu/Debian
sudo yum install logwatch -y  # CentOS/RHEL

Step 2: Configure Logwatch to Monitor VPN Logs

Edit the configuration file:

sudo nano /etc/logwatch/conf/logwatch.conf

Ensure these settings are present:

Output = mail
MailTo = your-email@example.com
Detail = High

Save and exit.

Step 3: Schedule Daily Reports

Run crontab -e and add:

0 6 * * * /usr/sbin/logwatch --output mail

This will send daily VPN activity reports at 6 AM.

Conclusion

Now your VPN logs, monitors traffic, and detects anomalies automatically! 🎉

✅ Track user connections and bandwidth usage
✅ Block brute-force attacks using Fail2Ban
✅ Detect suspicious activity with monitoring scripts
✅ Receive daily email reports with Logwatch

Adding VPN Access Policies Based on User Roles

For businesses and organizations, it is important to enforce role-based access control (RBAC) to ensure that different users have different levels of VPN access. With proper role-based VPN policies, you can:

✅ Restrict access to specific network resources based on user roles
✅ Limit bandwidth usage for certain users
✅ Ensure compliance with security policies

In this section, we will configure OpenVPN and WireGuard to enforce user-based access policies.

1. Configuring Role-Based Access Control (RBAC) in OpenVPN

OpenVPN allows us to control user access based on username, group, and IP assignments.

Step 1: Create a Directory for Per-User Configurations

Create a folder to store per-user configuration files:

sudo mkdir -p /etc/openvpn/ccd

Step 2: Modify the OpenVPN Server Configuration

Edit the OpenVPN server configuration file:

sudo nano /etc/openvpn/server.conf

Add this line to enable client-specific configurations:

client-config-dir /etc/openvpn/ccd

Save and restart OpenVPN:

sudo systemctl restart openvpn@server

Step 3: Create Access Rules for User Groups

For each user, create a file in /etc/openvpn/ccd/ with the same name as their username.

Example: Restricting Access for Regular Users

Create a file for employee1:

sudo nano /etc/openvpn/ccd/employee1

Add the following rules to restrict access to only internal resources (e.g., no internet access):

ifconfig-push 10.8.0.10 255.255.255.0
push "route 192.168.1.0 255.255.255.0"

Save and exit.

Example: Full Access for Admins

Create a file for admin1:

sudo nano /etc/openvpn/ccd/admin1

Allow full access:

ifconfig-push 10.8.0.20 255.255.255.0
push "redirect-gateway def1"

Save and exit.

Step 4: Apply Firewall Rules Based on User Roles

If you want to restrict access to certain IP ranges for non-admin users, add firewall rules.

For example, block employees from accessing the server’s SSH port (22):

sudo iptables -A INPUT -s 10.8.0.10 -p tcp --dport 22 -j DROP

To allow only admins to access SSH:

sudo iptables -A INPUT -s 10.8.0.20 -p tcp --dport 22 -j ACCEPT

2. Configuring Role-Based Access in WireGuard

WireGuard does not support username authentication, but we can enforce role-based access using different IP assignments and firewall rules.

Step 1: Assign Different IPs for Different User Groups

Edit the WireGuard server configuration file:

sudo nano /etc/wireguard/wg0.conf

For regular employees (limited access):

[Peer]
PublicKey = EMPLOYEE1_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

For admins (full access):

[Peer]
PublicKey = ADMIN1_PUBLIC_KEY
AllowedIPs = 10.0.0.3/32

Save and restart WireGuard:

sudo systemctl restart wg-quick@wg0

Step 2: Enforce Access Control with Firewall Rules

To restrict employees from accessing certain servers, add firewall rules:

Block employees from accessing the internal database server (192.168.1.50):

sudo iptables -A FORWARD -s 10.0.0.2 -d 192.168.1.50 -j DROP

Allow admins to access all resources:

sudo iptables -A FORWARD -s 10.0.0.3 -j ACCEPT

Step 3: Monitor User Activity

To check active connections and user roles, run:

sudo wg show

This will display which users are connected and their assigned IPs.

3. Restricting VPN Access to Specific Times (Schedule-Based Policies)

In some cases, businesses may want to restrict VPN usage to working hours.

For OpenVPN (Allow VPN Access Only During Office Hours)

1️⃣ Install cron if not installed:

sudo apt install cron -y

2️⃣ Edit the crontab file:

sudo crontab -e

3️⃣ Add the following rules to enable VPN at 8 AM and disable it at 6 PM:

0 8 * * * sudo systemctl start openvpn@server
0 18 * * * sudo systemctl stop openvpn@server

This ensures the VPN is only active during office hours.

For WireGuard (Restrict Access Based on Time)

WireGuard does not support scheduled access natively, but we can create a cron job to disable users after work hours.

1️⃣ Create a script to disable employees at 6 PM:

sudo nano /root/disable-vpn.sh

Add:

#!/bin/bash
wg set wg0 peer EMPLOYEE1_PUBLIC_KEY remove

Make it executable:

sudo chmod +x /root/disable-vpn.sh

2️⃣ Schedule it with cron:

sudo crontab -e

Add:

0 18 * * * /root/disable-vpn.sh

This will disconnect employees after work hours.

4. Restricting VPN Access to Only Corporate Devices

To ensure only company-approved devices can connect, we can use MAC address filtering.

For OpenVPN

1️⃣ Find the client’s MAC address in logs:

grep "Peer Connection Initiated" /var/log/openvpn.log

2️⃣ Create a script to block unknown devices:

sudo nano /etc/openvpn/auth-mac.sh

Add:

#!/bin/bash
ALLOWED_MACS=("00:11:22:33:44:55" "AA:BB:CC:DD:EE:FF")
CLIENT_MAC=$(grep "Peer Connection Initiated" /var/log/openvpn.log | awk '{print $6}')

if [[ ! " ${ALLOWED_MACS[@]} " =~ " ${CLIENT_MAC} " ]]; then
    exit 1
fi
exit 0

3️⃣ Make the script executable:

sudo chmod +x /etc/openvpn/auth-mac.sh

4️⃣ Edit OpenVPN config:

auth-user-pass-verify /etc/openvpn/auth-mac.sh via-env

Restart OpenVPN:

sudo systemctl restart openvpn@server

For WireGuard

1️⃣ Find connected users:

sudo wg show

2️⃣ Manually verify their device names and public keys.

WireGuard does not natively support MAC filtering, but you can remove unauthorized peers manually:

wg set wg0 peer UNKNOWN_PUBLIC_KEY remove

Conclusion

Now your VPN has role-based access control, ensuring:

✅ Employees and admins have different access levels
✅ Users are restricted based on time and work schedules
✅ Only approved company devices can connect

Wednesday, 5 February 2025

Why Set Up Your Own VPN on a Linux VPS?

Prerequisites

1. A Linux VPS

2. SSH Access to Your VPS

3. A Static IP or Domain (Optional)

4. Basic Linux Command Knowledge

5. Firewall Configuration

Choosing a VPN Solution

1. OpenVPN: A Reliable and Well-Established Choice

2. WireGuard: A Faster and Simpler Alternative

Which VPN Should You Choose?

Setting Up Your Linux VPS for VPN Installation

Step 1: Update System Packages

Step 2: Install Required Dependencies

Step 3: Configure Firewall (UFW or Firewalld)

For Ubuntu/Debian (UFW)

For CentOS (Firewalld)

Step 4: Enable IP Forwarding

Step 5: Reboot Your VPS

Installing and Configuring OpenVPN on a Linux VPS

Step 1: Install OpenVPN and Easy-RSA

For Ubuntu/Debian

For CentOS/RHEL

Step 2: Set Up the OpenVPN Server

Step 3: Generate Encryption Keys and Certificates

Step 4: Enable and Start OpenVPN

Step 5: Configure Firewall and IP Forwarding

Step 6: Create VPN Client Configuration File

Testing Your OpenVPN Connection

Installing and Configuring WireGuard on a Linux VPS

Step 1: Install WireGuard

For Ubuntu/Debian

For CentOS/RHEL

Step 2: Generate WireGuard Keys

Step 3: Configure the WireGuard Server

Step 4: Enable IP Forwarding

Step 5: Start and Enable WireGuard

Step 6: Configure WireGuard Clients

Step 7: Create Client Configuration File

Step 8: Testing Your WireGuard VPN

OpenVPN vs. WireGuard: Which One Should You Use?

Troubleshooting and Securing Your VPN on a Linux VPS

Common VPN Issues and Fixes

1. VPN Not Connecting

2. VPN Connects, But No Internet Access

3. VPN Speed is Slow

Enhancing VPN Security

1. Use Strong Encryption and Authentication

2. Enable Fail2Ban to Prevent Brute-Force Attacks

3. Disable Root Login for SSH

4. Set Up Automatic Security Updates

Next Steps

Automating VPN Start on Reboot

Step 1: Enable VPN Service on Boot

For OpenVPN

For WireGuard

Step 2: Check VPN Status After Reboot

Step 3: Automatically Reconnect Clients

Step 4: Monitor VPN Connectivity with a Cron Job

Step 5: Test Automatic VPN Startup

Next Steps

Optimizing VPN Performance: Speed, Compression, and DNS Settings

1. Using UDP Instead of TCP for Faster Speeds

For OpenVPN

For WireGuard

For OpenVPN

3. Using a Fast and Secure DNS Provider

For OpenVPN

For WireGuard

4. Enabling MTU Optimization to Reduce Latency

For OpenVPN

For WireGuard

5. Enabling Multi-Threading for OpenVPN (AES-NI Support)

6. Enabling Multi-User Access (Allowing More Clients to Connect)

For OpenVPN

For WireGuard

7. Using Split Tunneling to Route Only Specific Traffic Through the VPN

For OpenVPN

For WireGuard