# Install a VPN on a Linux VPS: WireGuard vs OpenVPN

**URL:** <https://forum.boxtoplay.com/t/install-a-vpn-on-a-linux-vps-wireguard-vs-openvpn/31826>\
**Category:** VPS\
**Tags:** english, vps\
**Created:** [Juillet 19, 2026, 4:57 UTC](https://forum.boxtoplay.com/t/install-a-vpn-on-a-linux-vps-wireguard-vs-openvpn/31826 "2026-07-19T16:57:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BoxToPlay-helper](https://forum.boxtoplay.com/user_avatar/forum.boxtoplay.com/boxtoplay-helper/32/5468_2.png) [@BoxToPlay-helper](https://forum.boxtoplay.com/u/BoxToPlay-helper)\
**Post date:** [Juillet 19, 2026, 4:57 UTC](https://forum.boxtoplay.com/t/install-a-vpn-on-a-linux-vps-wireguard-vs-openvpn/31826/1 "2026-07-19T16:57:49Z")

</div>

![Install a VPN on a Linux VPS: WireGuard vs OpenVPN](https://forum.boxtoplay.com/uploads/default/original/2X/1/1264f7875693d6d445aeb81c04efc8f81967f004.jpeg)

## Install a VPN on a Linux VPS: WireGuard vs OpenVPN

Turning a VPS (Virtual Private Server) into a VPN (Virtual Private Network) lets you secure a connection from a public network, reach internal services without exposing them to the whole Internet, or route traffic through your server’s dedicated IP address. The VPN encrypts the connection between your devices and the VPS, but it does not make you anonymous: traffic then reaches the Internet from the server’s IP address.

In this guide, we will cover two simple options. [WireGuard](https://www.wireguard.com/) is the modern choice: lightweight, fast, integrated into recent Linux kernels, and easy to use every day. [OpenVPN](https://openvpn.net/community/) is the long-standing reference: heavier, but very flexible, especially when you need TCP or a common port such as `443`.

### Which VPN should you choose for your VPS?

For a new setup, start with **WireGuard** in most cases. The configuration is shorter, performance is excellent, and the clients for Windows and Linux are straightforward.

Choose **OpenVPN** when you have a specific compatibility requirement: a very restricted network, mandatory TCP, a required port, an existing client deployment, or an infrastructure that already depends on it.

In practice:

- WireGuard is recommended for a fast modern private VPN.
- OpenVPN is recommended when network compatibility matters more than simplicity.
- Avoid installing both on the same VPS unless you really need both.

### Requirements

Before you begin, you need:

- a Linux VPS with root or sudo access.
- Ubuntu 24.04 or a recent Debian release.
- a public IPv4 address or a domain name pointing to the VPS.
- access to the server firewall and, if your provider offers one, to the external network firewall.
- a working SSH session before changing any firewall rule.

The examples below use `203.0.113.10` as a documentation IP address. Replace it with your VPS public address.

The profiles below route IPv4 traffic only. If your device uses IPv6, configure it in the VPN as well or disable it on that connection so that it does not bypass the tunnel.

### Prepare the server

Connect to the VPS over SSH. Check that its clock is synchronized because OpenVPN certificates depend on the correct date. Then enable IPv4 forwarding, which is required for the VPS to pass VPN traffic to the Internet:

```bash
timedatectl status
sudo tee /etc/sysctl.d/99-vpn-forward.conf > /dev/null <<'EOF'
net.ipv4.ip_forward=1
EOF

sudo sysctl -p /etc/sysctl.d/99-vpn-forward.conf

```

The last command must display `net.ipv4.ip_forward = 1`. Then choose the VPN you want to install and follow only the corresponding section. The commands use packages provided by Ubuntu 24.04 and recent Debian releases. No remote installation script is downloaded.

### Install WireGuard

Install WireGuard and the routing commands used by the configuration:

```bash
sudo apt update
sudo apt install -y wireguard iptables

```

Create one key pair for the server and another for the first client computer, named `client` here:

```bash
sudo install -d -m 700 /etc/wireguard
sudo sh -c 'umask 077; wg genkey > /etc/wireguard/server.key'
sudo sh -c 'wg pubkey < /etc/wireguard/server.key > /etc/wireguard/server.pub'
sudo sh -c 'umask 077; wg genkey > /etc/wireguard/client.key'
sudo sh -c 'wg pubkey < /etc/wireguard/client.key > /etc/wireguard/client.pub'

```

Create the `wg0` interface. The `PostUp` and `PostDown` rules only allow forwarding VPN traffic and applying NAT through the main network interface. They do not change inbound rules or SSH access.

```bash
WAN_IF=$(ip route show default | awk '{print $5; exit}')
CLIENT_PUBLIC_KEY=$(sudo cat /etc/wireguard/client.pub)

sudo tee /etc/wireguard/wg0.conf > /dev/null <<EOF
[Interface]
Address = 10.66.66.1/24
ListenPort = 51820
PostUp = wg set %i private-key /etc/wireguard/server.key
PostUp = iptables -I FORWARD 1 -i %i -o $WAN_IF -j ACCEPT; iptables -I FORWARD 1 -i $WAN_IF -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -A POSTROUTING -s 10.66.66.0/24 -o $WAN_IF -j MASQUERADE
PostDown = iptables -C FORWARD -i %i -o $WAN_IF -j ACCEPT 2>/dev/null && iptables -D FORWARD -i %i -o $WAN_IF -j ACCEPT || true; iptables -C FORWARD -i $WAN_IF -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null && iptables -D FORWARD -i $WAN_IF -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT || true; iptables -t nat -C POSTROUTING -s 10.66.66.0/24 -o $WAN_IF -j MASQUERADE 2>/dev/null && iptables -t nat -D POSTROUTING -s 10.66.66.0/24 -o $WAN_IF -j MASQUERADE || true

[Peer]
PublicKey = $CLIENT_PUBLIC_KEY
AllowedIPs = 10.66.66.2/32
EOF

sudo chmod 600 /etc/wireguard/wg0.conf

```

Start WireGuard and enable it automatically with the VPS:

```bash
sudo systemctl enable --now wg-quick@wg0

```

Create the Windows or Linux client profile. The command asks for the public IP address or DNS name of the VPS so that no example value remains in the file:

```bash
SERVER_PUBLIC_KEY=$(sudo cat /etc/wireguard/server.pub)
CLIENT_PRIVATE_KEY=$(sudo cat /etc/wireguard/client.key)
read -rp "Public IP address or DNS name of the VPS: " VPN_ENDPOINT

install -m 600 /dev/null "$HOME/client.conf"
tee "$HOME/client.conf" > /dev/null <<EOF
[Interface]
PrivateKey = $CLIENT_PRIVATE_KEY
Address = 10.66.66.2/32
DNS = 1.1.1.1, 1.0.0.1

[Peer]
PublicKey = $SERVER_PUBLIC_KEY
Endpoint = $VPN_ENDPOINT:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF

unset CLIENT_PRIVATE_KEY

```

The `client.conf` profile is now in your home directory. From your Windows or Linux computer, retrieve it over SSH, then import it into the WireGuard app:

```bash
scp username@203.0.113.10:client.conf .

```

Run the `scp` command from your computer. Replace `username` with your SSH account and `203.0.113.10` with the VPS address.

On a headless Ubuntu or Debian client, also install `resolvconf` so that `wg-quick` applies the profile’s `DNS` line:

```bash
sudo apt install wireguard resolvconf
sudo install -m 600 client.conf /etc/wireguard/client.conf
sudo wg-quick up client

```

After importing the profile and storing an encrypted backup, delete the client private key and profile copies left on the VPS:

```bash
sudo rm -f /etc/wireguard/client.key
rm -f "$HOME/client.conf"

```

If your hosting provider applies an external network firewall, allow `51820/udp` to the VPS. If UFW is already used locally, check its status and add the port:

```bash
sudo ufw status verbose
sudo ufw allow 51820/udp

```

If UFW is inactive, do not enable it automatically only to follow this guide. If you decide to enable it, allow the SSH port actually in use first. With an existing `iptables` policy, the temporary equivalent is:

```bash
sudo iptables -C INPUT -p udp --dport 51820 -j ACCEPT 2>/dev/null || sudo iptables -I INPUT -p udp --dport 51820 -j ACCEPT

```

Make this rule persistent using the mechanism already used on your server and do not mix multiple firewall managers.

An `ufw reload` or firewall rule reset can remove the direct forwarding and NAT rules. If this happens, restart `wg-quick@wg0` to apply them again.

Once the client is connected, check the service and latest handshake:

```bash
sudo systemctl status wg-quick@wg0 --no-pager
sudo wg show
sudo sysctl net.ipv4.ip_forward

```

The `client` peer should show a recent handshake. From the connected computer, the public IP address should match the VPS address.

Always create a new key pair and address, for example `10.66.66.3/32`, for each additional device. To revoke a device, remove its `[Peer]` block from `/etc/wireguard/wg0.conf`, then reload the configuration with `sudo systemctl restart wg-quick@wg0`. The other devices may take a few seconds to reconnect after this restart.

### Install OpenVPN

Install OpenVPN and Easy-RSA, then prepare the certificate authority, server certificate and first client certificate:

```bash
sudo apt update
sudo apt install -y openvpn easy-rsa iptables
getent group openvpn > /dev/null || sudo groupadd --system openvpn
getent passwd openvpn > /dev/null || sudo useradd --system --gid openvpn --home-dir /nonexistent --shell /usr/sbin/nologin openvpn
sudo install -d -o root -g openvpn -m 750 /etc/openvpn/server
sudo make-cadir /etc/openvpn/easy-rsa
cd /etc/openvpn/easy-rsa

sudo ./easyrsa init-pki
sudo env EASYRSA_REQ_CN=Private-VPN-CA ./easyrsa build-ca
sudo ./easyrsa build-server-full server nopass
sudo ./easyrsa build-client-full client nopass
sudo env EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
sudo openvpn --genkey tls-crypt /etc/openvpn/server/tc.key

sudo install -m 600 pki/ca.crt pki/private/server.key /etc/openvpn/server/
sudo install -m 644 pki/issued/server.crt /etc/openvpn/server/
sudo install -o root -g openvpn -m 640 pki/crl.pem /etc/openvpn/server/crl.pem
sudo chmod 600 /etc/openvpn/server/tc.key

```

Easy-RSA asks for a passphrase to protect the certificate authority private key. Keep it safe: it will be required to create or revoke profiles. The server and client keys remain without a passphrase so that the service and app can start automatically. The `.ovpn` file must therefore be protected like a private key.

The dedicated `openvpn` system account limits the service privileges. The revocation list remains readable by this account, unlike the private keys. Its validity is set to ten years to avoid the default expiration after 180 days, which would make new connections fail. Regenerate it before that deadline and after every revocation.

Easy-RSA 3.1.7 generates server and client certificates with a default validity of 825 days. Check and record their expiration dates during installation:

```bash
sudo openssl x509 -in /etc/openvpn/server/server.crt -noout -enddate
sudo openssl x509 -in /etc/openvpn/easy-rsa/pki/issued/client.crt -noout -enddate

```

Schedule their renewal before that date: a CRL that is still valid does not extend an expired certificate.

Add a local script that only manages OpenVPN routing and NAT. systemd will run it with the required privileges when the service starts and stops:

```bash
sudo tee /etc/openvpn/server/network.sh > /dev/null <<'EOF'
#!/bin/sh
WAN_IF=$(ip route show default | awk '{print $5; exit}')
DEV=tun0

case "$1" in
  up)
    iptables -C FORWARD -i "$DEV" -o "$WAN_IF" -j ACCEPT 2>/dev/null || iptables -I FORWARD 1 -i "$DEV" -o "$WAN_IF" -j ACCEPT
    iptables -C FORWARD -i "$WAN_IF" -o "$DEV" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || iptables -I FORWARD 1 -i "$WAN_IF" -o "$DEV" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
    iptables -t nat -C POSTROUTING -s 10.8.0.0/24 -o "$WAN_IF" -j MASQUERADE 2>/dev/null || iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o "$WAN_IF" -j MASQUERADE
    ;;
  down)
    iptables -C FORWARD -i "$DEV" -o "$WAN_IF" -j ACCEPT 2>/dev/null && iptables -D FORWARD -i "$DEV" -o "$WAN_IF" -j ACCEPT || true
    iptables -C FORWARD -i "$WAN_IF" -o "$DEV" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null && iptables -D FORWARD -i "$WAN_IF" -o "$DEV" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT || true
    iptables -t nat -C POSTROUTING -s 10.8.0.0/24 -o "$WAN_IF" -j MASQUERADE 2>/dev/null && iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o "$WAN_IF" -j MASQUERADE || true
    ;;
  *)
    exit 2
    ;;
esac
EOF

sudo chmod 700 /etc/openvpn/server/network.sh

```

Create the server configuration on `1194/udp`:

```bash
sudo tee /etc/openvpn/server/server.conf > /dev/null <<'EOF'
port 1194
proto udp4
dev tun0
ca ca.crt
cert server.crt
key server.key
dh none
tls-crypt tc.key
crl-verify /etc/openvpn/server/crl.pem
server 10.8.0.0 255.255.255.0
topology subnet
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 120
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
tls-version-min 1.2
user openvpn
group openvpn
persist-key
persist-tun
explicit-exit-notify 1
verb 3
EOF

sudo install -d /etc/systemd/system/openvpn-server@server.service.d
sudo tee /etc/systemd/system/openvpn-server@server.service.d/firewall.conf > /dev/null <<'EOF'
[Service]
ExecStartPost=/etc/openvpn/server/network.sh up
ExecStopPost=/etc/openvpn/server/network.sh down
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now openvpn-server@server

```

Finally, build the self-contained `client.ovpn` profile in your home directory:

```bash
cd /etc/openvpn/easy-rsa
read -rp "Public IP address or DNS name of the VPS: " VPN_ENDPOINT
CA_CERT=$(sudo cat pki/ca.crt)
CLIENT_CERT=$(sudo sed -ne '/BEGIN CERTIFICATE/,$ p' pki/issued/client.crt)
CLIENT_KEY=$(sudo cat pki/private/client.key)
TLS_CRYPT_KEY=$(sudo cat /etc/openvpn/server/tc.key)

install -m 600 /dev/null "$HOME/client.ovpn"
tee "$HOME/client.ovpn" > /dev/null <<EOF
client
dev tun
proto udp4
remote $VPN_ENDPOINT 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server name
tls-version-min 1.2
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
verb 3
<ca>
$CA_CERT
</ca>
<cert>
$CLIENT_CERT
</cert>
<key>
$CLIENT_KEY
</key>
<tls-crypt>
$TLS_CRYPT_KEY
</tls-crypt>
EOF

unset CLIENT_KEY TLS_CRYPT_KEY

```

Copy this file to your computer. On Windows or Linux, import it into OpenVPN Connect using the file import option.

```bash
scp username@203.0.113.10:client.ovpn .

```

Run the `scp` command from your computer. Replace `username` with your SSH account and `203.0.113.10` with the VPS address.

After importing the profile and storing an encrypted backup, delete the client private key and profile copies left on the VPS. The public certificate remains in the PKI so it can be revoked:

```bash
sudo rm -f /etc/openvpn/easy-rsa/pki/private/client.key /etc/openvpn/easy-rsa/pki/inline/client.inline
rm -f "$HOME/client.ovpn"

```

If your hosting provider applies an external network firewall, allow `1194/udp`. If UFW is already used, check its status and add the port:

```bash
sudo ufw status verbose
sudo ufw allow 1194/udp

```

If UFW is inactive, do not enable it automatically only to follow this guide. With an existing `iptables` policy, the temporary equivalent is:

```bash
sudo iptables -C INPUT -p udp --dport 1194 -j ACCEPT 2>/dev/null || sudo iptables -I INPUT -p udp --dport 1194 -j ACCEPT

```

Make this rule persistent using the mechanism already used on your server.

An `ufw reload` or firewall rule reset can remove the direct forwarding and NAT rules. If this happens, restart `openvpn-server@server` to apply them again.

This configuration uses `1194/udp`, the recommended mode. If a network blocks UDP and you really need TCP on port `443`, first check that no web server is using this port. Then replace `port 1194` with `port 443` and `proto udp4` with `proto tcp-server` on the server. In the client profile, replace `proto udp4` with `proto tcp-client`, use `remote $VPN_ENDPOINT 443`, and remove `explicit-exit-notify 1` from the server. Finally allow `443/tcp` instead of `1194/udp` in the firewalls. TCP is generally less efficient than UDP and should remain a compatibility option.

Check the service and confirm that routing is enabled:

```bash
sudo systemctl status openvpn-server@server --no-pager
sudo journalctl -u openvpn-server@server -n 50 --no-pager
sudo sysctl net.ipv4.ip_forward

```

From the connected computer, the public IP address should match the VPS address.

To revoke the profile of a lost device, regenerate the revocation list and restart OpenVPN:

```bash
cd /etc/openvpn/easy-rsa
sudo env EASYRSA_BATCH=1 ./easyrsa revoke client
sudo env EASYRSA_BATCH=1 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
sudo install -o root -g openvpn -m 640 pki/crl.pem /etc/openvpn/server/crl.pem
sudo systemctl restart openvpn-server@server

```

### Install the client app

The VPN server runs on your VPS, but every computer that connects to it also needs a client app.

For **WireGuard** , install the official app from the WireGuard download page:

- Windows and Linux: [wireguard.com/install](https://www.wireguard.com/install/)

For **OpenVPN** , choose the client for your device:

- Windows and Linux: install [OpenVPN Connect](https://openvpn.net/client/) for free. This official client accepts `.ovpn` profiles generated by OpenVPN Community Edition and does not require a subscription.
- On a Linux computer with NetworkManager, you can also install `network-manager-openvpn` and import the profile from the network settings. This integration handles DNS better than simply starting OpenVPN from the command line.

On a computer, the idea is simple: copy the configuration file generated by the VPS, then import it into the client app. WireGuard uses a `.conf` file, OpenVPN uses a `.ovpn` file.

### Security best practices

A VPN gives access to your private network. Treat every client profile as a sensitive key.

- Never share a WireGuard `.conf` file or an OpenVPN `.ovpn` file publicly.
- Create one profile per device.
- Revoke the profile of a lost device immediately.
- Delete unencrypted copies of profiles left on the VPS and your computer after import, unless they are kept in encrypted storage.
- Protect the passphrase and an encrypted backup of the OpenVPN certificate authority: its private key can sign new profiles.
- For a sensitive or multi-user deployment, ideally keep the OpenVPN certificate authority on a separate offline machine.
- A full tunnel is not automatically a kill switch: enable the client’s block-outside-VPN option or always-on VPN mode if no traffic may escape when the tunnel drops.
- Keep SSH open only to the IP addresses that need it when possible.
- Update the VPS regularly.
- Keep a copy of your client profiles in encrypted storage.

For personal use, WireGuard is often the easiest and smoothest solution. OpenVPN remains useful when you need to cross restrictive networks or keep compatibility with an existing setup. In both cases, a VPS gives you the freedom to host your own private gateway, with your own rules, ports and access control.

If you need a server for this kind of setup, you can start with a [BoxToPlay VPS server](https://www.boxtoplay.com/en/vps-hosting/vps-server) with a dedicated IP, root access, backups and a configurable hardware firewall.