Installing OpenVPN on a Debian or Ubuntu VPS running OpenVZ is straightforward with automated scripts that handle configuration, user management, and security settings in under 5 minutes. OpenVPN provides a secure, reliable VPN solution that runs over a single port, supports compression, tunnels over NAT, and offers enterprise-grade encryption for protecting your internet traffic.
This guide walks you through setting up OpenVPN on your OBHost VPS using an automated installation script that configures everything from port forwarding to authentication, even if you have minimal Linux experience.
What is OpenVPN?
OpenVPN is an open-source VPN protocol that creates secure point-to-point or site-to-site connections in routed or bridged configurations. Unlike other VPN solutions, OpenVPN can operate over a single TCP or UDP port, making it highly versatile for different network environments. It uses SSL/TLS for key exchange and supports various authentication methods including certificates and username/password combinations.
The protocol excels at bypassing firewalls and NAT routers while maintaining strong encryption standards. Its ability to run on port 53 (DNS) or port 443 (HTTPS) makes it particularly effective at circumventing restrictive networks and captive portals.
Key Features of This Installation
The automated OpenVPN installation script provides several important features that simplify deployment and management:
- Automatic .ovpn file generation: Creates complete configuration files with inline certificates, eliminating the need to manage separate certificate files
- Google DNS integration: Configures DNS servers automatically to prevent DNS leaks and ensure reliable name resolution
- Port 53 option: Includes a captive portal bypass server configuration that routes traffic over DNS port 53
- User management: Allows you to add multiple VPN users by re-running the script after initial installation
- Complete automation: Handles port forwarding, firewall rules, server configuration, and certificate generation without manual intervention
Step 1: Verify TUN/TAP Module Support
Before installing OpenVPN, you must ensure your VPS has the TUN/TAP module enabled. This kernel module is essential for creating virtual network interfaces that OpenVPN uses to route encrypted traffic.
Log in to your VPS via SSH and run this command:
cat /dev/net/tun
If your TUN module is properly configured, you should see this output:
cat: /dev/net/tun: File descriptor in bad state
This error message actually indicates success—it means the TUN device exists and is accessible. If you receive "No such file or directory" instead, the TUN module is not enabled.
Enabling TUN/TAP in Virtualizor
If the TUN module is not enabled, you can activate it through your Virtualizor control panel:
- Log in to your Virtualizor control panel using the credentials provided in your VPS welcome email
- Select your VPS from the list of virtual servers
- Click on "VPS Configuration" in the management menu
- Locate the "Enable Tun/Tap" checkbox and ensure it is checked
- Save the configuration changes and reboot your VPS if required
After enabling TUN/TAP, wait a few minutes for the changes to take effect, then verify again using the cat command above.
Step 2: Install OpenVPN Using the Automated Script
Once you have confirmed TUN/TAP support, installing OpenVPN requires just a single command. Connect to your VPS via SSH and execute:
wget https://raw.github.com/cwaffles/ezopenvpn/master/ezopenvpn.sh --no-check-certificate -O ezopenvpn.sh; chmod +x ezopenvpn.sh; ./ezopenvpn.sh
This command performs three actions in sequence:
- Downloads the installation script from the GitHub repository
- Makes the script executable with proper permissions
- Runs the automated installer
The installer will prompt you for several configuration options including:
- The protocol to use (UDP or TCP)
- The port number for OpenVPN to listen on
- DNS resolver preferences
- The first VPN username to create
Follow the on-screen prompts and choose options appropriate for your use case. UDP on port 1194 is the default and recommended configuration for most users, offering the best performance.
Step 3: Add Additional VPN Users
After the initial installation completes, you can create additional VPN users by running the same script again:
./ezopenvpn.sh
The script will detect the existing OpenVPN installation and offer options to add new users or revoke access for existing ones. Each user receives their own .ovpn configuration file containing all necessary certificates and settings in a single file.
Connecting to Your OpenVPN Server
After installation, you will find .ovpn configuration files in your home directory. Download these files to your client devices using SCP, SFTP, or another file transfer method.
To connect from different operating systems:
- Windows: Install OpenVPN GUI, right-click the system tray icon, and import your .ovpn file
- macOS: Use Tunnelblick or OpenVPN Connect, then import your configuration file
- Linux: Install openvpn package and run: sudo openvpn --config yourfile.ovpn
- Android/iOS: Install OpenVPN Connect app and import your .ovpn file
The single .ovpn file contains all certificates and keys inline, so you only need to import this one file to establish a connection.
Frequently Asked Questions
Why does my TUN check show "File descriptor in bad state" instead of "No such file or directory"?
The "File descriptor in bad state" message actually indicates that TUN/TAP is correctly enabled and working. This seemingly error message confirms the device exists and is accessible. Only "No such file or directory" indicates a problem requiring you to enable TUN/TAP in your control panel.
Can I change the OpenVPN port after installation?
Yes, you can modify the port by editing the /etc/openvpn/server.conf file and changing the "port" directive to your desired port number. After making changes, restart OpenVPN with: sudo systemctl restart openvpn@server. Remember to update your firewall rules and client .ovpn files to match the new port.
How do I remove a VPN user's access?
Run the installation script again (./ezopenvpn.sh) and select the option to revoke a client certificate. This prevents that specific .ovpn configuration file from connecting to your server. You can also manually revoke certificates using the OpenVPN easy-rsa tools located in /etc/openvpn/easy-rsa/.
What should I do if OpenVPN fails to start after installation?
Check the OpenVPN logs for error messages using: sudo journalctl -u openvpn@server -n 50. Common issues include port conflicts (another service using the same port), firewall blocking the port, or TUN/TAP not being properly enabled. Verify your configuration in /etc/openvpn/server.conf and ensure all prerequisites are met.
For assistance with OpenVPN installation or VPS configuration issues, the OBHost support team is available 24/7 at https://www.obhost.net/contact or via email at support@obhost.org.
