VPN Server Setup Checklist

In short: a VPN server for your business needs a server with a static IP, a VPN package (OpenVPN or WireGuard), NAT so that clients can reach the internet through the tunnel, per-user credentials and a firewall that only exposes the VPN port. The steps below follow that order on an Ubuntu or Debian VDS.

Step 1: prepare the server

Use a server with a fixed public IP address; a Cloud VDS with 1 GB of RAM is enough for a small team. Linux is the usual choice. Update the system and install the package:

sudo apt update && sudo apt upgrade -y
sudo apt install openvpn easy-rsa

Step 2: create the certificates

OpenVPN authenticates with certificates. Easy-RSA creates the certificate authority (CA), the server certificate and one certificate per user:

make-cadir ~/easy-rsa && cd ~/easy-rsa
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa build-server-full server nopass
./easyrsa build-client-full client1 nopass
./easyrsa gen-dh
openvpn --genkey secret ta.key

Copy ca.crt, server.crt, server.key, dh.pem and ta.key to /etc/openvpn/server/.

Step 3: configure the server

Start from the sample server.conf shipped with OpenVPN: set the port (1194 UDP by default), the tunnel network (server 10.8.0.0 255.255.255.0) and, if clients should send all traffic through the VPN, push "redirect-gateway def1" plus a DNS server. Enable IP forwarding in /etc/sysctl.conf (net.ipv4.ip_forward=1) and apply it with sysctl -p.

Step 4: NAT and firewall

Clients get addresses in 10.8.0.0/24; the server must translate them to its public address so they can reach the internet:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Replace eth0 with the real interface name (ip route get 1.1.1.1 shows it). In the firewall open only the VPN port and SSH; everything else stays closed. With UFW: ufw allow 1194/udp and ufw allow OpenSSH. Our UFW guide covers the rest.

Step 5: user access

Give each person their own certificate (./easyrsa build-client-full name nopass) and bundle it into an .ovpn profile with the CA certificate and ta.key. When someone leaves, revoke the certificate with ./easyrsa revoke name and regenerate the CRL; never share one profile between people.

Step 6: harden and monitor

• Run the service as an unprivileged user (user nobody, group nogroup in server.conf).
• Keep logs (status /var/log/openvpn/status.log) and check who is connected.
• Update the server regularly and keep an off-server backup of the CA; losing it means reissuing every user.
• Consider WireGuard for new setups: fewer moving parts, faster, and a configuration that fits in ten lines.

Step 7: test and roll out

Connect from a phone on mobile data and from a laptop at home; confirm the public IP changes to the server's address and internal systems are reachable. Measure speed, then close the management ports of your other servers to everything except the VPN network.

A well-configured VPN lets staff reach the company network safely from anywhere and keeps your servers' admin ports off the public internet. For choosing between self-hosted and commercial options see VPN solutions for business.