[opensourcedex]

openvpn-install is a free, open source networking & connectivity project written in Shell and released under MIT. It has 16,133 GitHub stars, 3,336 forks and 24 open issues, and was last pushed 2 days ago. On this registry it ranks #7 of 14 tracked projects in Networking & Connectivity, with 5 head-to-head comparisons available.

What is openvpn-install?

openvpn-install is an MIT-licensed Bash script that installs and manages a self-hosted OpenVPN server on Debian, Ubuntu, Fedora, openSUSE, CentOS, Amazon Linux, Arch Linux, Oracle Linux, Rocky Linux and AlmaLinux, aimed at anyone who runs their own VPS, dedicated server or home machine and wants to generate VPN client configuration files per device.

What it is

openvpn-install is a shell script that stands up an OpenVPN server on a machine the operator already controls, and then keeps managing it: issuing and renewing client and server certificates, listing connected clients, revoking access, and handling the firewall and forwarding rules the tunnel needs. It lives in the Linux sysadmin and self-hosting ecosystem rather than in the container or orchestration world, and it targets the distro families listed in its compatibility table. Configuration is driven from a command-line interface, so the same script serves both interactive setup and scripted, non-interactive provisioning.

The concrete thing it replaces is manual OpenVPN deployment: hand-editing server.conf, generating a CA and certificates, wiring up NAT and forwarding, and then repeating that work every time a client is added or revoked. It also replaces third-party or vendor VPN services for users who would rather terminate the tunnel on their own hardware. It exposes three access paths independently — internet routing to the wider internet, communication between VPN clients, and access to selected server-side networks — with internet routing enabled by default and the other two opt-in and limited to explicit CIDRs.

Key capabilities

  • Installs and configures a ready-to-use OpenVPN server across the supported Linux distributions.
  • CLI interface for automation and scripting, including a non-interactive mode with JSON output.
  • Certificate renewal for both client and server certificates, plus a client list and connection monitoring.
  • Immediate client disconnect on certificate revocation via the OpenVPN management interface.
  • Independent access policies for internet routing, client-to-client access, and selected server-side networks.
  • TCP or UDP tunnels, configurable VPN subnets (IPv4 default 10.8.0.0/24, IPv6 default fd42:42:42:42::/112) and configurable tunnel MTU (default 1500).
  • Firewall and forwarding handled natively with firewalld and nftables, with an iptables fallback, plus unprivileged mode running as nobody/nogroup and peer fingerprint authentication on OpenVPN 2.6 or newer.

Who uses it and how

  • Self-hosters running a VPS, dedicated server or home machine who want the tunnel endpoint on hardware they own.
  • Users on restrictive networks where UDP is blocked — corporate networks, airports, hotels — who need TCP transport.
  • Environments with legacy or older client platforms, where OpenVPN clients exist for nearly every system.
  • Setups needing password-protected private keys, which WireGuard configurations cannot offer since they store the key in plain text.
  • Operators granting several devices the same client profile at once, by disabling persistent IP addresses.

Getting started

The repository ships as a Bash script run directly on the target server; no Docker image or hosted option is part of the project. Distribution packages come from the official OpenVPN repositories where possible, so the script installs the latest stable release.

How it compares

The README names one comparable tool: wireguard-install, by the same author, which implements the WireGuard protocol. WireGuard is described as simpler and faster for most use cases, while OpenVPN remains the choice when TCP support, password-protected private keys or legacy client compatibility matter.

When to use it — and when not to

A self-hoster takes on the server itself, including firewall and forwarding changes, certificate lifecycle management, the choice of DNS resolver to push to clients, and distribution of client configuration files. Anyone who wants a fully managed, hosted VPN service should look elsewhere, and users whose needs WireGuard already covers should prefer the simpler and faster protocol. The script can also cleanly remove OpenVPN, including its configuration and firewall rules, which is convenient but confirms how much of the host's networking configuration it owns.

project readme (upstream, from github) — read inline

openvpn-install

Say Thanks!

OpenVPN installer for Debian, Ubuntu, Fedora, openSUSE, CentOS, Amazon Linux, Arch Linux, Oracle Linux, Rocky Linux and AlmaLinux.

This script will let you setup and manage your own secure VPN server in just a few seconds.

What is this?

This script is meant to be run on your own server, whether it's a VPS or a dedicated server, or even a computer at home.

Once set up, you will be able to generate client configuration files for every device you want to connect.

Internet routing, access between VPN clients, and access to selected server-side networks can be configured independently. By default, internet routing is enabled and the other paths are disabled.

flowchart LR
  A[Phone] -->|Encrypted| VPN
  B[Laptop] -->|Encrypted| VPN
  C[Computer] -->|Encrypted| VPN

  VPN[OpenVPN Server]

  VPN -->|Internet routing<br/>Default: enabled| I[Internet]
  VPN -.->|Explicit CIDRs only<br/>Default: disabled| LAN[Home LAN or cloud VPC]
  VPN -.->|Client-to-client access<br/>Default: disabled| PEERS[Other VPN clients]

The solid destination path is enabled by default. Dashed destination paths are opt-in.

Why OpenVPN?

OpenVPN was the de facto standard for open-source VPNs when this script was created. WireGuard came later and is simpler and faster for most use cases. Check out wireguard-install.

That said, OpenVPN still makes sense when you need:

  • TCP support: works in restrictive environments where UDP is blocked (corporate networks, airports, hotels, etc.)
  • Password-protected private keys: WireGuard configs store the private key in plain text
  • Legacy compatibility: clients exist for pretty much every platform, including older systems

Features

  • Installs and configures a ready-to-use OpenVPN server
  • CLI interface for automation and scripting (non-interactive mode with JSON output)
  • Certificate renewal for both client and server certificates
  • List and monitor connected clients
  • Immediate client disconnect on certificate revocation (via management interface)
  • Uses official OpenVPN repositories when possible for the latest stable releases
  • Firewall rules and forwarding managed seamlessly (native firewalld and nftables support, iptables fallback)
  • Independent access policies for internet routing, communication between VPN clients, and selected server-side networks
  • Configurable VPN subnets (IPv4: default 10.8.0.0/24, IPv6: default fd42:42:42:42::/112)
  • Configurable tunnel MTU (default: 1500)
  • If needed, the script can cleanly remove OpenVPN, including configuration and firewall rules
  • Customisable encryption settings, enhanced default settings (see Security and Encryption below)
  • Uses latest OpenVPN features when available (see Security and Encryption below)
  • Variety of DNS resolvers to be pushed to the clients
  • Choice to use a self-hosted resolver with Unbound (supports already existing Unbound installations)
  • Choice between TCP and UDP
  • Flexible IPv4/IPv6 support:
    • IPv4 or IPv6 server endpoint (how clients connect)
    • IPv4-only, IPv6-only, or dual-stack clients (VPN addressing and internet access)
    • All combinations supported: 4→4, 4→4/6, 4→6, 6→4, 6→6, 6→4/6
    • Automatic leak prevention: blocks undesired protocol in single-stack modes
  • Unprivileged mode: run as nobody/nogroup
  • Block DNS leaks on Windows 10
  • Randomised server certificate name
  • Choice to protect clients with a password (private key encryption)
  • Option to allow multiple devices to use the same client profile simultaneously (disables persistent IP addresses)
  • Peer fingerprint authentication (OpenVPN 2.6+): Simplified WireGuard-like authentication without a CA
  • Many other little things!

Compatibility

The script supports these Linux distributions:

Support
AlmaLinux >= 8 ✅ 🤖
Amazon Linux 2023 ✅ 🤖
Arch Linux ✅ 🤖
CentOS Stream >= 8 ✅ 🤖
Debian >= 11 ✅ 🤖
Fedora >= 40 ✅ 🤖
openSUSE Leap >= 16 ✅ 🤖
openSUSE Tumbleweed ✅ 🤖
Oracle Linux >= 8 ✅ 🤖
Rocky Linux >= 8 ✅ 🤖
Ubuntu >= 18.04 ✅ 🤖

To be noted:

  • The script is regularly tested against the distributions marked with a 🤖 only.
    • It's only tested on amd64 architecture.
  • The script requires systemd.

Recommended providers

  • Vultr: Worldwide locations, IPv6 support, starting at $2.5/month
  • Hetzner: Worldwide locations, IPv6, 20 TB of traffic, starting at €3.59/month
  • Digital Ocean: Worldwide locations, IPv6 support, starting at $4/month

Usage

First, download the script on your server and make it executable:

curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh

You need to run the script as root and have the TUN module enabled.

Interactive Mode

The easiest way to get started is the interactive menu:

./openvpn-install.sh interactive

This will guide you through installation and client management.

In your home directory, you will have .ovpn files. These are the client configuration files. Download them from your server (using scp for example) and connect using your favorite OpenVPN client.

If you have any question, head to the FAQ first. And if you need help, you can open a discussion. Please search existing issues and discussions first.

CLI Mode

[!WARNING] API compatibility is not guaranteed. Breaking changes may occur between versions. If you use this script programmatically (e.g., in automation or CI/CD), pin to a specific commit rather than using the master branch.

For automation and scripting, use the CLI interface:

# Install with defaults
./openvpn-install.sh install

# Add a client
./openvpn-install.sh client add alice

# List clients
./openvpn-install.sh client list

# Revoke a client (immediately disconnects if connected)
./openvpn-install.sh client revoke alice
Commands
openvpn-install <command> [options]

Commands:
  install       Install and configure OpenVPN server
  uninstall     Remove OpenVPN server
  client        Manage client certificates
  server        Server management
  interactive   Launch interactive menu

Global Options:
  --verbose     Show detailed output
  --log <path>  Log file path (default: openvpn-install.log)
  --no-log      Disable file logging
  --no-color    Disable colored output
  -h, --help    Show help

Run ./openvpn-install.sh --help for command-specific options.

Client Management
# Add a new client
./openvpn-install.sh client add alice

# Add a password-protected client
./openvpn-install.sh client add bob --password

# Revoke a client
./openvpn-install.sh client revoke alice

# Renew a client certificate
./openvpn-install.sh client renew bob --cert-days 365

List all clients:

$ ./openvpn-install.sh client list
══ Client Certificates ══
[INFO] Found 3 client certificate(s)

   Name      Status   Expiry      Remaining
   ----      ------   ------      ---------
   alice     Valid    2035-01-15  3650 days
   bob       Valid    2035-01-15  3650 days
   charlie   Revoked  2035-01-15  unknown

JSON output for scripting:

$ ./openvpn-install.sh client list --format json | jq
{
  "clients": [
    {
      "name": "alice",
      "status": "valid",
      "expiry": "2035-01-15",
      "days_remaining": 3650
    },
    {
      "name": "bob",
      "status": "valid",
      "expiry": "2035-01-15",
      "days_remaining": 3650
    },
    {
      "name": "charlie",
      "status": "revoked",
      "expiry": "2035-01-15",
      "days_remaining": null
    }
  ]
}
Server Management
# Renew server certificate
./openvpn-install.sh server renew

# Uninstall OpenVPN
./openvpn-install.sh uninstall

Show connected clients (data refreshes every 60 seconds):

$ ./openvpn-install.sh server status
══ Connected Clients ══
[INFO] Found 2 connected client(s)

   Name    Real Address          VPN IP      Connected Since   Transfer
   ----    ------------          ------      ---------------   --------
   alice   203.0.113.45:52341    10.8.0.2    2025-01-15 14:32  ↓1.2M ↑500K
   bob     198.51.100.22:41892   10.8.0.3    2025-01-15 09:15  ↓800K ↑200K

[INFO] Note: Data refreshes every 60 seconds.
Install Options

The install command supports many options for customization:

## Custom

readme truncated — read the full docs on github

Frequently asked questions

Is openvpn-install free to use?

openvpn-install is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does openvpn-install do?

Set up your own OpenVPN server on Debian, Ubuntu, Fedora, CentOS, Arch Linux and more

What is openvpn-install written in?

openvpn-install is primarily written in Shell. Its source is publicly available at https://github.com/angristan/openvpn-install, and it has 16,133 GitHub stars.