Every time you connect to the internet, you rely on a chain of networks and services you do not necessarily control. Your internet provider, the Wi-Fi network you are using, your VPN provider, and the websites you visit all have different levels of visibility into your activity.

A self-hosted VPN gives you another option: operate your own encrypted connection to a server in a location you choose. Instead of relying on a commercial VPN provider to operate the endpoint, you rent a small virtual private server (VPS) and administer the VPN yourself.

This tutorial uses OpenVPN Access Server, which includes a web-based administration interface, user management, and client profile distribution. It is different from the free, community-managed OpenVPN software, which uses a different setup process.

In this guide

1. How a self-hosted VPN works

A VPN creates an encrypted tunnel between your device and the VPN server. With full-tunnel routing enabled, your internet traffic travels through that tunnel before leaving the server for its destination.

With a correctly configured full tunnel, websites generally see your VPS's public IP address instead of the public IP address of the network you are currently using.

Access Server versus Community Edition

2. Choose the right small VPS

For personal browsing and a few devices, a small VPS is a sensible starting point. Actual performance depends on traffic volume, encryption workload, CPU capacity, and your provider's network.

• Operating system: Ubuntu Server 24.04 LTS, provided it remains supported by the installed Access Server release.
• Memory: 1 GB can be a starting point for light use; allow more for additional services or users.
• CPU: One virtual CPU may be enough for light use, but benchmark actual throughput.
• Networking: A public IP address and permission to receive VPN traffic.
• Storage: SSD storage with room for updates, logs, and backups.
• Domain: Recommended for a stable hostname and trusted TLS certificate.
• Provider controls: Access to a cloud firewall and recovery console.

Check your provider's monthly outbound transfer allowance, acceptable-use policy, IP address charges, and permitted ports. Streaming and downloads can consume substantial bandwidth.

Point your domain to the VPS

Create an A record for a hostname such as vpn.example.com and point it to your VPS's public IPv4 address. Replace the example hostname throughout this guide with your own.

dig +short vpn.example.com

The returned address should match the VPS's public IPv4 address. If you have not configured DNS yet, use the address supplied by your hosting provider for the initial connection.

3. Prepare and secure Ubuntu

Connect to the VPS using SSH. Replace the example username and IP address with your actual server details.

ssh YOUR_ADMIN_USER@YOUR_SERVER_IP

Update Ubuntu and install basic security tools:

sudo apt update
sudo apt full-upgrade -y
sudo apt install -y ufw unattended-upgrades

Review the upgrade output and reboot if required. Keep your provider's browser-based console available while changing firewall rules.

Configure the host firewall

Access Server commonly uses UDP 1194 for VPN connections and TCP 443 for VPN fallback or web-service forwarding. TCP 943 is commonly used for the web interfaces. Actual requirements depend on your configuration.

# Allow SSH before enabling UFW.
sudo ufw limit 22/tcp

# Allow the standard OpenVPN UDP listener.
sudo ufw allow 1194/udp

# Permit TCP fallback if you intend to use it.
sudo ufw allow 443/tcp

# Optional: restrict administration to your public IP.
# Replace the documentation example with your actual IP.
sudo ufw allow from 198.51.100.25 to any port 943 proto tcp

# Set default firewall policies.
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Review the rules before enabling the firewall.
sudo ufw status numbered
sudo ufw enable
sudo ufw status verbose

The address 198.51.100.25 is a documentation-only placeholder, not your actual IP. Do not copy it as a real access rule. If you do not know your current public IP, skip the optional rule until you have identified it and planned your administration access.

4. Install OpenVPN Access Server

Use the vendor's official package repository. The commands below follow the official manual installation method for Ubuntu 24.04 (Noble). Check the official instructions first if you use a different release or CPU architecture.

sudo apt update
sudo apt install -y ca-certificates wget gnupg

sudo install -d -m 0755 /etc/apt/keyrings

sudo wget -qO /etc/apt/keyrings/as-repository.asc \
  https://packages.openvpn.net/as-repo-public.asc

Add the official repository. This command uses the machine's Debian package architecture and the Ubuntu 24.04 repository codename, Noble.

ARCH=$(dpkg --print-architecture)

echo "deb [arch=${ARCH} signed-by=/etc/apt/keyrings/as-repository.asc] http://packages.openvpn.net/as/debian noble main" \
| sudo tee /etc/apt/sources.list.d/openvpn-as-repo.list

sudo apt update
sudo apt install -y openvpn-as

This repository configuration is specifically for Ubuntu 24.04. Do not use noble on a different Ubuntu release.

Check the service

sudo systemctl status openvpnas --no-pager

A running service is a useful first check, but it does not prove that the firewall, client configuration, or internet routing is correct.

5. Complete the initial configuration

The installer displays the administration and client web interface addresses along with initial account information. Save the credentials securely. Never publish them in a tutorial or screenshot.

The administration URL usually follows this pattern:

https://vpn.example.com:943/admin/

Replace the example hostname with yours. The Client Web UI usually uses the same hostname without /admin/.

Configure the public hostname

In the Access Server administration interface, configure the public hostname clients should use. Make sure the hostname resolves to the correct address and that the relevant ports are accessible. Save and apply changes when prompted.

Exact menu labels can differ between versions. Follow the documentation for your installed release instead of assuming every version has identical menus.

Protect administrator access

• Use a unique administrator password stored in a password manager.
• Enable multi-factor authentication where supported by your edition and identity configuration.
• Keep recovery credentials secured separately.
• Restrict administration to trusted source IP addresses where practical.
• Use a trusted TLS certificate for your public hostname.
• Review administrator accounts and permissions regularly.

6. Route all internet traffic through your VPS

Installing a VPN server does not automatically configure a full tunnel. Some configurations provide access only to selected private networks. If you want ordinary internet traffic to exit through your VPS, explicitly enable full-tunnel routing.

In the Access Server administration interface:

1. Open the VPN or Internet Access settings.
2. Enable the setting that routes client internet traffic through the VPN.
3. Configure the DNS resolvers that connected clients should use.
4. Retain the normal Access Server NAT behavior for a simple internet-exit server unless your network design requires different routing.
5. Save the settings and apply the changes.

Why DNS matters

DNS translates hostnames into IP addresses. A connection can appear to use a VPN while DNS queries still go to a resolver on the local network. That can expose browsing-related metadata to the local network operator.

Configure the resolver intentionally and test the actual client. A public DNS service is not automatically private just because it is popular. Consider its operator, logging policy, and privacy implications.

7. Connect your devices

Create a separate user or client identity for each person or device using Access Server's user-management interface. Download the appropriate profile through the Client Web UI and import it into OpenVPN Connect or another compatible client.

8. Verify the VPN is actually working

Do not rely solely on a green “Connected” indicator. Test the public address, routing, DNS behavior, and IPv6 from a client connected to the VPN.

Test 1: Compare your public IPv4 address

On Linux or macOS, run this before connecting to the VPN and again after connecting:

curl -4 https://ifconfig.co

After connecting, the address should normally match your VPS's public IPv4 address. If it does not, check the full-tunnel setting, the selected profile, and whether a proxy or another network path is in use.

Test 2: Inspect routes and DNS on Linux

ip route
resolvectl status

Compare the output before and after connecting. Look for the expected VPN route and configured resolver. The precise output depends on your Linux distribution and VPN client.

Test 3: Inspect server listeners

sudo ss -lntup | grep -E ':(443|943|1194)\b'

This displays matching TCP and UDP listeners. It does not prove that external clients can reach them; check provider firewall rules and perform a real connection test.

Test 4: Check DNS leaks and IPv6

• Use a reputable DNS leak testing service while connected.
• Confirm that displayed resolvers match your intended configuration.
• Test IPv4 and IPv6 separately where IPv6 is available.
• Check that the client does not have an unintended direct route around the tunnel.

9. Troubleshooting common problems

The VPN will not connect

• Confirm that Access Server is running.
• Verify that the hostname resolves to the correct public address.
• Check the VPS provider firewall and Ubuntu firewall.
• Confirm that the selected transport and port match the server configuration.
• Inspect the client log for certificate, authentication, or timeout errors.

The VPN connects but internet access stops

• Confirm that full-tunnel routing is enabled.
• Check DNS configuration and resolver reachability.
• Verify Access Server's routing and NAT settings.
• Check for conflicting private-network address ranges.

The connection works on one network but not another

Some networks block UDP VPN traffic. UDP is usually preferred for normal use; TCP 443 can be a useful fallback when UDP is blocked. TCP is not automatically faster, more private, or capable of defeating advanced traffic inspection.

Some websites or applications stall

Check client and server logs before changing MTU values or encryption settings. Path MTU issues can affect certain connections, but random changes make diagnosis harder. Test one documented change at a time.

Useful server diagnostics

sudo systemctl status openvpnas --no-pager
sudo journalctl -u openvpnas -n 100 --no-pager
sudo ufw status verbose

Review logs around the time of the failed connection. Redact public IPs, usernames, tokens, credentials, and sensitive configuration details before sharing diagnostic output.

10. Maintain and secure your VPN

A personal VPN still faces internet scanning, software vulnerabilities, account compromise, and accidental misconfiguration. Security is an ongoing task, not a one-time installation step.

• Install Ubuntu security updates regularly.
• Monitor Access Server updates and relevant security advisories.
• Keep an encrypted, access-controlled backup of configuration and recovery instructions.
• Protect client profiles and revoke lost or retired devices.
• Use a trusted TLS certificate and monitor certificate renewal.
• Restrict administrative access and review permissions periodically.
• Monitor CPU utilization, memory pressure, network usage, and transfer limits.
• Test VPN connectivity and DNS behavior after important updates.
• Keep provider console and account recovery details accessible.

Before changing firewall or routing configuration remotely, preserve a working recovery session. Store encrypted backups somewhere other than the VPS itself; a backup on the same machine will not help if that machine becomes inaccessible.

11. What your self-hosted VPN does—and does not—protect

12. Is a small VPS worth it?

For someone who wants a personal endpoint, a stable public IP, or additional protection on untrusted networks, self-hosting can be a useful project. It also teaches practical skills in Linux administration, routing, firewall management, certificate handling, and troubleshooting.

The trade-off is responsibility. You maintain the server, pay for bandwidth, manage access, monitor updates, and depend on the VPS provider's infrastructure. If you need many exit locations or a service designed for anonymity, a personal VPS may not replace a commercial VPN or other privacy tools.

Official documentation and further reading

• OpenVPN Access Server — Installation documentation
• OpenVPN Access Server — Ubuntu instructions
• OpenVPN Access Server — Official documentation
• OpenVPN Connect — Official client downloads
• Ubuntu Server — Official documentation
• Unsplash — License information

This tutorial is educational and assumes you administer the VPS and have permission to configure its network. Verify commands and product settings against the documentation for your installed versions. Never publish private keys, administrator credentials, or client VPN profiles.

Tags: #OpenVPN #VPS #Linux #Ubuntu #Cybersecurity #SelfHosting #DigitalPrivacy #Networking