Easy OpenVPN Server

A plug-and-play OpenVPN server that "Just Works" and has secure defaults.

Install the snap, download the client config and connect!

• Supports both IPv4 and IPv6 with secure encryption and DDoS protection.
• Defaults to a fast udp connection. If that is blocked, clients will fall back to a more covert tcp connection that mimicks HTTPS.
• Generates .ovpn client config files that work on Linux, Windows, Mac, Android and iOS.

Getting Started

1. Install the snap on the server.

sudo snap install easy-openvpn-server

2. Export the client config.

(umask 077; sudo easy-openvpn-server show-client default > default.ovpn)

3. Import the .ovpn config file into the VPN application of your device and connect!

By default, all the traffic of your device will go over the VPN.

If you don't want this, run

sudo snap set easy-openvpn-server push-default-gateway=False.

Changing the public address

The snap will do its best to figure out what the public address of the server is. However, when that fails, you can manually set the public address.

sudo snap set easy-openvpn-server public-address=example.com

Managing clients

The snap automatically creates a client profile and config with the name default. However, it's recommended to create a separate client profile for each user. This way, you can revoke the client profile when that user does not need access to the VPN anymore.

sudo easy-openvpn-server add-client alice

(umask 077; sudo easy-openvpn-server show-client alice > alice.ovpn)

sudo easy-openvpn-server remove-client alice

Changing ports

By default the server runs on port 443/tcp (https) and 1194/udp (OpenVPN). If those ports are already used, you can change which ports the server runs on.

sudo snap set easy-openvpn-server udp-server.port=1234

sudo snap set easy-openvpn-server tcp-server.port=80

More options

You can specify additional search domains.

sudo snap set easy-openvpn-server additional-search-domains="test"

Firewall

VPN clients can't reach the cloud metadata service of the server, because it hands out the server's cloud credentials. By default, VPN clients also can't reach each other. If you want them to, run

sudo snap set easy-openvpn-server firewall.client-to-client=true

Client-specific rules and access policies

You can give individual clients specific policies by creating a file with the name of that client in the following directory.

/var/snap/easy-openvpn-server/common/ccd/

For example, if you want the client sysadmin to always have the IP 10.8.1.1, then add the following line to the file /var/snap/easy-openvpn-server/common/ccd/sysadmin

ifconfig-push 10.8.1.1 10.8.1.2

The address has to be inside the tunnel network of the server the client connects to. The udp and tcp servers each have their own network, which you can see with sudo snap get easy-openvpn-server internal.udp.tun-network and sudo snap get easy-openvpn-server internal.tcp.tun-network.

Note: if you want to change the default config for all clients, you can add these changes in the file /var/snap/easy-openvpn-server/common/ccd/DEFAULT