Introduction to Running an OpenVPN Server
Virtual Private Networks (VPNs) can be utilized for a number of very useful applications. You can securely connect to any public WiFi hotspot. You can overcome geo-blocking restrictions on your favourite websites. And you can even connect to your home or office network from anywhere in the world, as if you were sitting right at your desk. This guide will walk you through the process of setting up your own OpenVPN server, and connecting to it with your copy of Viscosity.
Running your own OpenVPN server will allow you to encrypt everything you do on the internet, so that you can safely do your online banking on the free WiFi at your favourite cafe. If you connect to a public WiFi hotspot without using a VPN, then you are at risk of anyone else connected to that hotspot seeing everything you do, including reading any login details you may use (including your password!). However, with an OpenVPN server set up at home, you can connect to it from a public WiFi hotspot and protect your confidential details from eavesdropping. Anything you send over the VPN connection will be encrypted from your device until it reaches your OpenVPN server at home, where it will be decrypted and sent out to its destination, as if you were sitting in the comfort of your own home. Any files you access on your home/office network will also be encrypted as they travel through the internet. Setting up your OpenVPN server to access your home/office network gives you full access to all your files on your network. It's like having your own personal cloud, where you control it 100%.
Please be aware that we cannot provide any direct support for setting up your own OpenVPN server. We provide the information below and our server guides as a courtesy to help you get started with running your own OpenVPN server, as well as to help you get the most out of your copy of Viscosity.
We thoroughly test the steps in our guides, but if you do find a problem, please let us know and we will do our best to correct it. If you are looking for further support, we recommend contacting your device manufacturer or a support forum for your device. We have added links to where you can find more help on the guides where it is available.
The first step to setting up your OpenVPN server is to decide why you want a VPN Server. We'll cover a couple of popular scenarios below. Which ever way you choose to go, we have a growing list of setup guides for OpenVPN in our setup guides section to help you get started.
Securing Your Traffic
If all you want to do is secure your traffic when out and about, the easiest thing to do is purchase a package from a VPN Service Provider. We have a list of providers that support Viscosity here. The advantage is you don't need to worry about setting up or maintaining the security of your own server, plus a provider has many locations to ensure you get the best connection.
If you'd like to go it alone, you have two options. The first is to rent a VPS or server. We won't cover these but there are plenty of suggestions online for reputable VPS or Server providers. A popular one is Amazon Web Services, though you may find this more expensive than simply purchasing a package from a VPN Service Provider.
The second is to use your home Internet connection to dial back to.
There are many reasons you might want to connect home. You can utilise your home internet connection when out and about, creating a secure connection when on public WiFi, or you may like to access files on a home server when not at home.
The biggest thing to keep in mind is that your download speeds while connected via a VPN back home are limited by your home Internet's upload speed. If you are on an ADSL connection for example, this can be quite slow. If you have a fibre connection however, this will usually be more than enough.
Many home routers now have VPN capability built in, we cover some of these routes in our setup guides section. If you don't have a home server, another option is to run up a Virtual Machine on your home computer with something like Virtual Box or even pick up a cheap computer like a Raspberry Pi.
You will also need to make modifications to your router, usually in the way of Port Forwarding. Check your home routers user manual for more information about how to do this for your model of router.
You can find some setup guides for OpenVPN in our setup guides section.
Where To Host Your VPN Server
The most cost effective way to setup your VPN server is at home on an existing PC or server you already have. Many routers also have inbuilt VPN support, check your router to see if it supports OpenVPN.
This also allows you to connect home to access files or resources within your home network. There are a few things to consider though:
- Your Internet Speed - When a client is connected to a VPN server, it's upload and download speeds are the opposite of your home Internet. For example if you are on ADSL, and only have 1mbit of upload speed, then the maximum speed a client can download at when connected to your server is 1mbit.
- Carrier Grade NAT - To be able to run a home VPN server, you need to have your own public IP address. Many Internet Service Providers (ISPs) save on costs by using Carrier Grade Nat, where multiple users share a single public IP address. You will need to query your ISP if they offer you a public IP address or you share one. If you are sharing an IP address via NAT, you cannot setup a VPN server at home.
- Dynamic IP Address - Many ISPs provide Dynamic IP addresses. This means that your public IP address for your internet can change regularly. There are a couple of ways around this. Many companies offer Dynamic DNS, which allows you to use a DNS address which is updated with your IP address when it changes. Another option is to request a static IP address from your ISP, though for many this will incur an additional cost.
The other option is renting a VPS or server space from a provider. The options are endless for where you can host your server and who with. Shop around and find one that suits your needs. We do recommend an absolute minimum of 512mb of RAM though to get decent performance out of your server.
If you set up your OpenVPN server at home, you are most likely behind NAT on your home router and/or it has it's own firewall, you will need to configure your router to permit VPN traffic. Due to the many different models of router and network configurations, we cannot provide a step by step guide on how to set up your router to allow VPN traffic. However there are a few settings you are likely to need to change, so we will outline them here.
As the the router will be directing all traffic to and from your OpenVPN server, you will need to set up port forwarding so that the OpenVPN server is externally accessible. Port forwarding may be under the section in your router management interface named 'Virtual Servers'. In general, you will want to forward any traffic incoming to the router on the OpenVPN port (1194). You will need to setup a rule to send any UDP traffic on these ports to the local IP address of your OpenVPN server (which is probably something like 192.168.0.x).
If you have set up port forwarding please also make a note of your external WAN IP address. This is the IP address assigned to your router by your Internet Service Provider (ISP). This address will be needed when configuring your connection in Viscosity below.
The other main router setting you will need to consider is static routing. Because you will have a VPN set up, there will be traffic sent to your router with a source or destination IP in the range 10.8.0.x. This traffic will need to have static routing in place to ensure that when a host recieves a request from the VPN client (on the 10.8.0.x subnet) and sends a response to that address, the router knows how to convert the 10.8.0.x IP address into an address it understands (i.e. 192.168.0.x). Thus you will need to setup a static routing rule that has the following properties:
Destination: 10.8.0.0 Subnet mask: 255.255.255.0 Default gateway: your-server-IP
where your-server-IP is the IP address of your OpenVPN server on the local network (something in the range 192.168.0.x).
Stand-Alone Server Setup
Most stand alone servers and some routers require you to connect to them remotely in order to configure them or transfer files.
For almost all connections for configuring your server, SSH is the best option.
For almost all connections for transferring files, SCP is the best option. Alternatively if you have local access to your server, you may wish to use a USB drive instead.
SSH From Mac
To SSH from a Mac device, you can use the preinstalled ssh program. This program can be accessed by first opening the terminal application. Press
space to bring up the spotlight search bar and type
terminal. Once in the Mac terminal, you can SSH into your server by typing:
ENTER. You will then be prompted for the root password before being logged in.
SCP From Mac
Alternatively, you can transfer a file via Terminal to the home directory on your server with a command like:
scp path/to/file [email protected]:~/
SSH From Windows
If you are using an up to date version of Windows 10, ssh is now built into Powershell. Press your Windows Key, type in
Powershell then press
Once the Powershell Console Window has opened, you can SSH into your server by typing:
ENTER. You will then be prompted for the root password before being logged in.
If you don't have access to SSH via Powershell, there are a couple of alternatives. If you will be using SSH regularly, we highly recommend installing the Windows Subsystem for Linux. Once installed, open your Linux installation of choice from the linked guide and connect as above.
Alternatively, one of the best free-to-use and lightweight clients is PuTTY. Download a copy of PuTTY and run it then follow the onscreen prompts to connect via SSH to your server.
SCP From Windows
We highly recommend using a graphical user interface like WinSCP.
Alternatively, if you are using an up to date version of Windows 10, SCP is built into Powershell, or Windows Subsystem for Linux, you can use a command like:
scp C:\path\to\file [email protected]:~/
Accessing Network Resources
Once connected to your VPN server back to your home network, you can access your files or other services by using the LAN IP address you would use if you were connected to them via your home/office local network.
Connect via Mac
To connect to a shared network directory from your Mac connected to the VPN:
- Open a Finder window
- Click Go on the menu bar and select "Connect to Server..."
- In the Server Address, type the LAN IP address of your network resource (something like 192.168.0.x) and click
- Enter the username and password for the network resource
- Select the shared volume you want to access and click
Network resources you would normally find appearing in the Finder sidebar will not appear when connected to via the VPN. You can find connected network resources in the Computer directory. In a Finder window, press
c to jump to the Computer directory.
Connect via Windows
To connect to a shared network directory from your PC connected to the VPN:
- Type the
\\lan-ip-addressinto the Search the web and Windows box in the taskbar and press
Enter(something like \\192.168.0.x)
- Enter the username and password for the network resource
- You will then see the folders shared by this host
Choosing a Server Device
A question we get from time to time is what device should I purchase for a home or office OpenVPN Server? Unfortunately, there is no one size fits all solution. There are however two general rules that will decide what device you purchase, these being price and performance.
The vast majority of modern home routers support OpenVPN and have ample performance for using when you're out and about. Check with your router manufacturer if they support OpenVPN first, configure a server and give it a test, you may find it does everything you want, fast enough, and you won't need to spend a cent!
If your home router doesn't support OpenVPN, you may already have a NAS or server at home like a Synology Diskstation which could be a better alternative performance wise to a router, it just requires a few extra steps to setup.
If you don't have any devices that support OpenVPN, first weigh up if you need or want a home NAS, if you do, this is your best option. If you don't, a new router for home use is the most cost effective option. Just keep in mind your download speed when you're connected back home when you're out and about is restricted by your home internet upload speeds and the speeds of the public WiFi you're connected to. Most routers will be fast enough for one or two users to adequately surf the internet securely when away from home and download some files.
For an Office
An OpenVPN server for an office is a little more tricky. If you need half a dozen people or more connected to the server at once, a basic router simply won't cut it. They don't have enough CPU performance to encrypt/decrypt the traffic of several simultaneous users.
If you have an office server already for email, consider putting your OpenVPN server on this if you can secure it to only allow public access to the OpenVPN server port. You may even be able to run up a virtual machine on your server with Docker or VMWare. Many businesses use Synology Diskstations which can handle several users without a problem as well if it's a modern device.
If you're starting from scratch, again it will most likely come down to price and performance. There are enterprise grade routers and firewall devices like Sophos Firewalls or pfSense Firewalls which are designed to both secure your network and allow OpenVPN users to connect, both are available as ready to install devices or more custom hardware setups along with other products. A firewall device is our general recommendation for small-medium business. If you have an in-house IT team or use the services of a professional IT support business, we recommend having a chat to them to see what they recommend if you're not comfortable going it alone.