VPN SETUP GUIDES
OpenVPN Server on a Home Router: Step-by-Step Setup
WireGuard gets all the attention, but OpenVPN still earns its place on a home server: it's the protocol that connects when hotel firewalls block…
✓When OpenVPN beats WireGuard✓Building the certificate authority✓The server config
Quick Answer
An OpenVPN server at home is the fallback every traveler should run alongside WireGuard. It takes more work, an Easy-RSA certificate authority plus UDP and TCP/443 instances, but TCP/443 is the closest thing to an unblockable tunnel when hotel firewalls block everything else.
- Why bother: OpenVPN over TCP port 443 looks like ordinary HTTPS, so restrictive networks that filter WireGuard’s UDP wave it through.
- Architecture: WireGuard as primary, OpenVPN as the fallback profile; both run on the same box on different ports.
- The cost: TCP-over-TCP has real penalties on lossy networks, so treat the TCP profile as the emergency exit, not the daily driver.
- Security: Enable tls-auth, use AES-256-GCM, store the CA key offline, and revoke lost certs properly; HomeIPVPN builds both instances and verifies the kill switch.
WireGuard gets all the attention, but OpenVPN still earns its place on a home server: it's the protocol that connects when hotel firewalls block everything else. If you want to setup OpenVPN server home router style, as a fallback alongside (or instead of) WireGuard, here's the complete walkthrough.
When OpenVPN beats WireGuard
Let's be clear about why you'd bother, given WireGuard is faster and simpler:
- Restrictive networks. OpenVPN over TCP port 443 looks like ordinary HTTPS traffic. Hotel chains, corporate guest networks, and national firewalls that filter WireGuard's UDP usually wave it through, because blocking it would break normal browsing.
- Ancient client compatibility. OpenVPN runs on everything, including old devices WireGuard never will.
- Granular control. If you enjoy tuning, OpenVPN's configurability is unmatched.
For most home IP VPN users, the right architecture is WireGuard as primary and OpenVPN as the fallback profile on the travel router. This guide builds that fallback properly.
Building the certificate authority
OpenVPN's security rests on certificates, which means a little PKI ceremony up front. The easy path is Easy-RSA:
sudo apt install openvpn easy-rsa
make-cadir ~/openvpn-ca && cd ~/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca # create the Certificate Authority (keep its key safe)
./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-dh
openvpn --genkey secret ta.key # tls-auth key, blocks unauthenticated packetsThen one certificate per client device:
./easyrsa gen-req laptop nopass
./easyrsa sign-req client laptopGuard the CA key. Anyone with it can mint valid client certificates. Keep it offline or at least off the internet-facing server after issuing what you need. Losing control of it means rebuilding the whole PKI.
The server config
/etc/openvpn/server.conf (UDP instance, the fast one):
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
cipher AES-256-GCM
persist-key
persist-tunAnd a second instance for TCP/443 (the stealth one): copy the config, change proto tcp, port 443, and the dev/server subnet (e.g., 10.9.0.0) so the two instances don't collide. Two instances, two ports forwarded (UDP 1194 and TCP 443), one CA.
Enable IP forwarding and NAT masquerading exactly as with WireGuard, start OpenVPN (systemctl enable --now openvpn@server), and forward both ports on your home router to the server's static LAN IP.
Client setup and the TCP-vs-UDP decision
Generate one .ovpn per device embedding its certificates:
client
dev tun
proto udp
remote your-home.ddns.net 1194
ca ca.crt
cert laptop.crt
key laptop.key
tls-auth ta.key 1
cipher AES-256-GCMMake a second .ovpn with proto tcp and remote your-home.ddns.net 443 for the fallback. Import into the OpenVPN client app (desktop/phone) or your travel router's OpenVPN client section.
Which to use when: UDP always, unless it won't connect. TCP-over-TCP has real performance costs (the infamous TCP meltdown on lossy networks), so treat the TCP profile as the emergency exit, not the daily driver. On the travel router, keep both profiles and switch when needed. Two taps beats midnight debugging.
Test both from mobile data: connect each profile, confirm home IP, confirm DNS doesn't leak. Then test the kill switch with each.
Hardening checklist
OpenVPN's flexibility means a lazy setup can be weak, so run through this once:
- tls-auth (or tls-crypt) enabled. Already in the config above; it makes the server silently drop unauthenticated packets. Non-negotiable.
- Strong cipher, no fallbacks.
AES-256-GCM(or ChaCha20-Poly1305 on CPUs without AES acceleration). Don't leave the server negotiating down to legacy ciphers. - CA key stored safely. After issuing client certs, move the CA key off the server. An attacker who gets the server shouldn't get the ability to mint new clients.
- Revoke, don't just delete. When a device is lost, revoke its cert and regenerate the CRL; deleting the
.ovpnfile from your laptop does nothing to stop the cert itself. - Keep it updated. OpenVPN has had real CVEs; unattended-upgrades on the server box is the minimum.
Quick questions
Is OpenVPN slower than WireGuard in practice?
Can I run OpenVPN and WireGuard on the same box?
How do I revoke a lost client's access?
./easyrsa revoke laptop, regenerate the CRL (./easyrsa gen-crl), and point the server config at it (crl-verify crl.pem). The client cert dies immediately. Faster than rebuilding anything.TCP 443 vs UDP 1194 through hotels?
Do I need the tls-auth key?
Need help setting this up?
Certificates, dual instances, client profiles, kill-switch verification: our done-for-you setup covers OpenVPN properly, usually alongside WireGuard as primary. https://homeipvpn.com.
