OpenVPN on Ubuntu VPS

One way to improve the security of a system is to limit the attack surface, such as by using an allowlist of IP addresses for specific services like phpMyAdmin. If you are on an ADSL connection without a fixed IP address, this can be time-consuming because you may need to allow a whole IP range from your ISP for every service. It can also be limiting if you want to access something from another ISP, or you switch ISPs. A way around this is to use a dynamic IP service and OpenVPN. Although this is not a complete security solution, it does make things more difficult for would-be intruders. OpenVPN even has clients for Android, and on newer versions such as Jelly Bean, you do not need root access.

Note: From what I can tell, my VPS is running on Parallels virtualization. Instructions may differ between virtualization systems.

This is a list of instructions for how I installed OpenVPN. Before I start, I am NOT a system admin by any means, so my knowledge is limited to what I have read. This is simply me sharing what worked for me. This is a two-stage setup: (1) install OpenVPN and run it, and (2) set up a cron job to check the connection and restart OpenVPN if needed.

I also had to contact my VPS provider to get them to install the TUN/TAP device.

VPN Server

I use an Untangle firewall as my OpenVPN server. This runs at home and makes configuration simple through a web interface. For each VPN client, it builds a zip file containing the OpenVPN settings. I assume you already have an OpenVPN server running, that port forwarding has been tested, and that you already have the configuration on the Ubuntu server.

VPN Client

Install and set up OpenVPN

sudo apt-get install openvpn

Move and unzip the configuration that Untangle made to /etc/openvpn. Running ls in /etc/openvpn should show two files with the same name: a .conf file, an .opvn file, and a folder named untangle-vpn. Note: There is a file called "update-resolv-conf" that was already in that folder.

Now try #openvpn --config /etc/openvpn/myConfignNameHere.conf If you get an error like "Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)", you will have to talk to your VPS provider to get that set up on your VPS, as I did. All going well, you should be able to ping a machine on your home network! Now we need a script to detect whether OpenVPN is down. If it is, the script restarts it so it can reconnect.

OpenVPN auto reconnect script

This is a quick script that I built. I cannot remember where I got the ping code from. It pings its own private OpenVPN address to see whether it is available. If not, it runs service openvpn restart. I added this script in Webmin as a scheduled cron job that runs every minute. Note: I am using 172.16.0.5 as an example of the Ubuntu machine's IP address assigned by the OpenVPN server.

<?php
if(!(boolean)ping("172.16.0.5")){
    exec("service openvpn restart");//RESTART OPENVPN
}
function ping($host){
    exec(sprintf('ping -c 1 -W 5 %s', escapeshellarg($host)), $res, $rval);
    return $rval === 0;
}

Done!

Published: 12/07/2013 UTC

Updated: 18/06/2026 UTC

<- Back To Blog