A VPN is useful if you want to access devices on your home network – such as a file server or hosting – whilst away from home. By setting up your own VPN server, you can create a virtual private network that only devices you authorise can connect to. This means you don’t have to make your home services directly accessible to the internet.

The setup may seem complicated at first, as it requires server-side configuration, appropriate network access and client settings. This article explains what a VPN is used for, how to set up home or remote access, and how to export the OpenVPN configuration to the connecting device.

We’ll walk you through the necessary network settings, port forwarding and the role of keys and certificates. We’ll also discuss how to choose between OpenVPN and WireGuard, and what factors affect connection speed. These steps will help you set up access that suits your home network and your intended use.

Exporting an OpenVPN configuration file

1. Set up the server’s accessibility. In the OpenVPN server configuration, specify the externally accessible address, the protocol and the port. The example shown uses UDP and port 50015. Assign a separate address range for VPN clients; do not reuse your home LAN network. For example, the local network address might be 192.168.1.0/24.
2. Export the client profile. Use the server’s control panel or command-line tool to generate the OpenVPN configuration file. This typically contains the host address, port, transmission protocol and certificate details. If you also receive separate certificate or key files, save them alongside the profile. Treat the exported data as confidential, as it may grant access to the VPN.
3. Install the client, then import the profile. In the OpenVPN client, select ‘Import’ and open the exported file. On Android, the configuration shown uses a TUN interface, as this particular client does not support the TAP interface. On Windows, follow the application’s import steps, then enter your authentication details. The connecting device must also have internet access.
4. Choose the right router solution. The user interface of pre-configured VPN routers can simplify the process of loading client profiles, but settings may vary from device to device. Check the router’s routing and DNS settings, and ensure that traffic from the correct devices is routed through the VPN. The VPS environment used to host the server can also be provided by the VPS server infrastructure.
5. Protect and maintain access. The risks associated with running your own VPN server include client profile leaks, out-of-date software and unauthorised access. Keep your server up to date, restrict access and revoke the credentials of clients who are no longer using the service. In Hungary, only connect via VPN to networks you are authorised to access, and comply with your service provider’s terms and conditions.
6. Check your connection and performance. Once connected, compare your external IP address with the one you had before using the VPN, then carry out a DNS leak test. In Windows, the ‘Connected’ status displayed in the VPN profile indicates a successful connection. The speed of your home VPN is mainly determined by your upload bandwidth and the route to Hungary. Encryption and server load also affect latency.

When using PPPoE passthrough, the functioning of the internet connection may depend on the router’s settings. According to a forum reply, by connecting your own router to the Sagemcom ETH1 port and using PPPoE passthrough, your own router can establish the PPPoE connection. When using PPPoE passthrough, the set-top box can operate independently of your own router when connected to one of the provider’s router’s LAN ports. This means that your own router’s internet connection and the set-top box’s connection can be established via separate paths.

The ISP’s router is usually accessible via a direct LAN connection, but from the router behind it only if you set up a static route on it and the device supports this. During the check, it examines the accessibility of the ISP’s router, the address displayed on the router and the ping result separately. Compare the address displayed on the router with the public IP address shown on an external testing site. The router may block ping requests even if the ISP’s network does not filter them; therefore, a failed ping does not in itself prove that the ISP’s network is blocking the requests.

Local network or internet VPN access

From home, the VPN server can be accessed via the local network, but when connecting remotely, you’ll need to connect via the internet. For a home OpenVPN server, forward the port you’re using to the server’s static internal IP address, then use dynamic DNS to assign a permanent name to the changing public IP address.

1. Decide which network you need to access. If you are only testing the VPN on the local network, use the server’s internal address and the client’s routing settings. For a remote connection, you will need the router’s public address or dynamic DNS name. The VPN clients’ address range should be separate: the example uses the 192.168.2.0/24 network, whilst the home LAN address is 192.168.1.0/24.
2. Note down the internal IP address of the VPN server. Set a static IP address on the server, outside the router’s DHCP range. Enter this address as the destination for port forwarding. If the IP address of your computer or NAS changes after a restart, the router may forward external requests to the wrong device, meaning the remote connection will not be established.
3. Set up the port forwarding rule. In the OpenVPN example, forward UDP port 1194 to the VPN server’s static LAN address. Configure this rule on the router that directly receives the internet connection. If you are using a secondary router operating in AP mode, you may also need to open and forward the VPN port on the main router.
4. Take note of the route between the two routers. In one example, the service provider’s HGW address is 192.168.1.4, whilst the TP-Link router’s address is 192.168.1.250. If the OpenVPN server is running behind the second router, the external request must pass through the rules of both devices. Also check your firewall, as the security rules on your NAS or router may be blocking connections coming from the internet.
5. Set up a dynamic DNS name. Use an update program running on your router or network to link your chosen name to your current public IP address. This way, you can still use the name in the OpenVPN client even if your provider assigns a new address. Set the server address to this name in the exported profile as well.
6. Try accessing it from outside your network. Connect from a computer or mobile phone using mobile data, rather than from the same Wi-Fi network. Use an external port scanner to check the availability of UDP port 1194, then check the VPN server’s log. Once a successful handshake has been established, test whether the client can reach the desired local address.
7. Choose which traffic should pass through the VPN. If you only wish to access your home file server or other local devices, route the client’s traffic to the required LAN addresses. If you wish to route all internet traffic via your home connection, you can use the redirect-gateway def1 setting in the OpenVPN configuration. In this case, the overall route will also depend on the server’s upload speed.

The purpose and use cases of a VPN

1. Decide which devices you want to access. A VPN is a virtual private network to which only designated computers can connect. It can provide remote access, for example, to a home server, hosting or a printer. Setting up your own VPN server is advisable if you need a secure connection to access one of your own network resources.
2. Choose between remote access and full traffic tunnelling. You can configure the VPN so that only addresses on your home network are accessible. Alternatively, all of the device’s internet traffic can be routed through the VPN tunnel. This may affect traffic from all applications, so please bear in mind that there may be some latency when making video calls or playing online games.
3. Use it for remote working to access the internal systems you need. When working from home, you can access the internal file server or an administration interface via a VPN. Instead of making these directly accessible via the internet, you can restrict access to an authenticated VPN connection. The routing settings on the computer used for work and the VPN server determine which internal addresses can be accessed.
4. Set up a separate profile for each client. Create individual WireGuard configurations for your laptop, phone and tablet. This way, you can revoke access for a lost device without having to change the settings for your other clients. The VPN app imports the profile, and the user can start or stop the connection on their device.
5. Configure the solution to suit your operating system. On Linux, WireGuard can be set up as a system-level network connection, whilst on mobile devices, a client app can load the configuration. On Microsoft Windows, the VPN client can manage the WireGuard profile as a separate application. Choose the client supported by your device, then check that the server address and routing settings in the profile are correct.
6. Don’t expect complete anonymity from a VPN. Your own server routes traffic through its own VPN gateway, but it does not make your online activity invisible. The destination site, your browser login details and the application you are using can still identify you. A VPN primarily protects your network connection and provides controlled access; it is not a substitute for account security.
7. Determine when not to use your own gateway. If you only want to access a single device remotely, it may be unnecessary to connect your entire home network via a VPN. If several of your own devices need to access the same internal systems, a central WireGuard server can provide a simple access point. When making your decision, take into account the required routes, server load and connection speed.

Keys, certificates and special settings

1. Create a separate WireGuard key pair for each device. On the server, run the wg genkey command to generate the private key, then use the wg pubkey command to generate the public key. The private key must remain on the device in question and must not be logged or stored in a shared file. Add the public key to the other party’s peer settings.
2. Do not confuse keys with certificates. WireGuard identifies peers using public and private keys, not a traditional certificate chain. Therefore, in the configuration, the correct keys must be associated with the correct endpoints. In the case of OpenVPN, the configuration may also contain certificates, and the configuration files for the two solutions are not interchangeable.
3. Record your partner’s details accurately. In the server configuration, enter the client’s public key and the IP address or address range authorised for your partner. The client’s file should contain the server’s public key, its access address and the necessary routing settings. For example, the AllowedIPs field specifies which traffic is permitted to pass through the virtual private network tunnel.
4. Protect your private key on both the server and the client. Restrict access to the file using the operating system’s permissions, and do not send it over an unencrypted channel. If a device is lost, remove the corresponding public key from the server’s key list. This will revoke access linked to that key without having to replace the keys on every client.
5. Only enable connection keepalive when necessary. Mobile networks or firewalls may disconnect connections that have been inactive for a prolonged period, so the client may send regular keepalive packets. Do not automatically copy the OpenVPN parameters: the OpenVPN server keepalive settings shown here use a 10-second interval and a 120-second timeout. These values are not WireGuard settings.
6. Check the encryption roles and routing. WireGuard uses the ChaCha20 algorithm for encryption, Poly1305 for authentication, and Curve25519 for key exchange. For the virtual private network to function, the key pairs in the server and client configurations must match. If the tunnel is established but the internal device is unreachable, check the permitted addresses and the server’s routing.
7. Update your access details when changing devices. When connecting a new phone or computer, create a separate key pair and add only its public key to the server. Remove the old device’s key when it is no longer needed. This way, the configuration of your own VPN server remains straightforward, and you won’t have to reconfigure all connections just because you’ve replaced a single client.

WireGuard or OpenVPN: which is better for your own VPN server?

1. Choose based on your intended use. For a personal VPN gateway, WireGuard is a good starting point, and as a general choice, it can be recommended for almost any router-based VPN setup. Its straightforward configuration requires very few settings. OpenVPN may be suitable if your existing network is already built around it, or if the devices you use support it.
2. Please bear in mind how the connection is established. The WireGuard handshake is completed in a single round-trip, which allows for simple and fast connection establishment. This alone does not determine the overall data transfer speed. Latency and throughput are also influenced by the network route, server load and internet connection.
3. Consider the processor load. The encryption task of a personal VPN gateway is CPU-bound, not memory-bound. As a starting point for sizing, 1 vCPU and 1 GB of RAM can be used for WireGuard. With residential-grade bandwidth, this may be sufficient to handle 5–10 concurrent device connections. The actual load depends on traffic and the encryption workload.
4. Learn about the encryption components of WireGuard. WireGuard uses the ChaCha20 algorithm for encryption, Poly1305 for authentication and Curve25519 for key exchange. These algorithms are part of the protocol, so you do not need to put together a separate encryption package. The corresponding keys must be included in the configuration of the server and all clients.
5. Do not choose PPTP for a new server. The use of PPTP is not recommended as it has known security issues. When setting up WireGuard or OpenVPN, use modern key management, keep the system up to date and control access appropriately. Choosing a protocol is no substitute for regular server maintenance.
6. Test the chosen solution with actual clients. Install WireGuard on the Linux server, then connect from a laptop and a mobile phone using separate configurations. Check that the desired internal addresses are accessible and that the connection is re-established after it drops. For OpenVPN, also test the network routes and access.
7. Configure the Linux environment to suit your chosen protocol. The resources and system settings required for the server to operate are determined by the task at hand. If you are setting up a Linux-based VPN gateway, review the VPS server environments and then select the solution that is suitable for your planned WireGuard or OpenVPN installation.

If the OpenVPN server is running on a NAS or router, AES-256 can be used as an example when reviewing the encryption settings. The client-side profile must match the server’s settings, so please check the specified connection and authentication details before connecting. When creating a Windows VPN profile, select the VPN connection type based on the type used by your organisation or VPN service. You can use a username and password, a one-time password, a certificate or a smart card for authentication. Select the authentication method that is actually supported by the server and the profile in question; this will help prevent the connection from failing due to configuration discrepancies. Test the profile on the actual client and verify the connection whilst accessing the desired network resources.

The OpenVPN configuration shown here uses the 192.168.2.0 255.255.255.0 network for VPN clients. It is advisable to check this address range alongside the client settings to ensure that the assigned addresses do not conflict with the internal networks you wish to access. The server sets the keepalive parameter to 10 120: the connection is checked at 10-second intervals, and the timeout is 120 seconds. During testing, check whether the client can reach the server again after the connection is lost, and whether the required routes are still functioning. If you make any changes to the configuration, check that the values match on both the server and client sides, then repeat the test. This ensures that the chosen OpenVPN configuration not only starts up but also provides the intended access.

aWh: Web hosting

aWh’s web hosting may be the right choice if you wish to run a website alongside a VPN running on a Linux VPS. The VPN server and the web hosting serve separate purposes: the VPN provides secure remote network access, whilst the web hosting is used to host the website. This means that setting up your own VPN server can be kept separate from the operation of your web content.

If your main aim is still to run WireGuard, when choosing a server, take into account the Linux environment, the necessary network settings and the planned client connections. aWh Web Hosting is available for website hosting. To find out more about our services, please visit awh.hu.

Plan your next step with VPN

Once you have set up your own VPN server, establish a simple maintenance routine: keep the system up to date and revoke access for devices that are no longer in use. Also, make a record of which users and network resources can be accessed remotely. This way, the configuration remains clear even when you connect a new computer or mobile phone.

If you need a Linux-based server environment to run a VPN, aWh’s KVM VPS service may be of interest. Web hosting is used to run websites, whilst domain registration is for using your own web address. These serve different purposes, so please choose the option that best suits your specific technical requirements.

If you’d like to explore the available options, ask aWh for help. With a well-planned next step, you can confidently continue to build your own network environment.

Frequently Asked Questions

What is it for, and why might you need a VPN?

With a VPN, you can access designated resources on your home or work network remotely. It’s worth using if, for example, you need to access an internal business application or your own network device whilst on the move. You can specify in advance which users and devices are allowed access, so the connection does not automatically extend to the entire network.

What is a VPN?

A VPN is a network connection through which traffic can flow between a device and a remote endpoint. It works differently from remote desktop access: a VPN provides a network connection, whilst remote desktop displays the user interface of another computer. You can also access various local services via a VPN, provided that routing and permissions allow it.

Should you build a VPN router or use a VPS gateway?

Your home router can serve as a suitable endpoint if you wish to access your own home devices from the internet. With a VPS gateway, you can run the VPN on a separate server, meaning access to it does not depend on whether your home router is switched on. The two solutions are not necessarily mutually exclusive: if you also wish to access your home network via the VPS, you will need to plan the route between the two networks.

What hardware and internet connection do you need for your own VPN server?

A home server requires a computer or router on which VPN software can run continuously and which has a stable network connection. Remote data transfer may be limited by your home internet upload capacity, particularly when accessing large files. In the case of a VPS, select the server’s resources based on concurrent traffic and the encryption load. The network card and routing also affect performance.

How to set up your own VPN server on a VPS, step by step?

Select a supported Linux environment, then log in with administrator privileges. Once you have installed and configured WireGuard, start the connection using the command wg-quick up wg0. You can view the status of the interface and peers using the command wg show. If everything is working correctly, set the service to start automatically, then test it again after a reboot.

How can you set up VPN clients and secure encryption?

In the client application, check that you are connected to the correct server and that you are only using the necessary network routes. With WireGuard, the output of wg show on the server shows the latest handshakes and traffic for peers. When setting up your phone, do not display the configuration QR code in public places. In the event of a connection error, first check the client’s status, then examine the server log.

• vpn
• home network
• remote access
• openvpn
• wireguard
• port forwarding
• network security