The two VPN servers most people run on Linux are WireGuard and OpenVPN. Both are secure and well maintained. They differ in speed, complexity and how well they cope with restrictive networks.
Comparison
| WireGuard | OpenVPN | |
|---|---|---|
| Code size | Very small (in the Linux kernel) | Large, user space |
| Setup | A few lines of config, key pairs | PKI with certificates (CA, server, clients) |
| Performance | Very fast, low CPU | Good, but higher CPU use |
| Transport | UDP only | UDP or TCP (can run on TCP 443) |
| Roaming (Wi-Fi ↔ mobile) | Seamless | Reconnects |
| Authentication | Public keys per peer | Certificates; optional username/password, 2FA via plugins |
| Clients | Official apps for all platforms | Official and third-party apps for all platforms |
Choose WireGuard for almost everything: personal VPNs, server-to-server links, remote access for a team.
Choose OpenVPN if you need TCP (some networks block UDP), integration with existing certificate-based or LDAP authentication, or compatibility with older devices and routers.
Setting up WireGuard
Our step-by-step guides cover WireGuard in detail:
- Personal VPN on a VPS — phone and laptop clients, full-tunnel routing.
- Site-to-site VPN tunnel — connecting servers and office networks.
The essentials:
apt install -y wireguard
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
# write /etc/wireguard/wg0.conf with [Interface] and one [Peer] per client
systemctl enable --now wg-quick@wg0Setting up OpenVPN
The manual route requires building a certificate authority with Easy-RSA, generating server and client certificates, and writing configs. It’s well documented but long. Two practical approaches:
Option A: a maintained installer script
Community scripts (search for “openvpn-install” on GitHub) automate the PKI and configuration. Review any script before running it as root.
Option B: manual setup with Easy-RSA (outline)
apt install -y openvpn easy-rsa
make-cadir /etc/openvpn/easy-rsa && cd /etc/openvpn/easy-rsa
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa build-server-full server nopass
./easyrsa build-client-full laptop nopass
openvpn --genkey secret /etc/openvpn/server/tc.keyA minimal modern server config (/etc/openvpn/server/server.conf):
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key
dh none
tls-crypt /etc/openvpn/server/tc.key
data-ciphers AES-256-GCM:CHACHA20-POLY1305
server 10.9.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 1.1.1.1"
keepalive 10 60
user nobody
group nogroup
persist-key
persist-tunEnable forwarding and NAT (as for WireGuard), open 1194/udp, then:
systemctl enable --now openvpn-server@serverEach client gets a .ovpn file containing the CA certificate, its own certificate and key, and the tls-crypt key.
TCP 443 fallback: on networks that only allow web traffic, run a second instance with proto tcp and port 443 (if 443 isn’t used by a web server on the same IP).
Security checklist for either
- Keep the server patched — see automatic security updates.
- One key or certificate per device; revoke when a device is lost (remove the WireGuard peer, or
./easyrsa revoke+ CRL for OpenVPN). - Limit the VPN port to expected source networks if possible.
- Log connections and review them occasionally.
Where to host it
Latency and exit location depend on the server’s region. Pick a USA VPS, Hong Kong VPS or Japan VPS close to you or to the services you access. Use VPNs for your own devices and teams — public open proxies violate our acceptable use policy.