Install the packages:

sudo apt install openvpn easy-rsa

Copy an example config file:

gunzip -c /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz | \
sudo tee /etc/openvpn/server.conf

/etc/openvpn/server.conf

# Listen on UDP port 1194
port 1194
proto udp
proto udp6
 
# Use a tun device and push an IPv6 tunnel to clients
dev tun
 
# Certificate settings
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
 
# Create subnets for the clients
topology subnet
server 10.8.0.0 255.255.255.0
server-ipv6 2001:db8::/112
 
# Have all traffic go through the VPN
push "redirect-gateway def1 bypass-dhcp"
 
## OpenDNS is used in this example, but anything reachable by the VPN server will work
push "dhcp-option DNS 2620:0:ccc::2"
push "dhcp-option DNS 2620:0:ccd::2"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
 
# Allow direct client-to-client connections
client-to-client
 
# Ping every 10 seconds, assume disconnect after 120 seconds
keepalive 10 120
 
# TLS parameters
## This is the server
tls-auth ta.key 0
key-direction 0
## Use strong ciphers
cipher AES-256-CBC
auth SHA512
 
# Run the daemon with minimal privileges
user nobody
group nogroup
persist-key
persist-tun
 
# Logging settings
status openvpn-status.log
verb 3
explicit-exit-notify 1

Allow packet forwarding and enable the IPv6 neighbour detection proxy:

/etc/sysctl.conf

net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
net.ipv6.conf.all.proxy_ndp=1

Load the kernel parameters:

sudo sysctl -p

If your server gets its IPv6 configuration through SLAAC, also do this:

/etc/sysctl.conf

net.ipv6.conf.all.accept_ra=2
net.ipv6.conf.default.accept_ra=2

Load the kernel parameters:

sudo sysctl -p

Force acceptance of router advertisements for the WAN ethernet interface:

# This setting is not inherited from 'all' or 'default' when the interface is already up.
# It will be inherited after the next reboot, so this only has to be done once.
sudo su -c 'echo 2 > /proc/sys/net/ipv6/conf/eth0/accept_ra'

Allow masquerading for the OpenVPN subnet:

/etc/ufw/before.rules

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
COMMIT

/etc/ufw/before6.rules

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 2001:db8::/112 -o eth0 -j MASQUERADE
COMMIT

Don't drop forwarded packets:

/etc/default/ufw

DEFAULT_FORWARD_POLICY="ACCEPT"

Allow incoming connections on UDP port 1194 and restart the firewall:

sudo ufw allow 1194/udp
sudo ufw disable && sudo ufw enable

Create a working directory:

make-cadir openvpn-ca
cd openvpn-ca/

Fill in these variables as desired (saves time):

openvpn-ca/vars

set_var KEY_COUNTRY="..."
set_var KEY_PROVINCE="..."
set_var KEY_CITY="..."
set_var KEY_ORG="..."
set_var KEY_EMAIL="..."
set_var KEY_OU="..."

Initialize the directory:

./easyrsa init-pki

Build a certificate authority:

./easyrsa build-ca nopass

Build a server key called server:

./easyrsa build-server-full server nopass

Build a Diffie-Hellman key:

./easyrsa gen-dh

Generate a pre-shared key:

/usr/sbin/openvpn --genkey --secret ta.key

Copy the generated keys to the server configuration directory:

cd pki/
sudo cp ca.crt private/ca.key issued/server.crt private/server.key ta.key dh.pem /etc/openvpn/
sudo cp dh.pem /etc/openvpn/dh2048.pem

Restart the server:

sudo systemctl daemon-reload
sudo systemctl restart openvpn@server.service

Create a working directory next to openvpn-ca:

cd ../../
mkdir -p client-configs/files/
cd client-configs/

Add a base configuration file for your clients:

base.conf

# Specify that we are a client
client
 
# Use the same setting as you are using on the server
dev tun
 
# Connect to the server on UDP port 1194
proto udp
remote vpn.quietlife.nl 1194
 
# Run the daemon with minimal privileges
user nobody
group nogroup
 
# Unset these defaults (certificates will be provided by the .ovpn file)
#ca ca.crt
#cert client.crt
#key client.key
 
# Use strong ciphers
cipher AES-256-CBC
auth SHA512
 
# This is the client
key-direction 1
 
# Run these scripts after connecting (sets up DNS)
script-security 2
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
down-pre
dhcp-option DNSSEC allow-downgrade
dhcp-option DOMAIN-ROUTE .

Add a configuration build script:

make_config.sh

#!/bin/bash
 
KEY_DIR=../openvpn-ca/pki
OUTPUT_DIR=./files
BASE_CONFIG=./base.conf
 
cat ${BASE_CONFIG} \
    <(echo -e '<ca>') \
    ${KEY_DIR}/ca.crt \
    <(echo -e '</ca>\n<cert>') \
    ${KEY_DIR}/issued/${1}.crt \
    <(echo -e '</cert>\n<key>') \
    ${KEY_DIR}/private/${1}.key \
    <(echo -e '</key>\n<tls-auth>') \
    ${KEY_DIR}/ta.key \
    <(echo -e '</tls-auth>') \
    > ${OUTPUT_DIR}/${1}.ovpn

Make it executable:

chmod 750 ./make_config.sh

Build a client certificate with password:

cd openvpn-ca/
./easyrsa build-client-full $name

Create a client configuration file:

cd ../client-configs/
./make_config.sh $name

The resulting configuration will be in client-configs/files/$name.ovpn

Copy this to your client with SFTP. Repeat as many times as desired.

cd ~

You can also use a script to automatically generate certificates and configurations:

openvpn_generator.sh

#!/bin/bash
 
root=~
name=$1
 
cd $root/openvpn-ca/
 
./easyrsa build-client-full $name nopass
 
cd $root/client-configs/
./make_config.sh $name
 
echo Generated $root/client-configs/files/$name.ovpn
 
exit 0

Make it executable:

chmod 750 ./openvpn_generator.sh

Revoke the certificate:

cd openvpn-ca/
./easyrsa revoke $name
./easyrsa gen-crl

Copy the revocation list to the server configuration directory:

sudo cp ./pki/crl.pem /etc/openvpn/

Make sure that the OpenVPN server configuration file contains this line:

/etc/openvpn/server.conf

crl-verify crl.pem

Then restart the server:

sudo systemctl restart openvpn@server

sudo apt install network-manager-openvpn-gnome

Then simply import the .ovpn file with NetworkManager.