OpenVPN Installation¶

Part of the OpenVPN Comprehensive Guide.
Covers getting the openvpn binary and EasyRSA installed. Server config
starts in
openvpn-server-configuration.md.

From distro packages (recommended)¶

Package repos have carried current-enough OpenVPN releases for years now —
build from source only if you need a feature/patch not yet packaged, or a
platform without a package.

# Debian / Ubuntu
sudo apt update
sudo apt install openvpn easy-rsa

# RHEL / CentOS / Rocky / Alma
sudo dnf install epel-release
sudo dnf install openvpn easy-rsa

# macOS (Homebrew)
brew install openvpn easy-rsa

# FreeBSD
pkg install openvpn easy-rsa

Check the installed version:

openvpn --version

Anything 2.5.x or newer supports everything in this guide set
(tls-crypt, data-ciphers, AEAD ciphers). If your distro only has 2.4 or
older, either add the official OpenVPN repo for your distro (see below) or
build from source.

OpenVPN's own repos (for a newer version than your distro ships)¶

OpenVPN Inc. publishes repos for common distros with more current builds
than the base distro repos:

# Debian/Ubuntu example
curl -fsSL https://swupdate.openvpn.net/repos/repo-public.gpg | \
  sudo gpg --dearmor -o /usr/share/keyrings/openvpn-repo.gpg
echo "deb [signed-by=/usr/share/keyrings/openvpn-repo.gpg] \
https://build.openvpn.net/debian/openvpn/stable $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/openvpn.list
sudo apt update
sudo apt install openvpn

Confirm the exact URL/keyring path for your distro/release on OpenVPN's
Linux packages page before running this — repo layouts and key formats
change often enough that a stale command here would be worse than no
command at all.

From source¶

Only needed for unpackaged platforms or bleeding-edge features.

# Get the source and its detached signature
wget https://swupdate.openvpn.org/community/releases/openvpn-<version>.tar.gz
wget https://swupdate.openvpn.org/community/releases/openvpn-<version>.tar.gz.asc

# Import the OpenVPN signing key and verify
wget https://openvpn.net/security/openvpn-signature-key.asc -O openvpn-signing-key.asc
gpg --import openvpn-signing-key.asc
gpg --verify openvpn-<version>.tar.gz.asc openvpn-<version>.tar.gz

Only proceed to build if that verification reports a good signature from
OpenVPN's key.

tar xzf openvpn-<version>.tar.gz
cd openvpn-<version>
./configure
make
sudo make install

On RPM-based systems you can build a package instead of installing
directly, which keeps it manageable via the package DB:

rpmbuild -tb openvpn-<version>.tar.gz
sudo rpm -ivh ~/rpmbuild/RPMS/x86_64/openvpn-<version>.<arch>.rpm

EasyRSA¶

EasyRSA is the PKI management tool used throughout
openvpn-server-configuration.md and
openvpn-client-configuration.md — it
replaces hand-written openssl ca invocations against a manually maintained
openssl.cnf. If it wasn't pulled in by the openvpn package above:

git clone https://github.com/OpenVPN/easy-rsa.git

Or grab a release tarball from the EasyRSA GitHub releases page if you'd
rather pin a specific version.

Next: openvpn-server-configuration.md
to build the PKI and bring up the server.