Hardened OpenVPN on an Anubiz VPS
OpenVPN is older than WireGuard and slower, but it works everywhere, runs over TCP/443 if needed, and supports auth flows WireGuard does not. This guide is for the cases where WireGuard is not an option (corporate device, deep packet inspection) and walks through a hardened OpenVPN 2.6 build on an Anubiz Romania or Finland VPS.
Need this done for your project?
We implement, you ship. Async, documented, done in days.
Step 1: PKI with Easy-RSA
Use Easy-RSA 3 to build a CA on a separate machine, never on the VPS itself. The CA's private key never touches the production VPS. Issue server cert, then per-client certs. Revoke through CRL when someone leaves.
Step 2: server.conf
Key options: tls-crypt /etc/openvpn/tls-crypt.key, cipher AES-256-GCM, data-ciphers AES-256-GCM:AES-128-GCM, auth SHA256, tls-version-min 1.3, remote-cert-tls client, topology subnet, persist-key, persist-tun. Port 1194 UDP for normal use, also bind to TCP 443 if you need DPI fallback.
Step 3: nftables
Accept SSH from your IP, accept udp/1194, accept tcp/443 if dual-bind, MASQUERADE the 10.8.0.0/24 subnet out the WAN. Drop everything else inbound.
Step 4: 2FA via Static Challenge
Add a plugin openvpn-plugin-auth-pam.so login stanza and require both cert and password. Combine with PAM TOTP for true 2FA - a stolen .ovpn file is useless without the TOTP code.
Step 5: Log Discipline
OpenVPN logs connection source IPs by default. Set verb 3 and rotate logs daily with logrotate. If logs are not needed for ops, pipe to /dev/null in production.
Related Services
Why Anubiz Host
Ready to get started?
Skip the research. Tell us what you need, and we'll scope it, implement it, and hand it back — fully documented and production-ready.