OpenVPN on Oracle Cloud (Ubuntu 22.04)

Goal

Stand up a private OpenVPN server on a free Ubuntu 22.04 Linux VM in Oracle Cloud Always Free and document it so someone else can repeat the build. This is a portfolio project and a how-to — not a VPN hosting offer.

Two problems I solved

1. Remote access via exposed services

SSH/RDP “for a moment” on 0.0.0.0/0, or a commercial VPN with no control over logs and policy.

What I gained: one narrow entry point (UDP 1194 + SSH for admin only), traffic to resources behind the tunnel, my own PKI, and the ability to revoke a client without rotating a shared password.

2. Oracle: port open in the cloud, closed on the host (and the reverse)

After installing OpenVPN the client timed out because the Security List allowed UDP 1194 while host iptables still dropped — or the opposite.

What I gained: a dual-firewall checklist (VCN + host), working NAT/MASQUERADE, and a rebuild note you can follow from zero.

Who this guide is for

• you want your own Always Free VPN (learning / homelab / safer access),
• you can SSH into Ubuntu and edit files with sudo,
• you accept Always Free limits and that you own updates and keys.

Do not use this to chase anonymity “under the radar” or to bypass employer/school policy. The VPN here serves your resources and your network.

Architecture

[Client .ovpn] --UDP 1194--> [Oracle VM Ubuntu 22.04 + OpenVPN]
                                  |
                                  +--> NAT to the internet (full tunnel)
                                  +--> or lab routes only (split tunnel)

On Oracle Cloud always check two layers:

1. Security List / NSG (ingress: TCP 22, UDP 1194).
2. Host firewall (iptables / nftables / firewalld — depends on the image).

Step-by-step guide

Commands below are an educational skeleton. Package versions and easy-rsa paths may differ — read installer output. Work only on your own VM.

1. Always Free instance

1. Oracle Cloud account, default compartment.
2. Launch instance: Ubuntu 22.04, Always Free shape (e.g. Ampere A1 with small OCPU/RAM, or VM.Standard.E2.1.Micro where available).
3. SSH key (ed25519/RSA) — password login disabled.
4. Note the public IP (consider a Reserved Public IP so restarts do not change it).

2. Security List / NSG

Ingress (example):

If SSH stays on 0.0.0.0/0, use keys only and consider fail2ban — it is still exposure.

3. Ubuntu baseline

sudo apt update && sudo apt -y upgrade
sudo apt -y install openvpn easy-rsa iptables-persistent

Enable IP forwarding permanently in /etc/sysctl.d/99-openvpn.conf:

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-openvpn.conf
sudo sysctl -p /etc/sysctl.d/99-openvpn.conf

4. PKI (easy-rsa)

make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-dh
openvpn --genkey secret ta.key
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

Copy to the server (adjust paths):

• ca.crt, server.crt, server.key, dh.pem, ta.key → /etc/openvpn/server/

5. OpenVPN server config

/etc/openvpn/server/server.conf (skeleton):

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
keepalive 10 120
cipher AES-256-GCM
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

For split tunnel, remove redirect-gateway and push only lab routes, e.g. push "route 10.0.0.0 255.255.255.0".

6. NAT (MASQUERADE)

Find the internet-facing interface (ip route) — often ens3 / enp0s3:

IFACE=ens3   # set the correct one
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o "$IFACE" -j MASQUERADE
sudo iptables -A INPUT -p udp --dport 1194 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -o "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i "$IFACE" -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo netfilter-persistent save

Oracle images sometimes add extra chains — if UDP 1194 still never arrives, inspect iptables -L -n -v and the image docs.

7. Start the service

sudo systemctl enable --now openvpn-server@server
sudo systemctl status openvpn-server@server

8. Client .ovpn profile

Build a file with ca, cert, key, tls-auth (direction 1 on the client) and remote YOUR_IP 1194. Do not commit private keys to public repos.

Test: connect → ip addr shows tun → ping a resource behind the VPN / check egress IP on full tunnel.

9. Upkeep

• unattended-upgrades or regular apt upgrade,
• new client = new cert; lost laptop = revoke + CRL,
• logs: journalctl -u openvpn-server@server,
• do not expose admin panels “beside” the VPN without separate access control.

Common failures

Related material

• Remote access decision tree
• Internet exposure worksheet
• Network Security Lab
• Network security service

Boundaries

Not anonymity, not policy bypass, not managed VPN SaaS. Always Free terms can change — verify current Oracle limits. You own key safety and patching.

Status

completed as a deployment pattern and guide. Always re-validate a production build against your own network and policy.