iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
The dependable way to connect two VPS instances privately is a routed, site-to-site OpenVPN tunnel. Run OpenVPN on one VPS (or on a gateway attached to its private network), connect the second VPS as a client, assign a tunnel subnet that overlaps neither server’s existing networks, and install reciprocal routes. The result is encrypted traffic between the selected hosts or private subnets without exposing those services to the public internet.
For the strongest design, use mutual TLS certificates, allow only the OpenVPN listener through provider and host firewalls, enable forwarding on the gateway, and test the complete path in both directions. Use NAT only when you cannot add the necessary return routes, because NAT conceals the original source address.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat a VPS-to-VPS OpenVPN tunnel does
A site-to-site VPN joins separate private networks across an encrypted tunnel. OpenVPN’s site-to-site model uses TLS for peer authentication and key exchange, then carries routed IP traffic through a virtual tunnel interface. Applications continue to use ordinary private IP addresses; they do not need to know that packets cross a VPN.
Assume VPS A hosts services on 192.168.70.0/24 and VPS B hosts services on 10.0.60.0/24. A dedicated VPN network such as 172.16.0.0/20 carries traffic between them. These addresses illustrate the layout; they are not OpenVPN defaults. Every network in the design must be distinct and non-overlapping.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
In a routed design, a connection from 192.168.70.25 to 10.0.60.40 keeps its source and destination addresses. The receiving host can apply normal access controls and logs show the originating system. In a NAT design, the gateway rewrites the source address, which simplifies the return path but removes that visibility.
Plan the networks and trust boundaries first
Write down the traffic you actually need before installing packages. This prevents accidental exposure of every service on both VPS instances.
Recommended Free Tools
Inventory to collect
- Each VPS’s public address and, if applicable, its provider-assigned private address.
- The local service or private-subnet CIDR behind each VPS.
- The default gateway and the interface that reaches that network.
- The application ports that must cross the tunnel, such as a database, replication endpoint, or internal API.
- Which hosts may initiate connections and which hosts should only accept them.
- Provider security-group rules and host-firewall rules on every involved machine.
Choose a non-overlapping tunnel CIDR
Compare the proposed tunnel network with every local, peer, container, orchestration, and provider-private network. If a VPS already uses 172.16.0.0/20, choose another private range. Overlap makes the kernel believe a peer address is local and prevents the packet from entering the VPN at all.
| Purpose | Example network | Where it is used |
|---|---|---|
| OpenVPN tunnel | 172.16.0.0/20 |
Virtual addresses on the OpenVPN interface |
| VPS A private network | 192.168.70.0/24 |
Services reachable through VPS A |
| VPS B private network | 10.0.60.0/24 |
Services reachable through VPS B |
If only the two VPS operating systems need to communicate, route their individual addresses instead of advertising entire subnets. A smaller route and narrower firewall rule reduce the blast radius of a compromised account.
Choose the operating mode that matches your network
| Decision | Routed mode | NAT mode |
|---|---|---|
| Return routes | Requires a route back to the remote tunnel or service network on each side. | Gateway rewrites the source, so remote hosts can return traffic to the gateway without a new route. |
| Source-address visibility | Preserved end to end; logs and ACLs can identify the originating host. | Hidden behind the gateway’s address; detailed attribution requires VPN or gateway logs. |
| Session initiation | Both sides can initiate when reciprocal routes and firewall rules permit it. | Works well when return-route control is unavailable, but inbound initiation may need additional port-forwarding rules. |
| Best use | Networks you administer, where clean routing and precise policy matter. | Legacy or provider-controlled networks where adding a return route is impossible. |
Prefer routed mode for VPS-to-VPS administration. Select NAT deliberately, document the lost source visibility, and restrict the translated traffic to the required destinations and ports.
UDP or TCP transport
OpenVPN supports both UDP and TCP. UDP is generally the simpler choice for a VPN tunnel because it avoids layering a reliable transport inside another reliable transport. TCP can be useful when a provider firewall permits only TCP or when the available perimeter policy is easier to satisfy with a TCP listener. The trade-off is additional transport overhead and potentially poor behavior when packets are lost.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Use one transport and port consistently in the provider security group, host firewall, server configuration, and client configuration. Changing only one of those layers produces a tunnel that appears down even though the certificates are valid.
VPS endpoint or separate gateway
Running OpenVPN directly on a VPS is appropriate when that machine is the only host that needs the connection or when it is already the router for a private segment. A dedicated gateway is preferable when many systems must use the tunnel, when you want to isolate VPN software from application workloads, or when failover and maintenance require an independent network device. A gateway also avoids installing VPN software on every private host, but it introduces another system to patch, monitor, and protect.
Prepare both VPS instances and the perimeter firewall
Install matching OpenVPN packages
Install the OpenVPN package from each operating system’s supported repository. Debian-family systems commonly use:
sudo apt-get update
sudo apt-get install openvpn easy-rsaPackage names differ on other distributions; use the distribution’s OpenVPN package and its service-manager integration. Keep both peers on maintained releases and read the package’s current configuration guidance before selecting cryptographic options. Defaults and supported ciphers change over time, so do not copy an old cipher list from an unrelated tutorial.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePermit only the VPN listener
At the VPS provider, allow the selected OpenVPN UDP or TCP port to the server’s public address. At the host firewall, allow that same port and protocol, ideally from the client VPS’s public address or a tightly controlled administrative range. Do not open the private application ports to the internet merely because those ports will be reachable through the tunnel.
Also allow the intended tunnel traffic on the VPN interface. A rule that accepts the listener but drops packets arriving on tun0 will establish TLS successfully while blocking the actual application flow. Cloud security groups and host firewalls are independent; both must permit the path.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Enable forwarding on the gateway
The VPS or gateway that connects two networks must forward packets between its public, private, and VPN interfaces. On Linux, enable IPv4 forwarding immediately for a test:
sudo sysctl -w net.ipv4.ip_forward=1Persist the setting in the distribution’s sysctl configuration, then reload it during boot. If IPv6 traffic is part of the design, plan and secure IPv6 forwarding separately; an IPv4-only policy does not protect an accidentally reachable IPv6 path.
Create certificate identities with mutual TLS
Use a private certificate authority (CA), one server certificate, and a separate client certificate for each peer. The TLS handshake proves that the connecting endpoint possesses a certificate signed by your CA; it is not enough to rely on a shared password or an IP address.
- Build the CA on a protected administration system or on the VPN server with strict file permissions.
- Issue a server certificate whose private key is readable only by the OpenVPN service account or administrator.
- Issue a unique client certificate for the peer VPS. Never copy one client private key to multiple machines.
- Transfer only the files required by each endpoint over an authenticated channel, and keep private keys out of source-control repositories and world-readable backups.
- Record certificate ownership and expiration dates. Revoke a lost or decommissioned client certificate through your PKI process, then distribute the updated revocation data according to your OpenVPN deployment method.
The server and client configurations reference the CA certificate and their own certificate and key. OpenVPN’s standard TLS model provides both identity verification and session key negotiation; protect the CA key especially carefully because compromise allows an attacker to mint apparently trusted peer certificates.
Configure the routed OpenVPN server
The following example uses VPS A as the OpenVPN server, the 172.16.0.0/20 tunnel, and VPS B’s private network at 10.0.60.0/24. Replace the example addresses with the non-overlapping values from your inventory.
- Create the server configuration in the location used by your distribution’s OpenVPN service manager. Set the listener port and transport, select a tunnel device, and allocate the tunnel network:
port 1194
proto udp
dev tun
topology subnet
server 172.16.0.0 255.255.240.0
persist-key
persist-tun- Reference the CA certificate, the server certificate, and the server private key issued by your PKI. Use the current package documentation for the supported TLS and data-channel protection settings; avoid obsolete directives copied from older guides.
- Advertise the remote service network and map it to the correct client. In a one-client site-to-site deployment, the server needs a route for
10.0.60.0/24and a client-specific internal route (often called aniroute) that associates that network with VPS B’s certificate identity. Without both pieces, the server may know that the network exists but still send packets to the wrong VPN client. - Restrict the process account and permissions using the service-manager options supported by your distribution. Keep the private key protected while allowing the daemon to reopen the tunnel after a restart.
- Start the service and inspect its status and logs. A successful service start means only that the configuration parsed; it does not prove that the peer authenticated or that application routes work.
For a simple host-to-host connection, advertise only VPS B’s address rather than its whole private subnet. For a full site connection, ensure VPS B itself forwards traffic between its VPN interface and 10.0.60.0/24.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Configure the peer VPS as a client
- Copy the client certificate, client private key, and CA certificate to the client’s protected OpenVPN configuration directory.
- Set the client to use the server’s public address, listener port, and identical transport:
client
dev tun
proto udp
remote 203.0.113.10 1194
nobind
persist-key
persist-tun
topology subnet203.0.113.10 is a documentation address representing VPS A’s public endpoint. Use the real address in your deployment. Reference the client certificate and key issued specifically to VPS B, and enable the CA validation required by your OpenVPN package. If the client sits behind a changing public address, the server still authenticates the certificate; do not weaken certificate verification to accommodate address changes.
- Add a route for VPS A’s service network, such as
192.168.70.0/24, through the OpenVPN interface. The route may be supplied by the client configuration or by the operating system’s routing configuration, but it must remain present after a reboot. - Start the client service and verify that the tunnel interface receives an address in
172.16.0.0/20. Check the OpenVPN log for a completed TLS handshake rather than relying on a process ID alone.
Install reciprocal routes and forwarding
Routing is the step most often missed. The server needs a path to VPS B’s network, and VPS B needs a path back to VPS A’s network. If a private subnet has another router, add the route there instead of adding a host-only route that disappears when the VPS restarts.
Example route logic
- On VPS A or its upstream router:
10.0.60.0/24via the OpenVPN client/tunnel path. - On VPS B or its upstream router:
192.168.70.0/24via the OpenVPN server/tunnel path. - On each private host, ensure the default gateway or a more-specific route points to the VPS that runs OpenVPN.
For a temporary Linux test, a route can be added with a command such as:
sudo ip route add 192.168.70.0/24 dev tun0The exact next-hop form depends on the tunnel topology and the route already installed by OpenVPN. Confirm the result with ip route get 192.168.70.25; the output must select the VPN interface, not the public default route. Persist the route using your distribution’s network manager or OpenVPN configuration after the test succeeds.
When an entire subnet sits behind a VPS, enable forwarding on that VPS and permit forwarding in its firewall. A tunnel between two endpoint processes does not automatically turn either host into a router.
Apply least-privilege firewall policy
Separate the rules into three layers:
- Public input: allow only the chosen OpenVPN listener and tightly controlled administration such as SSH. Do not expose database or application ports on the public interface.
- VPN input: allow only the source tunnel addresses or remote subnets that need access, and only the required destination ports.
- Forwarding: allow specific source CIDRs to specific destination CIDRs and ports in each direction. Drop unrelated forwarding by default and log enough information to diagnose a denied flow without flooding the log.
For example, permit 172.16.0.2 to reach a database port on VPS A only if that is an actual requirement. Do not accept every port from 172.16.0.0/20 simply because the address range is private. Keep management services restricted to trusted administrative addresses even when they are technically reachable through the VPN.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Provider security-group counters and host-firewall counters are valuable evidence. A packet that never increments the provider rule is being blocked before it reaches Linux; a packet seen on tun0 but dropped by the host firewall requires a local policy change.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When NAT is the safer fallback
Use NAT when the remote private network has a router you cannot change or when adding reciprocal routes would disrupt an existing network. The OpenVPN gateway translates traffic from the remote tunnel subnet before forwarding it. The destination then returns packets to the gateway, which de-translates them back to the VPN client.
Limit NAT to the specific source and destination networks. A broad masquerade rule can unintentionally hide or permit traffic to unrelated networks. Document that service logs will show the gateway’s translated address, and retain VPN connection logs if you need to associate activity with an individual peer. NAT also makes unsolicited inbound sessions and fine-grained host policy harder; routed mode remains preferable when you control the return path.
Validate the tunnel and the real application path
- Check the listener: confirm that OpenVPN is listening on the expected public address, protocol, and port, and that the provider security group and host firewall allow it.
- Check certificate authentication: inspect both logs for a completed TLS handshake and a newly assigned tunnel address. Authentication errors must be fixed before route testing.
- Check the tunnel endpoints: from each VPS, test the other side’s tunnel address. This proves that the virtual interface and basic VPN path work.
- Check each routed direction: test an address in the remote service network from VPS A, then initiate a separate test from VPS B toward VPS A. Bidirectional ICMP is useful when firewalls allow it, but ICMP may be intentionally blocked.
- Test the actual service: use a TCP or UDP test that matches the application, such as connecting to its listening port from the permitted source address. A successful ping does not prove that the service port or its host firewall is open.
- Confirm source visibility: on the destination host, verify that logs show the expected remote private address in routed mode, or the translated gateway address in NAT mode.
Do not treat an ICMP failure as conclusive if the destination blocks ICMP. Conversely, do not treat a successful endpoint ping as proof that a database, API, or replication protocol is correctly routed.
Troubleshoot by following one packet
Choose one source, one destination, one protocol, and one direction. Then inspect each hop rather than changing several settings at once.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →| Symptom | Likely boundary | What to inspect |
|---|---|---|
| No TLS handshake | Public reachability or identity | Listener protocol and port, provider security group, host firewall, server address, certificate and key permissions, and clock accuracy. |
| Tunnel is up but remote subnet is unreachable | Route installation | ip route and ip route get on both VPS instances; server-side client mapping; and whether the advertised CIDR overlaps a local network. |
| Packets leave one side but no reply returns | Return routing or NAT | The destination host’s gateway, the upstream router’s route to the VPN subnet, forwarding state, and any required translation rule. |
| Endpoint ping works but application fails | Service or filtering | Application bind address, listening port, VPN-interface firewall rules, provider rules, and source-address ACLs. |
| Only one direction works | Asymmetric policy | Rules and routes independently for each direction; do not assume a permitted outbound flow implies permitted inbound traffic. |
Run packet capture at the same time on the gateway’s external interface, the OpenVPN interface, and the destination host. A typical Linux capture for the tunnel is:
sudo tcpdump -ni tun0 host 10.0.60.40Capture the public listener separately when diagnosing the handshake. If the packet appears on the external interface but not on tun0, examine OpenVPN authentication and route selection. If it appears on tun0 but not at the destination, inspect forwarding and the next route. If it reaches the destination but no response leaves, inspect the service bind address, local firewall, and return gateway. This packet-path method distinguishes a VPN problem from an ordinary routing or application problem.
Operate the tunnel securely over time
- Patch OpenVPN, the operating system, and the cryptographic libraries through the normal maintenance process.
- Review current package documentation before changing TLS or data-channel settings; cipher names, defaults, and deprecations evolve.
- Protect the CA and endpoint private keys with least-privilege permissions and encrypted backups.
- Issue one client certificate per VPS, revoke certificates for retired or compromised machines, and keep an inventory of certificate owners and expiry dates.
- Monitor service status, authentication failures, route changes, and firewall drops. Alert on repeated failed handshakes rather than silently restarting a broken configuration.
- Keep the public listener separate from application exposure. A VPN listener being reachable does not justify opening internal services on the public interface.
- Document every CIDR, route, firewall rule, certificate identity, and dependency on an upstream router. This record is essential when a provider changes a private-network address or when a replacement VPS is commissioned.
- If availability matters, design a second gateway or failover path explicitly. A single VPS endpoint is a single point of failure even when the encrypted tunnel itself is correctly configured.
Deployment checklist
- All tunnel, service, container, and provider-private networks are non-overlapping.
- The selected UDP or TCP listener is allowed by both provider and host firewalls.
- Server and client certificates are unique, mutually validated, and privately stored.
- IP forwarding is enabled only on the intended gateway systems.
- Each side has a persistent route to the peer’s required network, including return routes on upstream routers.
- Forwarding rules allow only the needed source, destination, protocol, and port combinations.
- Both tunnel-endpoint tests and real application tests pass in the required directions.
- Packet captures and firewall counters have been used to verify the path, not merely a process status check.
- Certificate revocation, patching, monitoring, backup, and failover procedures are documented.
With those controls in place, OpenVPN provides an encrypted, mutually authenticated path between the VPS networks while preserving ordinary IP routing and least-privilege firewall policy. The key distinction is operational: encryption establishes the tunnel, but correct routes, forwarding, and return-path filtering determine whether the application can actually use it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
