iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
A VPS can act as the Internet gateway for your home server, laptop, or remote network. Run OpenVPN in server mode on the VPS, connect your device as a client, enable Linux IP forwarding, and add source NAT (masquerading). With redirect-gateway def1 pushed to the client, ordinary Internet traffic enters the tunnel and leaves through the VPS, so public services see the VPS egress address rather than your home address.
The setup is straightforward only when routing, firewalling, NAT, and DNS are configured together. The steps below show a complete community OpenVPN design, explain full-tunnel and split-tunnel choices, and give checks for the common case where the tunnel connects but Internet access does not work.
What the VPS VPN middleman does
The VPS has a public, Internet-reachable address and two logical paths: its Internet-facing interface and its OpenVPN tunnel interface. Your home or remote machine establishes a TLS-authenticated OpenVPN session to the VPS. The VPS then routes packets from the VPN subnet out to the Internet and rewrites their source address with source NAT.
To an Internet service, the connection therefore appears to originate from the VPS. The VPS is not merely forwarding a port; it is acting as a router and egress gateway.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
- Client: your home server, workstation, phone, or another network behind the OpenVPN connection.
- VPN server: a Linux VPS with a public address, SSH access, and permission to create a VPN listener.
- Tunnel subnet: the private address range OpenVPN assigns to clients. Use the range in your actual configuration; examples such as
10.9.8.0/24are illustrative only. - Egress interface: the VPS interface connected to the Internet, often named
eth0orens3, but provider images can use different names.
Requirements and design decisions
| Item | What you need to decide or verify |
|---|---|
| VPS reachability | A public address, SSH administration, and an inbound firewall/security-group rule for the OpenVPN port and protocol you select. |
| Operating system | A supported Linux distribution with OpenVPN, a certificate tool such as Easy-RSA, and a packet-filter/NAT stack. |
| Interface name | The real Internet-facing device name from ip addr or ip route; do not assume eth0. |
| VPN subnet | The subnet in the server configuration. Every FORWARD and NAT rule must match it exactly. |
| Traffic policy | Full tunnel for all Internet traffic, or split tunnel for only selected destinations. |
| DNS | A resolver address reachable through the tunnel, or a deliberate client-side DNS arrangement. |
Full tunneling is the simplest way to make the VPS public address visible, but it uses VPS bandwidth and adds encryption and Internet round-trip overhead. Split tunneling can preserve local access and performance while sending only selected networks through the VPS.
Full tunnel versus split tunnel
| Mode | Routing directive | Advantages | Costs and edge cases |
|---|---|---|---|
| Full tunnel | push "redirect-gateway def1" |
All client IP traffic follows the VPN; Internet services see the VPS egress address without per-application routes. | Consumes VPS bandwidth, can be slower, and requires working VPN DNS. DHCP renewal and Windows DNS behavior can need platform-specific handling. |
| Split tunnel | Push specific route entries, or control route installation with client options. |
Only chosen destinations use the VPS, preserving local Internet paths and reducing load. | Traffic not covered by a pushed route can bypass the VPS, so it will not receive the VPS public address. |
OpenVPN’s redirect-gateway def1 installs routes that send all client IP traffic through the server. If your requirement is only a private subnet, a work network, or a small list of destinations, push those routes instead and document which traffic remains local.
Step 1: Inspect the VPS before installing OpenVPN
- Find the Internet interface and default gateway. Run
ip addr ip routeLook for the interface associated with the default route. Record its exact name.
- Check the VPS provider firewall. Permit the OpenVPN listener’s UDP or TCP port in the provider console as well as in any host firewall. Keep SSH access restricted to your administration source where practical.
- Select a non-conflicting tunnel subnet. It must not overlap the client’s home LAN or any network the client must reach. Put the chosen network in the OpenVPN server configuration and use the same value in firewall rules.
Step 2: Install OpenVPN and create certificates
Install the OpenVPN package supplied by your distribution and a PKI utility such as Easy-RSA. Exact package names and service paths vary by distribution, so use the package manager and layout documented for your release.
Create a certificate authority, a server certificate, and a separate certificate/key pair for each client. Easy-RSA supports certificate generation and revocation; revoking a lost or decommissioned client certificate is part of operating the VPN, not an optional cleanup task.
- Keep the certificate-authority private key and server private key readable only by the accounts that need them.
- Give each device its own client certificate so one compromised profile can be revoked without replacing every client.
- Transfer client private keys over an encrypted administrative channel and protect them with the device’s normal file permissions.
- Do not paste private keys into tickets, chat, shell history, or a world-readable web directory.
The OpenVPN server configuration normally specifies the TLS material, tunnel device, listener address and port, and the VPN subnet. A minimal policy fragment for a full tunnel looks like this:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
server 10.9.8.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"The addresses above are examples. Replace the subnet with your configured tunnel network and replace the DNS address with a resolver that is genuinely reachable from that network. Do not publish or reuse the private-key portions of a real configuration.
Recommended Free Tools
Step 3: Enable Linux packet forwarding
Linux does not forward packets between interfaces when net.ipv4.ip_forward is zero. Set it to one before diagnosing firewall rules.
- Create a persistent sysctl drop-in, for example:
sudo sh -c 'printf "net.ipv4.ip_forward = 1n" > /etc/sysctl.d/99-openvpn-forward.conf'- Apply the setting:
sudo sysctl --system- Confirm the running value:
sysctl net.ipv4.ip_forwardThe output should show net.ipv4.ip_forward = 1. If it is still zero, fix the sysctl configuration before changing NAT rules; a NAT rule cannot compensate for a kernel that refuses to route.
Step 4: Push the correct routes to clients
Full-tunnel routing
Add this directive to the server configuration:
push "redirect-gateway def1"After reconnection, the client installs routes that direct ordinary IPv4 traffic through the OpenVPN tunnel. The VPS remains reachable because OpenVPN preserves a route to the server endpoint while changing the effective default path.
Split-tunnel routing
Instead of replacing the client’s default path, push only the networks that should use the VPS:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
push "route 192.0.2.0 255.255.255.0"Use the actual destination network, not the documentation-only address shown above. Client options such as route-nopull can prevent pushed routes from being installed when you need local control, but that also means you must add the required routes yourself.
Step 5: Permit forwarding and apply source NAT
Two separate firewall functions are required. The FORWARD policy must allow packets from the VPN subnet to leave through the Internet interface and allow related return traffic. POSTROUTING must rewrite the source address so upstream networks know to return traffic to the VPS.
iptables example
For a VPN subnet of 10.9.8.0/24 and an Internet interface named eth0, a representative setup is:
sudo iptables -A FORWARD -s 10.9.8.0/24 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -d 10.9.8.0/24 -i eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 10.9.8.0/24 -o eth0 -j MASQUERADEIf your FORWARD policy is DROP, the two allow rules are essential. Narrow them to the actual tunnel subnet and egress interface. Replace both values if your OpenVPN configuration or interface differs. MASQUERADE uses the current address of the outgoing interface, which is useful when a VPS address can change.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutenftables equivalent
On distributions using nftables as the primary firewall, implement the same policy in the distribution’s supported ruleset rather than layering ad-hoc iptables commands. The NAT concept is a postrouting masquerade rule, for example:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
table ip nat {
chain postrouting {
type nat hook postrouting priority 100;
ip saddr 10.9.8.0/24 oifname "eth0" masquerade
}
}Add equivalent forward-chain rules for the outbound tunnel traffic and established return traffic. Ensure the rules are loaded at boot using your distribution’s firewall service; a rule that works interactively but disappears after reboot is not a complete configuration.
Step 6: Provide DNS through the tunnel
When the default route moves into the VPN, DNS queries can move there as well. A client that keeps using an unreachable local resolver may show a connected tunnel but fail to browse by name.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A server can push a DNS option such as:
push "dhcp-option DNS 10.8.0.1"Only use a resolver address that actually answers from the client tunnel. It might be a resolver running on the VPS or another reachable DNS service. Verify the address and firewall path; the example address is not a universal OpenVPN default.
Full-tunnel mode has documented DHCP-renewal and Windows DNS edge cases. If a client loses local network services after connecting, test split tunneling or use the platform’s supported DNS handling rather than weakening the entire firewall.
Step 7: Start the intended OpenVPN service
Distribution service names can be instance-specific. If your configuration is named myserver.conf, Ubuntu’s instance pattern is:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
sudo systemctl enable --now openvpn@myserverThe generic openvpn unit may not load the configuration you just created. Confirm the active unit and inspect its logs:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemssudo systemctl status openvpn@myserver
sudo journalctl -u openvpn@myserver -bOn the client, import the generated profile, connect, and wait for the tunnel to receive an address from the configured VPN subnet.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify that the VPS is really the public gateway
- Confirm the tunnel address. On the client, inspect the OpenVPN/TUN interface and verify that it has an address from the server’s configured subnet.
- Inspect routes. Check the client routing table. In full-tunnel mode, the effective default path should point into the VPN; in split mode, only the selected networks should do so.
- Check the public address before and after connecting. Use the same public-IP checking method both times. After a working full-tunnel connection, the observed address should be the VPS egress address, not the home connection’s address.
- Test DNS separately from routing. Resolve a known hostname, then test a numeric Internet address. A numeric-address success with hostname failure points to DNS rather than forwarding.
- Inspect counters on the VPS. OpenVPN logs should show the client session. FORWARD and NAT rule counters should increase when the client generates Internet traffic.
Troubleshooting: connected tunnel, no Internet
| Symptom | Likely cause | What to check |
|---|---|---|
| Client connects but keeps its home public address | The default route was not pushed or the client rejected it. | Check for redirect-gateway def1, reconnect, and inspect the client route table. |
| Routes point through the tunnel, but no replies return | Forwarding is disabled, FORWARD rules are missing, or the egress interface is wrong. | Confirm sysctl net.ipv4.ip_forward, rule counters, and the interface used by ip route. |
| Outbound packets leave but Internet services cannot reply | POSTROUTING MASQUERADE is absent or uses the wrong subnet/interface. | Check the NAT rule and its packet counter; replace example values with the actual ones. |
| Numeric addresses work but names do not | The pushed resolver is unreachable or the client retained an unsuitable DNS setting. | Verify the resolver address from the tunnel and inspect platform DNS status. |
| Browsing is noticeably slow | All traffic now traverses the VPS and OpenVPN processing adds overhead and distance. | Use split tunneling for destinations that do not need the VPS, or choose a VPS location closer to the clients. |
| Local DHCP or Windows name resolution breaks | Full-tunnel route and DNS behavior conflicts with local network assumptions. | Test split tunneling and apply the operating system’s supported DNS configuration. |
| Service starts but the new configuration is ignored | The wrong systemd unit was started. | Use the instance-specific unit matching the configuration filename and read its journal. |
Security and operational practices
- Restrict the VPS provider firewall and host firewall to the OpenVPN listener, SSH administration, and any explicitly required services.
- Use separate client certificates and revoke profiles that are lost, shared improperly, or no longer needed.
- Protect the CA, server key, and client keys with least-privilege file permissions.
- Keep OpenVPN and the operating system patched, and review logs for repeated authentication failures.
- Document the tunnel subnet, egress interface, listener protocol/port, DNS resolver, and the systemd unit name. These values are what you will need after a reboot or migration.
- Remember that NAT changes the address visible to Internet services; it does not make the VPS a private, anonymous network. The VPS operator and systems along the connection can still observe metadata permitted by their access.
Community OpenVPN, Access Server, iptables, or nftables?
| Choice | Best fit | Trade-off |
|---|---|---|
| Community OpenVPN | Administrators who want direct control of certificates, routes, firewall rules, and system services. | More manual setup and ongoing responsibility for PKI, upgrades, and troubleshooting. |
| OpenVPN Access Server | Teams that prefer a managed administration interface and packaged user management. | Less low-level control and a separate product and licensing model. |
| iptables | Existing deployments and administrators familiar with its rule syntax. | It is a legacy interface on many current distributions, so persistence and interaction with the system firewall need attention. |
| nftables | Distributions whose current firewall stack is nftables-based. | Requires learning the ruleset structure and loading it through the distribution’s normal firewall service. |
Choose one firewall management path and make it persistent. Mixing tools without understanding which ruleset is authoritative makes a working VPN difficult to reproduce and troubleshoot.
When this design is the right answer
Use a VPS middleman when you need a stable public egress address, cannot expose your home connection directly, or want selected remote traffic to leave from a different network. It is also useful for a home server whose outbound connections must originate from a known address.
It is less suitable when the VPS is far from the clients, the provider’s bandwidth allowance is small, or the application is sensitive to added latency. In those cases, split tunneling can limit the cost while preserving the VPS route only where it is necessary.
Quick Recap
Final configuration checklist
- The VPS has a public address and accepts the OpenVPN listener traffic.
- Certificates and keys were generated per device and stored securely.
net.ipv4.ip_forwardis persistently set to1.- The server pushes either
redirect-gateway def1or the intended specific routes. - The FORWARD policy permits tunnel-to-Internet traffic and established return traffic.
- POSTROUTING MASQUERADE uses the real VPN subnet and Internet interface.
- The pushed DNS resolver is reachable through the tunnel.
- The instance-specific OpenVPN service starts at boot.
- The client route table, DNS resolution, public address, and VPS firewall counters have all been checked after connection.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
