iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To install Pritunl on Ubuntu 24.04, add the signed MongoDB 8.0, OpenVPN and Pritunl APT repositories, install MongoDB and the VPN packages, start mongod and pritunl, then finish configuration in the web console. You will need a sudo-enabled non-root account, a DNS A record for the server, and reachable TCP 80 and 443. The process produces a working OpenVPN or WireGuard service and downloadable client profiles. Ubuntu is supported in practice, but Pritunl cautions that future Ubuntu support is not tested or guaranteed to the same extent as RHEL-family distributions, so test upgrades before using the server in production.
What do you need before installing Pritunl on Ubuntu 24.04?
Prepare the host and network first. A small test installation can run on one Ubuntu 24.04 server with MongoDB on the same machine; production deployments should reserve memory and CPU headroom for the database and concurrent VPN sessions.
- An up-to-date Ubuntu 24.04 server with a public IP address.
- A non-root user with
sudoprivileges. Keep direct root SSH disabled where your operating policy permits. - A DNS A record such as
pritunlvpn.example.compointing to the server’s public IP. - Firewall access for SSH from your administration network, TCP 80 for certificate validation, and TCP 443 for the Pritunl console. VPN listener ports depend on the server configuration you choose later.
- Outbound HTTPS access so APT can reach the signed repositories and the host can obtain updates.
- A plan for backups of MongoDB and Pritunl configuration before upgrades.
The DNS record should resolve publicly before you request a certificate. If the name resolves to an old address, a certificate request or browser connection can fail even when the service itself is healthy.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →How does a Pritunl installation fit together?
Pritunl uses MongoDB for management data such as organizations, users, servers and settings. OpenVPN and WireGuard provide the VPN protocol support, while the Pritunl service presents the administrative web console and coordinates those components.
#1 Best Overall
On a single host, MongoDB normally listens locally and the Pritunl console uses a localhost MongoDB URI. In a cluster, every Pritunl host must connect to the same MongoDB database; separate databases per node do not form a supported cluster. Pritunl recommends high-memory database instances and high-clock-speed CPUs for Pritunl nodes, so do not size a larger deployment solely by disk space.
How do you add the required Ubuntu 24.04 repositories?
Use the repository definitions and GPG key commands shown in Pritunl’s current Ubuntu installation documentation. The important details are the distribution names, keyring location and signed APT metadata: MongoDB must use the noble/mongodb-org/8.0 channel, OpenVPN must use its stable noble channel, and Pritunl must use its stable/apt noble channel.
- Install the tools used to verify repositories.
sudo apt update sudo apt install -y gnupg ca-certificates curl - Create the keyring directory.
sudo install -d -m 0755 /usr/share/keyrings - Import all three vendor signing keys into
/usr/share/keyrings. Use the current key files and fingerprints published by MongoDB, OpenVPN and Pritunl. Store each key with a distinct filename, for example a MongoDB keyring, an OpenVPN keyring and a Pritunl keyring. Do not use the deprecated globalapt-keymechanism. - Create separate APT source files. The MongoDB entry must target Ubuntu
noble, MongoDB8.0and themultiversecomponent. The OpenVPN entry must target its stable Ubuntu 24.04 repository. The Pritunl entry must target the stable APT repository fornoble. Each line should includesigned-by=/usr/share/keyrings/<matching-keyring>so APT verifies that repository with the intended key. - Refresh package metadata and inspect errors.
sudo apt updateEvery configured repository should complete without a missing-key, unsupported-release or signature error. Stop here and correct the source or keyring rather than bypassing signature checks.
Repository signing is part of the security boundary. Retain the source files and keyrings so you can audit package provenance later, and record the package versions installed on the server.
How do you install MongoDB, OpenVPN, WireGuard and Pritunl?
Once all three signed repositories are available, install the documented package set. MongoDB supplies the management datastore; OpenVPN, WireGuard and their tools provide protocol support; and pritunl installs the server and console.
sudo apt install -y mongodb-org openvpn wireguard wireguard-tools pritunlAPT may install additional dependencies. Review the transaction and confirm that packages are coming from the intended repositories. If APT reports that a package has no installation candidate, revisit the repository distribution and component names before continuing.
How do you start and verify the Pritunl and MongoDB services?
Enable both services so they start after reboot, then check their current state before opening the web console.
Rank #2
sudo systemctl enable --now mongod
sudo systemctl enable --now pritunl
sudo systemctl status mongod --no-pager
sudo systemctl status pritunl --no-pagerEach status should show active (running). If mongod is not running, Pritunl cannot read or write its configuration. Inspect recent service messages with:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo journalctl -u mongod -n 100 --no-pager
sudo journalctl -u pritunl -n 100 --no-pagerCorrect database, repository or permission errors first. Repeatedly restarting Pritunl without resolving a failed MongoDB service will not complete setup.
How do you generate the one-time Pritunl setup key?
Generate the setup key locally on the server:
sudo pritunl setup-keyCopy the output into a protected password manager or terminal session. Treat it as a one-time secret: do not publish it in shell history, tickets or chat. You will enter it in the browser during initial setup; it is not a replacement for the administrator password.
Which firewall and DNS settings are required for the web console?
Allow only the traffic required by your deployment. TCP 80 is needed when a certificate authority validates the hostname over HTTP; TCP 443 carries the HTTPS console. Keep SSH restricted to your administration networks, and add the VPN protocol ports only after you decide which Pritunl server listeners to use.
sudo ufw allow from <admin-network> to any port 22 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseReplace <admin-network> with your real management CIDR; do not leave a broad SSH rule if your policy allows a narrower one. If an external cloud firewall, security group or load balancer exists, permit the same traffic there. After certificate validation, remove temporary broad rules and retain only the ports required by the console, VPN listeners and administration.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteVerify DNS from a separate network with a resolver such as:
dig +short pritunlvpn.example.comThe returned address must be the server’s public IP. A private-only name can be used for an internal console, but it will not satisfy a public certificate authority unless the validation path is available as required by that authority.
How do you complete the first web-console setup?
Open https://pritunlvpn.example.com after the services, DNS and firewall are ready. The initial page asks for the setup key and database connection details.
- Enter the one-time key generated by
sudo pritunl setup-key. - Review the MongoDB URI. For a single-host installation it is normally a localhost connection. Use a shared, authenticated MongoDB URI only when you have deliberately built that architecture.
- Save the configuration and wait for the console to reload.
- On the server, generate the temporary default credentials:
sudo pritunl default-password- Sign in with the displayed temporary password and immediately replace it with a long, unique administrator password. Store the new credential in an approved password manager.
- Configure the public hostname and HTTPS certificate in the console. Keep the hostname consistent with the DNS A record and the name users will visit.
Do not leave the generated default password in use. Administrative access controls the VPN configuration, user accounts and downloadable profiles.
Recommended Free Tools
How do you create an organization, user and VPN server?
Pritunl organizes access hierarchically: an organization contains users, and a VPN server defines the network and protocol settings to which those users connect.
- Create an organization for the team, department or environment that will share policy.
- Add a user to that organization. Give each person an individual account rather than sharing one profile, so access can be revoked without affecting everyone else.
- Create a VPN server and choose OpenVPN or WireGuard settings appropriate for your clients. Define the virtual network, DNS behavior, routing and listener port according to the networks that must be reached.
- Start the VPN server from the console and confirm that its status changes to running.
- Attach the organization to that VPN server and generate or download the user’s profile.
Use the narrowest routes and user permissions that meet the requirement. A full-tunnel profile sends all client traffic through the VPN; a split-tunnel design sends only selected private networks through it and requires deliberate route and DNS planning.
How do clients connect after setup?
The official Pritunl Client supports OpenVPN and WireGuard profiles on Ubuntu 24.04, Windows and macOS. Download the profile generated for the specific user and import it into the client; compatible third-party clients can also use the corresponding OpenVPN or WireGuard profile.
Rank #4
- Install the Pritunl Client on the user’s operating system.
- Import the downloaded profile file, or use the console’s enrollment method if your policy enables one.
- Sign in with the assigned user credentials when prompted.
- Connect and verify that the client receives a VPN address, resolves the expected internal DNS names and reaches only the networks permitted by the server policy.
- Disconnect, reconnect and test from an external network such as a mobile hotspot. This confirms that the test was not accidentally using a local route.
Never email profiles without protection. A profile can contain credentials or keys that grant access; revoke and regenerate it if the file is exposed.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should you check when the console or VPN does not work?
The browser times out
Check that the DNS A record points to the current public IP, TCP 443 is allowed in every firewall layer, and pritunl is listening. Review sudo systemctl status pritunl and the Pritunl journal. If only certificate issuance fails, confirm that TCP 80 is reachable for the selected validation method.
The setup page rejects the key
Generate a fresh key with sudo pritunl setup-key, copy it exactly and use it promptly. Verify that you are connecting to the same host on which the key was generated and that the Pritunl service was restarted after installation.
Pritunl reports a database error
Confirm that mongod is active, that its local data directory is writable and that the console’s URI matches the intended database. Read both service journals for authentication or storage errors rather than changing the URI blindly.
A client connects but cannot reach an internal service
Check the VPN server’s routes, DNS settings and organization attachment. The destination network must have a return route through the VPN gateway, and upstream firewalls must permit traffic from the VPN address range.
WireGuard or OpenVPN will not establish a tunnel
Verify that the selected listener port is allowed through host and cloud firewalls, that the downloaded profile belongs to the correct server and user, and that the client clock is accurate. Test from another network to separate a local firewall problem from a server-side configuration problem.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Should you use one Ubuntu host or a Pritunl cluster?
A single host is simpler and suits a pilot or modest installation. A cluster improves maintenance and failure tolerance only when the shared MongoDB service, network paths and operational processes are designed for that purpose.
| Decision factor | Single Ubuntu 24.04 host | Clustered design |
|---|---|---|
| MongoDB placement | Local MongoDB on the same server | All Pritunl hosts connect to one shared MongoDB database |
| Failure tolerance | Host failure takes down the console and VPN service | Can tolerate a node failure when load balancing, database availability and networking are also resilient |
| Resource planning | One host shares CPU and memory between MongoDB and Pritunl | Reserve memory for MongoDB and high clock speed for each Pritunl node |
| Concurrent-connection target | Best for a measured, limited target | Size by connections per node, database memory and failover headroom |
| Firewall and operations | Fewer addresses, rules and certificates | More nodes, health checks, firewall paths and upgrade testing |
| Ubuntu support caveat | Applies directly to the host | Applies to every Ubuntu node and the surrounding automation |
Pritunl’s installation documentation gives a vendor sizing heuristic of approximately $0.50–$1.00 per concurrent connection each month in server costs. Treat that as planning guidance, not an independent benchmark; actual cost depends on provider, traffic, redundancy and database sizing.
How do you secure and operate the installation over time?
- Keep MongoDB, OpenVPN, WireGuard and Pritunl packages updated from their signed repositories. Test upgrades on a disposable Ubuntu 24.04 instance before production.
- Record repository key fingerprints, package versions and configuration changes so a rollback has a known starting point.
- Back up MongoDB and protect the backup location as carefully as the live server.
- Use HTTPS for administration, restrict SSH and remove temporary certificate-validation or troubleshooting firewall rules.
- Review users and profiles regularly; revoke accounts promptly when staff or devices change.
- Monitor service state, disk space, database growth, certificate expiry and concurrent connections.
- Document the Ubuntu support limitation. Pritunl states that “Future support with Ubuntu installations is not tested or guaranteed,” while its strongest continuous-testing and future-support focus is on RHEL distributions.
For a cluster, document the shared MongoDB dependency explicitly: Pritunl states that all hosts in a cluster need to connect to the same MongoDB database. A cluster without a resilient database and tested failover is only a collection of single points of failure.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Frequently Asked Questions
Can Pritunl use WireGuard instead of OpenVPN on Ubuntu 24.04?
Yes. Install both wireguard and wireguard-tools, then create a WireGuard-capable server in the console. Clients still need a profile generated for that protocol; an OpenVPN profile cannot be imported as a WireGuard configuration.
Is MongoDB required on every Pritunl node?
No. A single-host deployment can run MongoDB locally, while clustered Pritunl hosts should use the same shared MongoDB database. Plan authentication, network access, backups and database capacity before moving MongoDB off the VPN node.
Can I put the Pritunl console behind a reverse proxy?
You can place it behind controlled infrastructure, but preserve correct HTTPS, hostname, forwarding headers and WebSocket behavior. Ensure the proxy and upstream firewalls still allow certificate validation and the VPN listener ports; proxying the console does not proxy the VPN tunnels automatically.
What is the safest way to test a new Pritunl upgrade?
Clone the package versions and keyring configuration in a non-production Ubuntu 24.04 server, restore a representative MongoDB backup and test administrator login plus OpenVPN and WireGuard connections. Promote the upgrade only after checking certificate renewal, profile downloads and routes.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
