Learn OpenVPN - Pre-Requisites Skills & Setup Environment

#Introduction

Welcome to the Learn OpenVPN series! This series will take you on a journey to master OpenVPN — the most widely used open-source SSL/TLS-based VPN software for remote access, site-to-site, and network traffic protection — from concepts to production readiness. There are 23 episodes in total, organized into six phases.

But before we touch openvpn, there are a number of foundational skills and software packages you must have. Why are these prerequisites important? Because OpenVPN works on three layers at once: networking for routing and encapsulation, Linux for the daemon and systemd, and TLS for building trust between nodes. If any of these foundations is weak, troubleshooting in later episodes will feel difficult.

Episode 0 is your roadmap: we will verify your foundational skills, set up two or three Linux VMs, install OpenVPN, Easy-RSA, and OpenSSL, and confirm that your environment is ready to build your first VPN lab in episodes 1 through 3.

#Foundational Skills You Must Master

Before setting up the software, make sure the following theoretical foundations are familiar. Each topic will be used repeatedly throughout the series.

#Networking: TCP, UDP, Routing, and Firewall

OpenVPN communicates over UDP port 1194 or TCP port 443, so you must understand the difference between the two. UDP is faster for VPNs because it does not perform a three-way handshake per packet, while TCP is often used when the network only allows standard web traffic.

In addition, you need to understand IP addressing, subnetting, and routing. In episode 6 we will build a virtual subnet of 10.8.0.0/24 and set up routes between networks.

Basic firewall skills are also required, especially for NAT with iptables and for restricting access to the OpenVPN port. Commands like iptables -t nat -A POSTROUTING will become your companion starting in episode 6.

#Linux, systemd, and CLI

OpenVPN runs as a Linux daemon managed by systemd. You should be comfortable with:

• package managers: apt, dnf, or brew depending on the distro you use.
• systemctl to manage services: start, enable, status.
• basic CLI tools: ls, cd, cp, chmod, and a terminal text editor.

If you are still unsure about these basics, take some time to practice before moving on. How quickly you can follow this series depends heavily on how smoothly you can operate the terminal.

#TLS and X.509 Certificates

OpenVPN uses X.509 certificates for mutual authentication between server and client. You need to understand the concepts of a CA (Certificate Authority), a certificate chain, and a key pair.

You don't need to be able to create certificates yourself yet — that is covered in depth in episode 4. But understanding that both server and client must have certificates signed by the same CA will make the whole series much more coherent.

#Software to Prepare

Here is the list of software that must be available in your lab. The version used in this series is OpenVPN 2.7.x, the latest stable release.

#OpenVPN 2.7.x and Its Dependencies

Install the main package on both server and client:

apt update
apt install -y openvpn easy-rsa

For the Red Hat family use dnf install -y openvpn, and on macOS brew install openvpn. Verify the installation with openvpn --version:

openvpn --version

Make sure the output shows OpenVPN 2.7.x. If it is still an older version, update your repositories before continuing.

#Easy-RSA and OpenSSL

Easy-RSA is a wrapper script on top of OpenSSL that makes managing a CA and certificates easier. OpenSSL itself is the cryptography library that underpins TLS in OpenVPN. Verify both:

openssl version
easyrsa --version

openssl version should show OpenSSL 3.x, and easyrsa --version will show Easy-RSA 3.x. These two tools are the backbone of certificate management in episode 4.

#Docker as a Lab Alternative

If you don't have physical VMs, you can use the widely known kylemanna/openvpn image. Docker is also useful for testing clients in a clean environment without polluting your main system.

For episodes 17 and 21, experience with Docker and container networking will be very helpful. But for the first 16 episodes, two Linux VMs are more than enough.

#Setting Up the Lab Environment

Here is the lab layout we will use throughout the series. Take note of each host's role.

#Two or Three Linux VMs

• One server VM with an externally reachable IP address, e.g. 203.0.113.10.
• One client VM acting as a remote worker.
• Optional: a third VM for site-to-site testing in episode 15.

If you use cloud, make sure the cloud firewall (security group) opens UDP 1194. This is often the cause of failed connections in episode 3.

#Verifying the TUN Device

OpenVPN tun mode requires the virtual device /dev/net/tun. Make sure it exists on both server and client:

ls -l /dev/net/tun

If the file is missing, in a Docker container run with the flags --cap-add=NET_ADMIN --device=/dev/net/tun. On standard VMs this device is usually available by default.

#Verifying the Installation

Before moving on to episode 1, do a thorough verification that your environment is ready to use:

openvpn --version
openssl version
easyrsa --version
ls -l /dev/net/tun
ip addr show

Pay attention to ip addr show to confirm network interface names such as eth0 or ens3. These interface names will be used repeatedly in iptables configuration from episode 6 onward.

If all commands run without error, your environment is officially ready. Keep a small note of your server IP, interface names, and OpenVPN version — you will need this information in nearly every upcoming episode.

#Conclusion

Key takeaways:

• OpenVPN works on three layers: networking, Linux/systemd, and TLS.
• Prepare two or three Linux VMs, plus Docker as a backup lab.
• Install OpenVPN 2.7.x, Easy-RSA 3.x, and OpenSSL 3.x on both server and client.
• Make sure /dev/net/tun is available and open UDP 1194 in the firewall.
• Verify with openvpn --version and note the network interface names.
• Master the concepts of CA and certificate chain first, since they are used in episode 4.

In the next episode, episode 1, we will discuss history, background, and why choose OpenVPN — from the failures of IPsec and PPTP, the birth of OpenVPN in 2001 by James Yonan, to mass adoption by Cloudflare WARP and corporate VPNs. Make sure your lab is ready, because the Learn OpenVPN journey has only just begun!