Constraints needed for OpenVPN within OpenVZ

You can run OpenVPN Access Server on a virtual host within a VPS (Virtual Private Server) if particular constraints are satisfied.

Prepare your VPS host so that the following requirements are met:

All the steps described below to be done on the host node, not the individual VPS container. You have to login as root user.

1. Make the iptables state and nat modules accessible to containers.

Edit /etc/vz/vz.conf and add "ipt_state iptable_nat" to the end of the list of IPTABLES modules.

2. Allow the container to open the TUN/TAP interface.

# vzctl stop <VPSID>

# vzctl set <VPSID> --devices c:10:200:rw --save

# vzctl set <VPSID> --capability net_admin:on --save

3. These kernel modules and commands should be ran/installed on the host node before the container is started:

# modprobe ipt_mark

# modprobe ipt_MARK

# modprobe tun

4. Now start the container:

# vzctl start <VPSID>

5. After starting the container run these commands on the host node:

# vzctl exec <VPSID> mkdir -p /dev/net

# vzctl exec <VPSID> mknod /dev/net/tun c 10 200

# vzctl exec <VPSID> chmod 600 /dev/net/tun

6. Install AS normally in the container.

That's it...