Setting up a root VPN typically involves configuring a VPN server on a Linux system with root access. Here are the steps to install and configure a VPN server (using OpenVPN or WireGuard) on a root-enabled Linux machine:

Option 1: OpenVPN Setup

Install OpenVPN & Easy-RSA

sudo apt update
sudo apt install openvpn easy-rsa

Set Up PKI (Certificates)

make-cadir ~/openvpn-ca
cd ~/openvpn-ca
nano vars  # Edit and set certificate details
source vars
./clean-all
./build-ca
./build-key-server server
./build-dh
openvpn --genkey --secret keys/ta.key

Configure OpenVPN Server

sudo cp ~/openvpn-ca/keys/{ca.crt,server.crt,server.key,ta.key,dh2048.pem} /etc/openvpn/
sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/
sudo nano /etc/openvpn/server.conf  # Modify config (e.g., `proto udp`, `dev tun`)

Enable IP Forwarding

sudo nano /etc/sysctl.conf  # Uncomment: net.ipv4.ip_forward=1
sudo sysctl -p

Start OpenVPN

sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server

Generate Client Configs

cd ~/openvpn-ca
./build-key client1```
---
### **Option 2: WireGuard Setup (Faster & Simpler)**
#### **1. Install WireGuard**
```bash
sudo apt update
sudo apt install wireguard

Generate Keys

wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod 600 /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

Configure Server (wg0.conf)

sudo nano /etc/wireguard/wg0.conf

Example config:

[Interface]
PrivateKey = <SERVER_PRIVATE_KEY>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = <CLIENT_PUBLIC_KEY>
AllowedIPs = 10.0.0.2/32

Enable IP Forwarding

sudo nano /etc/sysctl.conf  # Uncomment: net.ipv4.ip_forward=1
sudo sysctl -p

Start WireGuard

sudo systemctl enable --now wg-quick@wg0

Client Setup

• Generate client keys (wg genkey / wg pubkey).
• Add the client as a [Peer] in /etc/wireguard/wg0.conf.
• Create a client config (wg0.conf) with the server’s public key and endpoint.

Security & Firewall

• UFW Firewall Rules (OpenVPN example):

  sudo ufw allow 1194/udp  # OpenVPN
  sudo ufw allow 51820/udp # WireGuard

• Avoid running VPN as root; use sudo where possible.

Conclusion

• OpenVPN: More complex, TLS-based, widely compatible.
• WireGuard: Faster, simpler, modern alternative.

Would you like help with a specific VPN setup or troubleshooting?