Home Page » News » How To » How to Turn an Android Phone into a Persistent OpenVPN Server (No Root)

How to Turn an Android Phone into a Persistent OpenVPN Server (No Root)

17 min read Learn step‑by‑step how to configure an Android device as a fully functional OpenVPN server using Termux, without rooting the phone. October 11, 2026 21:30

Running a personal VPN on a spare Android phone can give you a secure tunnel back to your home network without paying for a commercial service. This tutorial walks you through every step required to transform a regular Android device into a reliable OpenVPN server – all without rooting.

Before you start

Device requirements: Android 8.0 or newer, at least 2 GB RAM, and a stable Wi‑Fi connection.
Power source: Keep the phone plugged in. The server will stay active for hours, and battery drain can cause unexpected shutdowns.
Network considerations: You need control over your home router to forward UDP port 1194 (or any port you choose) to the Android device’s local IP address.
Permissions: Termux will request storage access to store certificates and configuration files. Grant the permission when prompted.

Step 1 – Install Termux and prepare the environment

Open the Google Play Store (or F-Droid) and install Termux. The F‑Droid version receives updates more quickly.
Launch Termux. The first launch will automatically install the default package repository.
Update the package list and upgrade existing packages:
```
pkg update && pkg upgrade -y
```
Install the required tools:
```
pkg install openvpn iproute2 iptables wget curl openssl -y
```
Why? openvpn provides the server binary, iptables will handle NAT, and openssl is needed for key generation.
Optional but recommended: install nano for easy file editing.
```
pkg install nano -y
```

Step 2 – Set up the Easy‑RSA PKI (Public Key Infrastructure)

OpenVPN uses X.509 certificates for mutual authentication. Easy‑RSA is a lightweight script that automates key creation.

Download Easy‑RSA 3.2.0 (or the latest stable tarball) directly into Termux:

wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.2.0/EasyRSA-3.2.0.tgz

Extract the archive:
```
tar xzf EasyRSA-3.2.0.tgz
```
Rename the folder for convenience:
```
mv EasyRSA-3.2.0 easy-rsa
```
Enter the directory and initialise a new PKI:
```
cd easy-rsa
./easyrsa init-pki
```
Build the Certificate Authority (CA). You will be prompted for a passphrase – choose a strong one and remember it:
```
./easyrsa build-ca nopass
```
If you prefer a pass‑protected CA, omit nopass and follow the prompts.
Create a server certificate and key (valid for 10 years, adjust as needed):
```
./easyrsa build-server-full server nopass
```
Generate a Diffie‑Hellman (DH) parameter file – this is required for older clients. Modern OpenVPN can use tls-crypt instead, but we include DH for maximum compatibility:
```
./easyrsa gen-dh
```
Optionally, create a client certificate (you can repeat this step for each device that will connect):
```
./easyrsa build-client-full client1 nopass
```

Step 3 – Assemble the server configuration file

OpenVPN reads a plain‑text .conf (or .ovpn) file. We will place it in ~/openvpn for clarity.

Create the configuration directory:
```
mkdir -p ~/openvpn
```

Copy the generated keys and certificates into this folder:

cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/dh.pem ~/openvpn/

Open a new file called server.conf with nano:
```
nano ~/openvpn/server.conf
```

Paste the following configuration (adjust the port and proto if you plan to use TCP):

port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh.pem

# Use modern TLS authentication (recommended)
#tls-crypt ta.key 0

# Keep the connection alive
keepalive 10 120
cipher AES-256-CBC
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

# Push routes to the client – adjust to your home LAN
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"

Why these options? keepalive helps detect dead peers, cipher and auth choose strong encryption, and push statements automatically configure the client’s routing.

Save the file (Ctrl+O) and exit (Ctrl+X).

Step 4 – Enable IP forwarding and set up NAT

For connected clients to reach the internet through your phone, the Android kernel must forward packets, and iptables must masquerade the traffic.

Enable IPv4 forwarding for the current session:
```
sysctl -w net.ipv4.ip_forward=1
```
Android does not expose /proc/sys/net/ipv4/ip_forward for permanent changes, so we set it each time the server starts.
Identify the interface that provides internet access (usually wlan0 for Wi‑Fi). Verify with:
```
ip addr show
```
Add a NAT rule that rewrites outgoing packets from the VPN tunnel (tun0) to the Wi‑Fi interface:
```
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
```

Allow forwarding between tun0 and wlan0:

iptables -A FORWARD -i tun0 -o wlan0 -j ACCEPT
iptables -A FORWARD -i wlan0 -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Persist the rules across reboots by creating a small script (optional but convenient):

cat > ~/openvpn/start-iptables.sh <<'EOF'
#!/data/data/com.termux/files/usr/bin/sh
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
iptables -A FORWARD -i tun0 -o wlan0 -j ACCEPT
iptables -A FORWARD -i wlan0 -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT
EOF
chmod +x ~/openvpn/start-iptables.sh

Step 5 – Start the OpenVPN server

Run the server in the foreground first to verify that the configuration is valid:
```
openvpn --config ~/openvpn/server.conf
```
You should see messages ending with Initialization Sequence Completed. Keep this terminal open for the next step.
To run the server as a background service, use Termux’s built‑in termux-service wrapper (available from termux-services package). Install it first:
```
pkg install termux-services -y
```

Create a service definition file ~/.termux/boot/openvpn.service (Termux:Boot will launch it after a reboot):

mkdir -p ~/.termux/boot
cat > ~/.termux/boot/openvpn.service <<'EOF'
[Unit]
Description=OpenVPN server on Android
After=network-online.target

[Service]
ExecStart=/data/data/com.termux/files/usr/bin/openvpn --config /data/data/com.termux/files/home/openvpn/server.conf
ExecStartPre=/data/data/com.termux/files/home/openvpn/start-iptables.sh
Restart=on-failure

[Install]
WantedBy=default.target
EOF

Enable the service:
```
sv enable openvpn
sv start openvpn
```
Now the VPN will start automatically after a reboot and stay alive in the background.

Step 6 – Export the client configuration

Clients need a single .ovpn file that contains the CA certificate, client certificate, private key, and optionally a tls-crypt key.

Navigate to the Easy‑RSA pki directory and copy the necessary files:

cd ~/easy-rsa/pki
cat ca.crt issued/client1.crt private/client1.key > ~/openvpn/client1.ovpn

Append the basic client configuration to the same file:

cat >> ~/openvpn/client1.ovpn <<'EOF'
client
dev tun
proto udp
remote YOUR_PUBLIC_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
auth SHA256
verb 3
EOF

Replace YOUR_PUBLIC_IP with the external IP address of your home network (or a dynamic DNS name).

If you generated a tls-crypt key (highly recommended), add it now:
```
cat ta.key >> ~/openvpn/client1.ovpn
```
Transfer the client1.ovpn file to the device that will act as a client. The simplest way is to use adb pull to your PC, then email or QR‑code it to the client.

Step 7 – Configure your home router

Without port forwarding, external clients cannot reach the Android server.

Log into your router’s admin interface (usually 192.168.1.1 or 192.168.0.1).
Locate the Port Forwarding or Virtual Server section.
Create a rule that forwards UDP port 1194 to the Android device’s local IP (e.g., 192.168.1.42).
Save and apply the changes. Some routers need a reboot.

Step 8 – Test the connection from a client

Install the official OpenVPN Connect app on another Android phone, Windows PC, macOS, or Linux machine.

Transfer the client1.ovpn file to the client device.
Open OpenVPN Connect, tap the + button, and import the .ovpn file.
Enter the VPN username/password if you added auth-user-pass (not required for certificate‑only auth).
Tap Connect. If everything is set up correctly you will see Connected and the log will end with Initialization Sequence Completed.
Verify that your public IP has changed (visit https://ifconfig.me from the client). The IP should now be the one of your home network.

Step 9 – Troubleshooting common issues

Warning: Making changes to iptables or forwarding settings can break other network functions. Keep a terminal window open with iptables -L -v -n so you can revert changes if needed.

9.1 Server does not start

Missing permissions: Ensure Termux has WRITE_EXTERNAL_STORAGE and INTERNET permissions (Settings > Apps > Termux > Permissions).
Port already in use: Run netstat -tunlp | grep 1194 to see if another app occupies the port. Change port in server.conf and update the router rule.
Incorrect file paths: OpenVPN expects absolute paths. Verify that ca.crt, server.crt, server.key, and dh.pem are all inside ~/openvpn or provide full paths.

9.2 Clients cannot reach the internet

Check that net.ipv4.ip_forward is set to 1. Run sysctl net.ipv4.ip_forward.
Confirm the NAT rule exists: iptables -t nat -L POSTROUTING -n -v. The rule should show traffic from 0.0.0.0/0 being masqueraded on wlan0.
If your carrier blocks UDP traffic, try switching to TCP (change proto udp to proto tcp in both server and client configs, and adjust the router forwarding accordingly).

9.3 Connection drops after a few minutes

Power‑saving features on some devices turn off Wi‑Fi when the screen is off. Disable Wi‑Fi optimization in Settings > Wi‑Fi > Advanced > Keep Wi‑Fi on during sleep.
Ensure the keepalive 10 120 line is present. It sends a ping every 10 seconds and expects a response within 120 seconds.

9.4 DNS resolution fails inside the VPN

Make sure the push "dhcp-option DNS 8.8.8.8" line is in server.conf. You can replace 8.8.8.8 with any public DNS you trust.
On Android clients, go to Settings > VPN > tap the connected OpenVPN profile > Advanced and enable Use default DNS if you see a conflict.

Step 10 – Maintaining the server

Renewing certificates: OpenVPN does not enforce expiration, but for good security rotate the CA and server certificates every 2‑3 years. Use the same Easy‑RSA steps from Section 2.
Updating OpenVPN: Periodically run pkg update && pkg upgrade openvpn -y inside Termux.
Monitoring logs: View the live log with tail -f ~/openvpn/openvpn-status.log. Look for lines like CLIENT_LIST to see connected clients.

What you have achieved

By following this guide you now have a self‑hosted OpenVPN server running on an Android phone that can be started automatically, survives reboots, and provides encrypted access to your home network from anywhere. Because the solution uses only standard Android components and Termux, it works on a wide range of devices without rooting, and you retain full control over keys and traffic.

Remember to keep your private keys safe, use strong passwords for the CA if you chose to protect it, and regularly check your router’s port‑forwarding rules after firmware updates. With these habits in place, your Android‑based VPN will remain a reliable, privacy‑respecting gateway for years to come.

User Comments (0)

Add Comment

No comments added yet.

Add Comment

Your Name: *

Comment Title: *

Your E-mail: * We'll never share your email with anyone else.

Your Comment: *

Comments will not be approved to be posted if they are SPAM, abusive, off-topic, use profanity, contain a personal attack, or promote hate of any kind.