Security

How to Install Pritunl VPN on Rocky Linux & AlmaLinux 8

Install Pritunl VPN on Rocky Linux and AlmaLinux 8: add the EPEL and Pritunl repos, install MongoDB 8.0 and WireGuard tools, then set up the web console.

In this guide we will learn how to install and configure Pritunl vpn server in Rocky Linux 8. Pritunl is a free and open source enterprise distributed VPN server. It allows you to virtualize your private networks across datacenters and provide simple remote access in minutes. It utilizes a graphical interface that is friendly and easy to use to the user. It is secure and provides a good alternative to the commercial VPN products.

Which release should you use? Pritunl still builds current packages for EL8 — as of July 2026 the EL8 repo carries the same pritunl 1.34 releases as EL9 and EL10. Rocky Linux 8 and AlmaLinux 8 are, however, in the security-only phase of the RHEL 8 lifecycle (full support ended May 2024, maintenance runs to May 2029). If you are building a new server rather than maintaining an existing one, use How to install and configure Pritunl in Rocky Linux/ Alma Linux 9 instead — the steps are the same, only the repo paths change.

Ensure that your system is updated

First start by ensuring that the OS packages are up to date. Use this command:

sudo dnf -y update

Next, install epel release. Pritunl itself is not in EPEL, but wireguard-tools on EL8 is:

sudo dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

WireGuard server support

Both iptables-services and firewalld must be disabled on the server to prevent interference with the Pritunl iptables rules. If the Pritunl iptables configuration is incorrectly modified by other software this can cause connection issues or inadvertent access to networks that are not permitted in the Pritunl server route configuration.

First Install wireguard tools:

sudo dnf -y install wireguard-tools

Then remove iptables and firewalld

sudo dnf -y remove iptables-services
sudo systemctl stop firewalld.service
sudo systemctl disable firewalld.service

Disabling firewalld leaves the host with no local packet filter of its own — Pritunl manages its own iptables rules, but it does not firewall the rest of the box. On a public server, restrict inbound traffic at the layer above instead: an AWS security group, a DigitalOcean cloud firewall, or your hypervisor’s network ACL. At minimum allow TCP 80 and 443 for the console and the UDP port your VPN server listens on, and keep SSH restricted to addresses you trust.

Install MongoDB

Pritunl uses MongoDB as its database backend. In this section we will install MongoDB.

Updated: this guide originally used MongoDB 5.0, which reached end of life on 31 October 2024 and no longer receives security fixes. Pritunl now targets MongoDB 8.0, which is what we install below. If you are upgrading an existing Pritunl host, do not jump straight from 5.0 to 8.0 — MongoDB only supports upgrading one major release at a time (5.0 → 6.0 → 7.0 → 8.0), and at each hop you must raise the feature compatibility version before moving on, e.g. db.adminCommand({setFeatureCompatibilityVersion: "6.0"}). Take a backup first.

Add the MongoDB repository with this command:

sudo tee /etc/yum.repos.d/mongodb-org-8.0.repo << EOF
[mongodb-org-8.0]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/8/mongodb-org/8.0/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://pgp.mongodb.com/server-8.0.asc
EOF

Note that MongoDB 5.0 and later require a CPU with AVX support. On older bare-metal hosts or some cheaper VPS instances mongod will fail to start with an illegal instruction error — check with grep -o avx /proc/cpuinfo | head -1 before you begin.

Next, install mongodb

sudo dnf -y install mongodb-org

Finally, start and enable mongodb server

sudo systemctl start mongod
sudo systemctl enable mongod

Confirm that it is running by checking status

$ sudo systemctl status mongod

● mongod.service - MongoDB Database Server
   Loaded: loaded (/usr/lib/systemd/system/mongod.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2022-06-21 07:10:51 UTC; 6min ago
     Docs: https://docs.mongodb.org/manual
 Main PID: 15557 (mongod)
   Memory: 145.0M
   CGroup: /system.slice/mongod.service
           └─15557 /usr/bin/mongod -f /etc/mongod.conf

The line to look for is Active: active (running). If it shows failed instead, check sudo journalctl -u mongod -n 50 — on EL8 the two usual causes are a missing AVX instruction set and SELinux blocking the data directory.

Install pritunl

Next we install pritunl the software that will provide VPN functionality. By default, the Pritunl server package is not included in the Rocky Linux 8, so you will need to create a Pritunl repo to your system.

Add Pritunl repository using this command. Pritunl now publishes its signing key over HTTPS, so we point gpgkey straight at it and let dnf fetch and import the key on first use:

sudo tee /etc/yum.repos.d/pritunl.repo << EOF
[pritunl]
name=Pritunl Repository
baseurl=https://repo.pritunl.com/stable/yum/oraclelinux/8/
gpgcheck=1
enabled=1
gpgkey=https://raw.githubusercontent.com/pritunl/pgp/master/pritunl_repo_pub.asc
EOF

This replaces the older gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys ... dance that this guide used to recommend. Public keyservers are frequently unreachable or rate-limited, which made that step the most common place for the install to fail. The key itself has not changed — it is still fingerprint 7568D9BB 55FF9E52 87D58601 7AE645C0 CF8E292A, which you can confirm after installing with rpm -qi gpg-pubkey-cf8e292a.

The Oracle Linux 8 repository is correct for Rocky Linux and AlmaLinux 8 — all three are RHEL 8 rebuilds and share the same ABI.

Finally, install the Pritunl server. Pritunl ships its own OpenVPN build, so install pritunl-openvpn alongside it:

sudo dnf -y install pritunl pritunl-openvpn

Verify that pritunl has been installed by checking the pritunl version:

$ pritunl version

pritunl v1.34.4681.89

Enable and start pritunl

sudo systemctl enable pritunl
sudo systemctl start pritunl

Check Pritunl status to confirm that it is running

$ sudo systemctl status pritunl

● pritunl.service - Pritunl Daemon
   Loaded: loaded (/etc/systemd/system/pritunl.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2022-06-21 07:10:49 UTC; 6min ago
 Main PID: 15549 (pritunl)
    Tasks: 19 (limit: 10992)
   Memory: 344.7M
   CGroup: /system.slice/pritunl.service
           ├─15549 /usr/lib/pritunl/bin/python /usr/lib/pritunl/bin/pritunl start
           └─15805 pritunl-web

Jun 21 07:10:49 pritunl systemd[1]: Started Pritunl Daemon.

Pritunl configuration

Increase Open File Limit

Run the following commands to increase the open file limit on the server. This will prevent any connection issues in case of high load. If you have installed MongoDB on a separate server, you need to run these commands on that server.

sudo sh -c 'echo "* hard nofile 64000" >> /etc/security/limits.conf'
sudo sh -c 'echo "* soft nofile 64000" >> /etc/security/limits.conf'
sudo sh -c 'echo "root hard nofile 64000" >> /etc/security/limits.conf'
sudo sh -c 'echo "root soft nofile 64000" >> /etc/security/limits.conf'

Corrected: earlier revisions of this guide printed these first two lines with a - instead of a *. The first field of a limits.conf line is the domain — a username, a @group, or * for the wildcard — and - is not valid there, so those two lines were silently ignored and only the root limits applied. If you followed this guide before, check /etc/security/limits.conf and fix any - hard nofile / - soft nofile lines.

The wildcard entries only apply to users who log in through PAM, which does not cover services started by systemd. Because Pritunl runs as a systemd unit, also raise the limit on the unit itself:

sudo mkdir -p /etc/systemd/system/pritunl.service.d
sudo tee /etc/systemd/system/pritunl.service.d/override.conf << EOF
[Service]
LimitNOFILE=64000
EOF
sudo systemctl daemon-reload
sudo systemctl restart pritunl

Confirm the limit actually took effect:

grep 'Max open files' /proc/$(pgrep -f pritunl-web | head -1)/limits

Configure Pritunl using the web

At this point, Pritunl VPN is installed and running. Access it from the browser using your server IP to configure it: https://<your_server_ip>.

Pritunl serves the console over HTTPS on port 443 and also runs a small web server on port 80 that redirects to HTTPS, so a plain http:// address will still get you there. Until you configure a real certificate, Pritunl uses a self-signed one, so expect a browser warning on this first visit.

Generate setup-key by running the command below and enter the set up key.

$ sudo pritunl setup-key

f5620e48769131ad57a73f10e9661f8d

Once you enter the setup-key and mongodb url, it will prompt you for username and password. For the single-server setup in this guide the MongoDB URI is the pre-filled default, mongodb://localhost:27017/pritunl — leave it as is unless you put MongoDB on a separate host.

The default username and password are obtained with the below command:

$ sudo pritunl default-password

[INFO] Getting default administrator password
Administrator default password:
  username: "pritunl"
  password: "cf3x9LTa5hGg"

When you login with the provided credentials, you will get the initialization page.

Set your new password and save and you should be taken to a page to configure organizations, users and servers.

Connecting to a Pritunl vpn server

To get connected to a vpn server on Pritunl an organization, user and server must be created.

Creating Organization and User

To create an organization click Add Organization from the Organization page in the web console. Then click Add User an email address and user pin can optionally be included.

If you want to add many users at once, click on Bulk Add user.

Creating Server

Once the organization and user have been created go to the Servers page and click Add Server. By default a random udp port and random vpn network will be selected. The network should not conflict with a local network on your client computer and also be large enough for all users that will be attached to the server. The dns server will automatically be set to Google’s public dns server. Once the server is created click Attach Organization to and attach the organization created earlier to the server. Then click Start Server to start the vpn server.

Provide server particulars and click Add. You should see that the server has successfully been added as below.

Remember to attach the server to an organization by clicking on ‘Attach organization’ and choosing your organization.

Configuring Server Routes

Server routes control what traffic will be tunneled over the vpn server. By default a server will include the 0.0.0.0/0 route. This route will tunnel all internet traffic over the vpn server. To only route a local network on the vpn server first remove the 0.0.0.0/0 route and click Add Route to add the local network route such as 10.1.0.0/16.

Downloading User Profile

After the server has been created the user profile can be downloaded on the Users page by clicking the download button or profile links button on the right side of a user. The profile can then be imported into the Pritunl client or any other OpenVPN client.

Profile links allow downloading user profiles in different formats using temporary links. The uri link can be used to import the profile directly from the Pritunl client.

Install Pritunl Client

Now that our server is up and running, it’s time to install a client and connect to the VPN. Pritunl offers two types of clients; a Command line and a GUI Client.

For our tutorial, we will use the command-line client. You can only install one type of client on a system — the pritunl-client package declares an explicit RPM conflict with pritunl-client-electron and pritunl-client-gtk, so dnf will refuse to install a second one rather than let them fight over the same profiles.

The steps below are for a separate Rocky Linux or AlmaLinux 8 client machine. If you are installing the client on the VPN server itself, you already added both repositories above and can skip straight to the install command.

Install the EPEL repository needed by the Pritunl client.

sudo dnf -y install epel-release

Add the official Pritunl repository to your Rocky Linux system.

sudo tee /etc/yum.repos.d/pritunl.repo << EOF
[pritunl]
name=Pritunl Stable Repository
baseurl=https://repo.pritunl.com/stable/yum/oraclelinux/8/
gpgcheck=1
enabled=1
gpgkey=https://raw.githubusercontent.com/pritunl/pgp/master/pritunl_repo_pub.asc
EOF

Install the command-line client.

sudo dnf -y install pritunl-client

Connect from Client to the Server

From the users’ tab of the Pritunl server site, get the temporary profile link to connect to the client.

Copy the temporary URI link from the last entry.

Enter the following command on the client terminal to add the profile.

pritunl-client add pritunl://citizix.com/ku/2hd6S6Ug

Make sure you add the profile link copied earlier after add in the command.

Check the list of the profiles added.

$ pritunl-client list

+----------------------------------+-------------------------+--------------+----------------+----------------+
|                ID                |          NAME           |  ONLINE FOR  | SERVER ADDRESS | CLIENT ADDRESS |
+----------------------------------+-------------------------+--------------+----------------+----------------+
| wkinhnnjyz3ybektjbavy8qpecafqp1e | citizix (citizix).      | Disconnected | -              | -              |
+----------------------------------+-------------------------+--------------+----------------+----------------+

Run the following command to connect to the profile. You don’t need to use the full profile ID in the command. Just use the first 3 letters of the profile ID to refer to it.

pritunl-client start wki --mode=ovpn --password=PINOTP
  • To specify OPVN mode, add the flag --mode=ovpn in the command.
  • If you have enabled the Google Authenticator option, you need to configure it using a Google Authenticator or Authy client.
  • To specify the pin and the two-factor authentication code, use the flag --password=PINOTP in the command. For example, if the pin is 54321 and the OTP code is 456789, then use the flag --password=54321456789 in the command above. If you are only using PIN, then use the flag --password=PIN.

Run the list command again to check whether the connection is working.

$ pritunl-client list

+----------------------------------+-------------------------+------------+----------------+----------------+
|                ID                |          NAME           | ONLINE FOR | SERVER ADDRESS | CLIENT ADDRESS |
+----------------------------------+-------------------------+------------+----------------+----------------+
| wkinhnnjyz3ybektjbavy8qpecafqp1e | citizix (citizix)       | 6 secs     | 178.62.233.196 | 192.168.238.2  |
+----------------------------------+-------------------------+------------+----------------+----------------+

You have made a successful connection to the Pritunl VPN.

Pritunl Command-line

Pritunl server comes with a command-line tool that you can use to perform some basic operations.

Repair Database

You can use Pritunl to repair the database and allow recovering a corrupted or inconsistent database.

First, stop the Pritunl server.

sudo systemctl stop pritunl

Repair the database.

sudo pritunl repair-database

Restart the Pritunl service.

sudo systemctl start pritunl

The repair-database command will clear all the logs, reset all user static virtual IP addresses, and put all servers in the stopped state.

Reset Credentials

The following command will reset the administrator username and password back to pritunl. It will also remove any single sign-on and two-step authentication settings for the administrator user if enabled.

sudo pritunl reset-password

Change the Web Console Port

By default, Pritunl runs on port 443. If you want to change it, use the following command.

sudo pritunl set app.server_port 8443

Pritunl runs a web server on port 80 for Let’s Encrypt verification and redirects HTTP requests to HTTPS. You can turn off the redirection using the following command. This will also prevent the use of Let’s Encrypt certificates.

sudo pritunl set app.redirect_server false

Conclusion

In this guide we managed to install and configure Pritunl VPN server in Rocky Linux 8. You can now add as many users as needed that will be able to install the Pritunl client on their remote client machines and connect to the Pritunl VPN server.

Related content

comments powered by Disqus
© 2020 - 2026 Citizix, Ltd.
Citizix Ltd
Built with Hugo
Theme Stack designed by Jimmy