OpenVPN client

https://linuxconfig.org/how-to-setup-a-vpn-with-openvpn-on-debian-9-stretch-linux
Add a client:
# cd /etc/openvpn/certs
# source ./vars
# ./build-key clientname ##(Accept rational defaults, change FF_VPN_Server, DO NOT enter challenge password or optional Company Name)
# cd/etc/openvpn/client
# mkdir clientname
# cp client.conf clientname/clientname.conf ##(Copy client.conf to client dir renamed appropriately)
# cp ../certs/keys/{ca.crt,clientname.crt,clientname.key,ta.key} clientname/
Edit clientname/clientname.conf and, around line 92 rename cert and key with the ones you built.
Make a tarball for the client
# tar -czvf clientname.conf.tar.gz clientname/
(Note: It's not a true ovpn client file, which would contain all the certs within the ovpn.)

iptables -A INPUT -p udp --dport 1194 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --sport 1194 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT