Pritunl is an open-source VPN server with a genuinely clean web interface for managing OpenVPN and WireGuard connections, a self hosted VPN server ubuntu admins can run as an alternative to commercial VPN products without per-user licensing costs. This pritunl installation guide covers how to install Pritunl VPN server ubuntu the right way in 2026. If you’re setting up pritunl vpn ubuntu 22.04 today, one detail matters more than it should: a lot of guides still circulating online reference outdated MongoDB versions (3.2, 4.4, 5.x) or even Python 2 manual build instructions, and Python 2 has been end-of-life since January 2020. This guide uses the current, officially correct installation path, MongoDB 8.0 via Pritunl’s real APT repository, verified directly against Pritunl’s own documentation, not an aggregated or outdated tutorial.
What Pritunl Actually Does
Pritunl orchestrates OpenVPN protocol server processes (and a WireGuard kernel interface, if you enable that option) behind a web UI, storing all state, users, organizations, server configurations, audit logs, in MongoDB. When you create an organization, a user, and a server through the interface, Pritunl writes the OpenVPN configuration, generates per-user PKI certificates, and starts the relevant daemon automatically as a systemd service. Clients connect using the dedicated Pritunl Client application (built on the pritunl-client-electron package for desktop platforms) or any standard OpenVPN/WireGuard client.
Each VPN organization in Pritunl is a logical grouping of users, typically one per team, department, or client, that gets attached to one or more servers. This structure is what makes Pritunl practical for managing dozens or hundreds of users without manually maintaining individual OpenVPN configuration files, which is the real operational pain point Pritunl’s web UI is solving.
Prerequisites
- A server running Ubuntu 22.04.3 LTS with at least 1GB RAM and 1 vCPU
- Root or sudo access
- A public IP address or domain name pointing to the server
- Ports 443 and 80 (TCP) open for the web interface, plus a UDP port for actual VPN traffic
- Important: if MongoDB is already running on this server for another application, don’t share it. Pritunl pins specific MongoDB versions, and version conflicts between a shared instance and Pritunl’s requirements are a common, avoidable setup problem, install a dedicated MongoDB instance for Pritunl instead, and apply the same database maintenance discipline to it that any production database deserves, not just Pritunl-specific configuration.
Step 1: Update the System
sudo apt update && sudo apt -y full-upgrade
Reboot if a kernel update was applied:
[ -f /var/run/reboot-required ] && sudo reboot -f
Step 2: Add the MongoDB Repository
Pritunl uses MongoDB as its backend database, and the current version to install for this pritunl mongodb setup is MongoDB 8.0, not the older 3.2, 4.4, or 5.x versions still referenced in outdated guides for self-hosted vpn deployments:
echo “deb [ signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu $(lsb_release -cs)/mongodb-org/8.0 multiverse” | sudo tee /etc/apt/sources.list.d/mongodb-org.list
$(lsb_release -cs) automatically detects your Ubuntu codename, jammy for 22.04, so this same command works correctly without manually typing the codename.
Step 3: Add the Pritunl Repository
This is Pritunl’s own official repository configuration, not a third-party mirror, and includes proper GPG key verification so packages are cryptographically confirmed as authentic before installation:
sudo apt –assume-yes install gnupg
gpg –keyserver hkp://keyserver.ubuntu.com –recv-keys 7568D9BB55FF9E5287D586017AE645C0CF8E292A
gpg –armor –export 7568D9BB55FF9E5287D586017AE645C0CF8E292A | sudo tee /etc/apt/trusted.gpg.d/pritunl.asc
echo “deb https://repo.pritunl.com/stable/apt jammy main” | sudo tee /etc/apt/sources.list.d/pritunl.list
sudo apt update
Step 4: Install Pritunl and MongoDB
sudo apt –assume-yes install pritunl mongodb-org
sudo systemctl enable –now pritunl mongod
Confirm both services are actually running before continuing, the kind of check that should become part of ongoing monitoring once this is live, not just a one-time verification during setup:
sudo systemctl status pritunl mongod
Step 5: Get Your Setup Key
Pritunl needs a setup key to complete initial configuration through the web interface:
sudo pritunl setup-key
This returns a key you’ll paste into the web UI in the next step. By default, the MongoDB URI field in that setup screen is pre-filled correctly for a local MongoDB instance, leave it as-is unless you’re connecting to a separate MongoDB cluster.
Step 6: Complete Setup in the Web Interface
Visit https://your-server-ip in a browser (you’ll get a certificate warning initially, this is expected on first setup, before you configure a real certificate). Enter the setup key from Step 5, confirm the MongoDB URI, and create your admin account.
Step 7: Create an Organization, User, and Server
Inside the web UI: create an Organization (a logical grouping, often one per team or client), add a User within that organization, then create a Server specifying the VPN protocol, this is where a pritunl openvpn wireguard choice actually gets made, between OpenVPN and WireGuard, plus port and network settings. Attach the organization to the server, and Pritunl generates the necessary certificates and configuration automatically.
Step 8: Connect a Client
This final pritunl vpn client setup step happens on the end-user’s device. Download the Pritunl Client for your platform (Linux, macOS, or Windows), and import the profile using the URI link generated on the user’s profile page in the web UI. Mobile devices don’t have an official Pritunl client but can connect using any standard OpenVPN client with the individual profile download link.
Enabling Two-Factor Authentication
Pritunl supports two-factor authentication for both the admin panel and individual VPN user profiles, worth enabling for any deployment beyond a purely personal, single-user setup. In the web UI, this is configured per-organization under user settings, supporting standard TOTP authenticator apps. For an enterprise VPN server handling real organizational access, treating 2FA as a default rather than an optional extra is the more defensible security posture, part of the same broader access-control discipline that governs any system handling real credentials, not just VPN specifically.
Pritunl vs. Other VPN Solutions
The most common real comparison is Pritunl vs OpenVPN Access Server, OpenVPN’s own commercial management layer. Both wrap OpenVPN with a web UI and organizational structure, but Pritunl is fully open-source with no per-user licensing cost, while OpenVPN Access Server’s free tier caps at a small number of concurrent connections before requiring paid licensing. Pritunl’s WireGuard support is also a genuine differentiator, OpenVPN Access Server, as the name implies, is built specifically around the OpenVPN protocol rather than supporting both.
For teams that specifically want Zero Trust Network Access rather than traditional VPN architecture, that’s a different model entirely, worth reading our Cloudflare Zero Trust setup guide if per-connection access policies matter more than a traditional always-on VPN tunnel for your use case.
Pritunl’s own documentation states plainly that it does not publish any AMIs or marketplace images, AWS community AMI listings containing “Pritunl” in the name are unverified third-party images that could compromise your installation’s security. If you’re deploying on AWS, install Pritunl yourself using the steps above rather than launching a pre-built community image claiming to be Pritunl.
Common Setup Mistakes
Using outdated Python 2 installation instructions: Several older tutorials and GitHub examples still reference manual python2 setup.py build installation, Python 2 has been unsupported since January 2020, and this approach shouldn’t be used for a current installation.
Sharing an existing MongoDB instance: Pritunl pins specific MongoDB versions; running it against a MongoDB instance shared with another application risks version conflicts neither application handles gracefully.
Launching an unverified AWS community AMI: Covered above, but worth repeating since it’s an easy mistake, Pritunl publishes no official AMIs at all.
Forgetting to open the UDP port for VPN traffic: The web UI (443/80) being reachable doesn’t mean the actual VPN connection will work, the UDP port configured for your server also needs to be open.
The Bottom Line
Installing Pritunl on Ubuntu 22.04.3 correctly in 2026 comes down to one detail most existing guides get wrong: use MongoDB 8.0 via the official repository, not an outdated version or a Python 2 manual build process that’s been unsupported for years, the same pattern of stale tutorials worth watching for covered in our Apache Solr installation guide, a different platform with the exact same “most guides are on an old major version” problem. Beyond that, the process is genuinely straightforward, add two repositories, install two packages, complete setup through the web UI, and create your first organization, user, and server. The real risks worth avoiding are sharing MongoDB with another application and downloading an unverified AWS community image instead of installing directly.
Deploying VPN Infrastructure at Real Scale
A single Pritunl server for a small team is straightforward to set up using this guide, and worth automating through a real CI/CD pipeline once you’re managing more than one server by hand. Scaling this to multi-cloud peering, high availability, and integration with existing Zero Trust access policies is a different, ongoing infrastructure problem. If you’re building out real VPN or network access infrastructure and want it done correctly, that’s the kind of work we do.
Frequently Asked Questions
How to install Pritunl VPN server on Ubuntu 22.04?Â
Add the MongoDB 8.0 and Pritunl official APT repositories, install both packages, run pritunl setup-key, then complete setup through the web interface, the full pritunl vpn server setup step by step process is covered above.
What MongoDB version does Pritunl require in 2026?Â
MongoDB 8.0, installed via the official MongoDB repository. Older guides referencing 3.2, 4.4, or 5.x are outdated pritunl mongodb version requirements and shouldn’t be used for a current installation.
Is Pritunl free to use?Â
Yes, Pritunl is open-source and free to self-host, without per-user licensing costs, though a paid enterprise tier exists with additional support and features for larger deployments.
Can Pritunl use the same MongoDB instance as another application?Â
Not recommended. Pritunl pins specific MongoDB versions, and sharing an instance with another application risks version conflicts, install a dedicated MongoDB instance for Pritunl.
Does Pritunl support WireGuard, or only OpenVPN?Â
Both. Pritunl started as an OpenVPN-focused management platform and added WireGuard support more recently, you choose the protocol when creating a server in the web UI.
Pritunl vs OpenVPN Access Server: which should I actually choose?Â
Pritunl is fully open-source with no per-user licensing cost and native WireGuard support; OpenVPN Access Server is commercial software with a limited free tier, built specifically around the OpenVPN protocol rather than supporting both.
Why shouldn’t I use a Pritunl AMI from the AWS Marketplace?Â
Pritunl’s own documentation states it publishes no official AMIs. Community AMI listings with “Pritunl” in the name are unverified third-party images that could compromise security, install directly using the official repository instead.
How to add users to Pritunl VPN?Â
Create an Organization in the web UI, then add Users within it. Each user gets an individual profile with certificates Pritunl generates automatically, downloadable or importable via a URI link.