Client-to-Site OpenVPN Setup

I need a secure client-to-site tunnel built with OpenVPN. The goal is to let remote users authenticate, receive the correct routes, and reach on-prem and cloud resources without exposing anything else to the internet.

Scope
• Install and harden the OpenVPN service on my existing VPS (Ubuntu).
• Generate certificates/keys, create at least one user profile, and provide clear steps so I can add or revoke accounts later.
• Configure firewall rules and routing so traffic only flows through the tunnel when it should, with DNS leaks prevented.
• Supply .ovpn files (or equivalent) that import cleanly on Windows, macOS, Linux, iOS, and Android clients.
• Include concise documentation of every command or change made so I can reproduce the setup.

To be considered, send a detailed project proposal explaining the exact approach, tools, and timeline you will follow.