Linux Site-to-Site OpenVPN Setup

I need to establish a secure, site-to-site VPN between our main office network and a remote branch using OpenVPN on Linux servers. Both ends already have fresh VPS gateways (Ubuntu 22.04 at HQ, Rocky Linux 9 at the branch) with full root access and static public IPs.

The scope is straightforward: install and configure OpenVPN, harden it with robust certificates/keys, set up firewall rules, and ensure the tunnel comes up automatically on reboot. Once the tunnel is alive, traffic from 192.168.10.0/24 (HQ) must seamlessly reach 192.168.20.0/24 (branch) and vice-versa.

Deliverables
• Installed and fully-configured OpenVPN service on both Linux gateways
• Persistent systemd service, firewall/NAT rules, and routing that survive reboots
• Exported .ovpn or conf files plus CA/keys so I can redeploy if needed
• Brief, step-by-step handover notes (Markdown or plain text) explaining what was done and how to extend the setup

Acceptance criteria
• Successful ping and file transfer between the two subnets
• Tunnel auto-reconnects after either server restarts
• No IPv4 or IPv6 leaks to the public internet from internal hosts when the tunnel is active

Feel free to suggest minor tweaks, but OpenVPN on Linux is the baseline. SSH access can be provided as soon as we agree on a timeline.