Best idiot-proof-guide for VPNs that will work on 4.3?

Assuming Debian, not Kicksecure: