AWS EC2 VPN Server Setup: Quick Start Guide

This guide steps you through launching a BYOL instance.

You can choose from several options in the AWS marketplace that come with a set number of connections or the bring-your-own-license (BYOL) Access Server instance.

When you select an instance with a set number of connections, you pay the subscription for those connections through AWS and keep that set amount.

When you select a BYOL instance, you purchase a license separately from us for unlocking connections. You buy a subscription on our site and activate it on your Access Server installation. You can adjust the number of connections up or down at any time.

When you launch a BYOL-type AMI, you can get started immediately without purchasing a subscription. You can connect up to two devices simultaneously and test out all features and functionality of Access Server without a time limit. When you need to expand beyond two connections, you purchase and activate a license key.

If you’re launching one of the Amazon AWS EC2 tiered instances, refer to that separate quick start guide: AWS Tiered.

For more information about Access Server subscriptions, refer to Which licensing models are available for Access Server?

To launch a new instance with Access Server software:

Once you launch your new AMI, you need to SSH into the console using an SSH client software and the private key pair you used/created previously.

Use the instance username openvpnas.

Connect with ssh:

ssh -i /path/key-pair-name.pem openvpnas@instance-public-ipv4-address

You can refer to Connect to Access Server via SSH using PuTTY for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow Amazon’s instructions on connecting to your instance.

Connect to your server, and the Access Server will complete the installation. Access Server then provides the URLs for your Admin Web UI and Client Web UI and the username and password for signing into the Admin Web UI.

Refer to First-time setup for details.

In addition to the steps in the link above, we recommend you assign an Elastic IP address to your instance:

You can start right away with two simultaneous connections to your VPN server. To add more connections, purchase a subscription from our site and activate it using the Admin Web UI: Purchasing And Activating A Subscription.

The default time zone may not be the time zone that you're in. If you are in a different time zone, you can change this setting by running this command, then choose your appropriate time zone:

sudo dpkg-reconfigure tzdata

We recommend installing the NTP client to keep the time synchronized, but it's especially important for those that plan on using multi-factor authentication with TOTP. Run this command:

apt-get install ntp

If your VPN setup consists of a site-to-site setup between your cloud instances and your machines on-premises, ensure you disable source destination check protection on Amazon; otherwise, routing won’t function properly.

Access Server’s default routing uses network address translation (NAT). Traffic originating from the VPN clients appears to come from the local IP address of Access Server with NAT, and this is simpler than setting up routing.

However, when using NAT, your traffic from the VPC itself can’t directly access a VPN client as the NAT engine prevents direct contact. You must configure routing instead of NAT to allow direct access to a VPN client.

To access this configuration:

After setting up routing, the source IP address of packets coming from the VPN clients is kept intact, and direct access from the VPC network to the VPN client subnet is possible. However, because the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Amazon routing table for your VPC so that the return traffic flows properly. Refer to Amazon’s AWS VPC routing documentation: Route tables for your VPC (Amazon).

We recommend updating your Linux OS. From the time we've generated the appliance and you've downloaded and are using it, there are likely a number of updates. To make sure your appliance OS is up to date, execute the following commands:

sudo apt-get update
sudo apt-get upgrade

When you launch an EC2 instance, you can pass user data to the instance to perform common automated configuration tasks. You can use this feature to preconfigure Access Server with specific settings, as defined below.

We use AWS “user data,” which is only available to you through the manual launch method on the EC2 dashboard or via API or CLI.

Here’s an example of user data sent during launch:

public_hostname=vpn.example.com
admin_user=admin1
admin_pw=p@$w0rd