Skip to main content

DigitalOcean VPN: Droplet Quick Start Guide for Access Server

Abstract

Set up a VPN in the cloud within minutes with Access Server on your DigitalOcean Droplet.

Access Server provides a DigitalOcean marketplace VPN that you can get up and running within minutes.

Working with DigitalOcean, you use their droplets, which are Linux-based virtual machines running on virtualized hardware. By using the Access Server image from their marketplace, you can launch a VPN hosted in the cloud, with the following benefits:

Read on for your guide to get started with your VPN server on the web.

To get started, visit the DigitalOcean marketplace to find the Access Server VPN and follow these steps:

  1. Click Create OpenVPN Access Server Droplet.

  2. Choose your DigitalOcean plan and data center for your droplet.

  3. Choose your authentication. We recommend SSH keys, which are more secure.

  4. Select any additional options, change the droplet hostname (if desired), add tags, and select a project.

  5. Click Create Droplet.

Note

This guide assumes you use an SSH key pair.

Tip

Use these helpful tips for selecting your Droplet options:

  • When starting an Access Server, you can start with a Basic CPU. If you notice slow data performance traveling through the VPN tunnel, we recommend choosing a CPU-optimized droplet. Decrypting and encrypting data are CPU-intensive.

  • Access Server requires very little storage for logs. Even 25 GB should be enough.

  • Access Server primarily uses IPV4, with limited IPv6 support.

Once your image deploys, you can connect with an SSH client.

We provide instructions on how to connect with a common use case for Windows OS users with the PuTTY SSH Client: Connect to Access Server via SSH using PuTTY.

The initial Access Server configuration tool runs automatically the first time you sign into the instance.

For this guide, we assume you choose the default values by pressing ENTER for each choice.

You can now connect to the Admin Web UI with ‘openvpn’ and the generated password with the URL https://[youripaddress]/admin.

Tip

Replace "[youripaddress]" with the static IP address of your server.

Now that you've installed Access Server, follow these next steps.

When you complete the installation process on the command line, the output displays the URLs for your admin UI and client UI as well as the username and randomly generated password for the admin account.

Admin UI

The Admin UI is the web-based GUI for managing your Access Server. We refer to it as the Admin Web UI. Typically, it is the address of your server with /admin/ appended, for example https://192.168.70.222/admin/.

When you sign in to the Admin Web UI, you can manage the configuration, certificate, users, and so on as an administrative user. The web-based GUI provides simplified management of complex VPN features rather than having to run Linux-based commands and scripts.

Client UI

The Client UI is the web-based GUI where users sign in to download clients or configuration files. Typically, it is the address of your server, https://192.168.70.222 as an example.

Tip

The web services run on port TCP 943, by default, so you can visit them at https://192.168.70.222:943/ and https://192.168.70.222:943/admin/ as well. The OpenVPN TCP daemon that runs on TCP port 443 redirects incoming browser requests so that it is slightly easier for users to open the web interface by leaving the :943 part out.

Administrative User

For the first use of the Admin Web UI, sign in with the openvpn user created during setup. The user’s password is randomly generated and displays in the output at the completion of setup.

On Access Server versions older than 2.9, you must manually set the password for the openvpn user with this command:

passwd openvpn

You can now open a browser and enter your Admin Web UI address.

Invalid Certificate

Access Server’s web interface comes with a self-signed certificate. This allows you to sign in to the Admin Web UI right away. Since it’s self-signed, it triggers an expected warning. We recommend adding your own SSL certificate in the Admin Web UI to resolve this.

By clicking through to the site, you can continue to the web interface. At the login screen, enter the username and password for your openvpn user.

The first time you sign into the Admin Web UI, Access Server displays the Activation page so you can easily get an activation key:

  1. Click Get Activation Key.

    • This takes you to the Access Server portal.

  2. Sign in with your openvpn.com account if needed.

  3. Click Activation Keys.

  4. Click Purchase A New Key.

  5. Select the number of concurrent connections for your subscription.

    • For a free subscription with two connections, select the free option.

    • For five or more connections, select the standard option.

  6. Once you've finished obtaining a subscription, click Copy Key to copy the subscription key.

  7. Return to your Admin Web UI.

  8. Paste the subscription key in the text field.

  9. Click Activate.

Once your subscription loads, you can see the available connections. When users start connecting, you'll see how many are connected. You can also see the connection details on the Access Server portal by clicking Access Server Information.

We recommend using a hostname for your web interfaces and client connections, rather than the IP address of your server. It’s easier for clients and users to sign in with a domain such as vpn.example.com than to use an IP address.

Refer to Setting up your Access Server Hostname and follow the steps.

Once signed in to the Admin Web UI, you can configure user authentication. Access Server supports local authentication where you configure users in the Admin Web UI. You can also use an external authentication system with PAM, RADIUS, LDAP, or SAML.

Access ServerAccess Server 2.10 and newer supports using multiple authentication systems simultaneously. Refer to Access Server’s User Authentication System for more information.

With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.

Option to connect

Procedure

Download a bundled VPN client to connect

A user follows these steps to download a pre-configured OpenVPN Connect app:

  1. Navigate to the Client Web UI in a browser.

  2. Sign in with user credentials.

  3. Choose the OpenVPN Connect app for their operating system.

  4. After it downloads, install the software.

  5. Open the app and click on the connection profile.

    • The user connects to Access Server.

Download a connection profile

A user follows these steps to download a connection profile. They can then load this file into an installed VPN client like OpenVPN Connect:

  1. Navigate to the Client Web UI in a browser.

  2. Sign in with their user credentials.

  3. Click on the link under Available Connection Profiles.

  4. After the connection profile downloads, upload the file to a VPN client.

Admin provides users with ways to connect

Alternatively, as an admin, you can use these ways to connect your users:

  1. Have your users install OpenVPN Connect from our website, then download a connection profile from the Admin Web UI and distribute it to users.

  2. Create an OpenVPN Connect installer from the Access Server command-line interface and distribute it to users.

Tip

Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure split-tunnel traffic, their IP address remains the same for internet traffic.

You can start right away with two simultaneous connections to your VPN server. To add more connections, purchase a subscription from our site and activate it using the Admin Web UI: Purchasing And Activating A Subscription.

The default time zone may not be the time zone that you're in. If you are in a different time zone, you can change this setting by running this command, then choose your appropriate time zone:

sudo dpkg-reconfigure tzdata

We recommend installing the NTP client to keep the time synchronized, but it's especially important for those that plan on using multi-factor authentication with TOTP. Run this command:

apt-get install ntp

We recommend updating your Linux OS. From the time we've generated the appliance and you've downloaded and are using it, there are likely a number of updates. To make sure your appliance OS is up to date, execute the following commands:

sudo apt-get update
sudo apt-get upgrade

Additional Security Steps You Can Take After Installation