Tutorial: Downgrade Access Server
Overview
This tutorial provides the steps necessary to downgrade your Access Server version.
Prerequisites
Console access and the ability to get root access.
An Access Server portal account.
An installed Access Server.
Refer to this tutorial to back up your Access Server configuration:
We deliver the openvpn-as Access Server package via our software repository for supported Linux operating systems. The latest available version is selected when you install or upgrade from the repository. If an older Access Server release is available for your operating system, you can select it using the package manager.
Connect to your console and get root privileges.
Run the command below for your Linux OS to list the Access Server package (openvpn-as) versions available in the software repository:
Ubuntu/Debian: List the openvpn-as versions from the software repository:
apt update && apt list -a openvpn-asAn overview similar to the following displays:
openvpn-as/noble,now 3.0.2-87c70987-Ubuntu24 amd64 [installed] openvpn-as/noble 3.0.1-84b60e70-Ubuntu24 amd64 openvpn-as/noble 3.0.0-2b84043e-Ubuntu24 amd64 openvpn-as/noble 2.14.3-5936bcd7-Ubuntu24 amd64 openvpn-as/noble 2.14.2-40b190d8-Ubuntu24 amd64 openvpn-as/noble 2.14.1-ff013d4d-Ubuntu24 amd64 openvpn-as/noble 2.14.0-b90cb316-Ubuntu24 amd64To downgrade to version 2.14.3, use the following package:
2.14.3-5936bcd7-Ubuntu24. Save this for the next steps.RHEL: List the openvpn-as versions from the software repository:
yum list --showduplicates openvpn-asAn overview similar to the following displays:
Installed Packages openvpn-as.x86_64 3.0.2_87c70987-1.el9 @openvpn-as-rhel9 Available Packages openvpn-as.x86_64 2.11.1_f4027f58-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.11.2_72c0e923-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.11.3_af31575c-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.12.0_2e834031-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.12.1_bc070def-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.12.2_f897d9cb-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.12.3_76774795-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.13.0_c7623b5a-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.13.1_d8cdeb9c-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.14.0_b90cb316-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.14.1_ff013d4d-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.14.2_40b190d8-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 2.14.3_5936bcd7-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 3.0.0_2b84043e-1.el9 openvpn-as-rhel9 openvpn-as.x86_64 3.0.1_84b60e70-1.el9 openvpn-as-rhel9 [root@rhel-as ~]#To downgrade to 2.14.3, use the following package:
2.14.3_5936bcd7-1.el9. Save this for the next steps.
Install a specific version (for example, 2.14.3):
Ubuntu/Debian:
bash <(curl -fsS https://packages.openvpn.net/as/install.sh) --as-version=2.14.3 --yes apt autoremove -yRHEL:
bash <(curl -fsS https://packages.openvpn.net/as/install.sh) --as-version=2.14.3 --yes yum autoremove -y
If the installation script fails for you, use these optional steps:
Ubuntu/Debian:
apt install openvpn-as=2.14.3-5936bcd7-Ubuntu24 -y --allow-downgrades --autoremoveRHEL:
yum downgrade openvpn-as-2.14.3_5936bcd7-1.el9 -y
Verify the installed version with one of the commands below:
Ubuntu/Debian:
dpkg -l|grep openvpn-asor
/usr/local/openvpn_as/scripts/sacli Versionor
cat /usr/local/openvpn_as/etc/VERSIONRHEL:
rpm -qa|grep openvpn-asor
/usr/local/openvpn_as/scripts/sacli Versionor
cat /usr/local/openvpn_as/etc/VERSION
Pin the package so it's not automatically upgraded:
Ubuntu/Debian:
apt-mark hold openvpn-asRHEL:
yum versionlock openvpn-as
As we add new Access Server features, we update the configuration database schema accordingly. To work correctly, Access Server requires that the configuration database be the same version or an older version. Access Server can upgrade a configuration database automatically, but can’t downgrade it. Therefore, you need to restore a backup if you downgrade the Access Server. If you try to use a configuration from a newer Access Server version, you will likely encounter problems.
Restore from a manual backup
Refer to this tutorial on how to restore Access Server's configuration from backup files:
Restore from an automatic backup
When you perform an in-place upgrade of Access Server, it automatically makes backups of the SQLite3 database files containing the pre-upgrade configuration, which it stores in the /usr/local/openvpn_as/etc/backup/ directory with timestamps.
Access Server also automatically backs up during a downgrade. Ensure you restore the backup set Access Server automatically created when you upgraded it. Be careful not to use the backup set created during the downgrade. Usually, this means you should restore the second-most recent backup when downgrading.
Restore a backup set (for example, "
2026-01-31T16:35:43+00:00"):systemctl stop openvpnas which apt > /dev/null 2>&1 && apt -y install sqlite3 which yum > /dev/null 2>&1 && yum -y install sqlite cd /usr/local/openvpn_as/etc/backup/ cd "2026-01-31T16:35:43+00:00" [ -e config.db ]&& /bin/cp config.db ../../db/config.db [ -e certs.db ]&&/bin/cp certs.db ../../db/certs.db [ -e userprop.db ]&&/bin/cp userprop.db ../../db/userprop.db [ -e log.db ]&&/bin/cp log.db ../../db/log.db [ -e config_local.db ]&&/bin/cp config_local.db ../../db/config_local.db [ -e cluster.db ]&&/bin/cp cluster.db ../../db/cluster.db [ -e notification.db ]&&/bin/cp notification.db ../../db/notification.db chmod 0600 /usr/local/openvpn_as/etc/db/*.db chmod 0600 /usr/local/openvpn_as/etc/as.conf systemctl start openvpnas
As your final step, verify that Access Server is working and that your clients are connecting successfully.
Review the logs to see that Access Server starts up correctly.
Check that you can access the Admin and Client Web UIs.