Ubuntu VPN Software Package for Access Server | OpenVPN
Access Server fits seamlessly with Ubuntu. Access Server gives you the following benefits:
A self-hosted VPN solution.
A simplified, rapid deployment of secure remote access and site-to-site solutions.
A web-based administration interface.
Built-in OpenVPN Connect app distribution with bundled connection profiles.
We recommend you start by updating your operating system to the latest version and ensure it's set to the correct time:
Sign in to your Linux system on the console or via SSH and obtain root privileges.
Run the commands below to install updates and set time and date correctly.
apt update
apt upgrade
apt install tzdata
dpkg-reconfigure tzdataSign into the Access Server portal.
Click Get Access Server.
Under Install on Linux OS, copy the
bashcommand.From your console or SSH session, copy and paste the command.
After installing the openvpn-as package, take note of the Admin UI and Client UI addresses as well as the randomly generated password for your administrative user openvpn. These display on screen similar to this example:
Initial Configuration Complete!
You can now continue configuring OpenVPN Access Server by
directing your Web browser to this URL:
OpenVPN Access Server URL:
During normal operation, OpenVPN AS can be accessed via these URLs:
Admin UI: https://192.0.2.10:943/admin/
Client UI: https://192.0.2.10:943/
To login please use the "openvpn" account with "FKadk2254" password.
See the Release Notes for this release at:
https://openvpn.net/vpn-server-resources/release-notes/Using the information from the previous step, connect to the Access Server and sign in with the openvpn user and password.
The Access Server Admin Web UI provides an intuitive tool for managing settings for Access Server. The first time you access it, a warning will display. This is expected, as Access Server has a self-signed SSL certificate, so the web service can function. Override this warning message and proceed.
After you sign in and accept the EULA, the Activation page displays. Paste your activation here and click Activate.
Now that you've installed Access Server, follow these next steps.
When you complete the installation process on the command line, the output displays the URLs for your admin UI and client UI as well as the username and randomly generated password for the admin account.
Initial Configuration Complete!
You can now continue configuring OpenVPN Access Server by
directing your Web browser to this URL:
OpenVPN Access Server URL:
During normal operation, OpenVPN AS can be accessed via these URLs:
Admin UI: https://192.0.2.10:943/admin/
Client UI: https://192.0.2.10:943/
To login please use the "openvpn" account with "FKadk2254" password.
See the Release Notes for this release at:
https://openvpn.net/vpn-server-resources/release-notes/Admin UI | The Admin UI is the web-based GUI for managing your Access Server. We refer to it as the Admin Web UI. Typically, it is the address of your server with /admin/ appended, for example https://192.0.2.222/admin/. When you sign in to the Admin Web UI, you can manage the configuration, certificate, users, and so on as an administrative user. The web-based GUI provides simplified management of complex VPN features rather than having to run Linux-based commands and scripts. |
Client UI | The Client Web UI is the web-based GUI where users sign in to download clients or configuration files. Typically, it is the address of your server, https://192.0.2.222 as an example. |
Administrative User
For the first use of the Admin Web UI, sign in with the openvpn user created during setup. The user’s password is randomly generated and displays in the output at the completion of setup.
On Access Server versions older than 2.9, you must manually set the password for the openvpn user with this command:
passwd openvpnYou can now open a browser and enter your Admin Web UI address.
Invalid Certificate
Access Server’s web interface comes with a self-signed certificate. This allows you to sign in to the Admin Web UI right away. Since it’s self-signed, it triggers an expected warning. We recommend adding your own SSL certificate in the Admin Web UI to resolve this.
By clicking through to the site, you can continue to the web interface. At the login screen, enter the username and password for your openvpn user.
The first time you sign into the Admin Web UI, Access Server displays the Activation page so you can easily get an activation key:
Click Get Activation Key.
This takes you to the Access Server portal.
Sign in with your openvpn.com account if needed.
Click Activation Keys.
Click Purchase A New Key.
Select the number of concurrent connections for your subscription.
For a free subscription with two connections, select the free option.
For five or more connections, select the standard option.
Once you've finished obtaining a subscription, click Copy Key to copy the subscription key.
Return to your Admin Web UI.
Paste the subscription key in the text field.
Click Activate.
Once your subscription loads, you can see the available connections. When users start connecting, you'll see how many are connected. You can also see the connection details on the Access Server portal by clicking Access Server Information.
We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: vpn.example.com. This provides an easier user experience than remembering the server's IP address.
Refer to Hostname and follow the steps.
Once signed in to the Admin Web UI, you can configure user authentication. Access Server supports local authentication, where you configure users in the Admin Web UI. You can also use an external authentication system with PAM, RADIUS, LDAP, or SAML.
Access Server 2.10 and newer supports using multiple authentication systems simultaneously. Refer to Authentication System for more information.
With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.
Connection method | Procedure |
|---|---|
Download OpenVPN Connect from the Client Web UI | A user follows these steps to download a pre-configured OpenVPN Connect app:
|
Download a connection profile | Follow these steps to download a connection profile. They can then load this file into an installed VPN client like OpenVPN Connect:
|
Admin distributes connection profiles or installers | Alternatively, as an admin, you can use these ways to connect your users:
|
To reach Access Server via the internet, set the hostname or IP address to one facing the public internet. If you set up your server in a private network, it may assume a private IP that can't be reached from the internet. Change this setting by setting up a DNS hostname that resolves to the public IP address where your Access Server can be reached.
Ensure the right ports are open so your VPN clients can reach Access Server from outside your private network.
Access Server's default, internal VPN subnet is 172.27.224.0/20. You can change the subnet to one that might work better for your current network.
Your users and devices need a VPN client program, like OpenVPN Connect, to establish a connection to Access Server. You can obtain the necessary software and connection details from the Client Web UI. This is the same address as the Admin Web UI, minus the /admin part.
Users can sign in with their credentials and obtain all the necessary client software and configuration to connect to your Access Server.
Successfully running the Linux commands here requires executing them with root privileges logged in as a root user or sudo up.
By default, an unlicensed server allows only two connections. You can purchase a subscription to increase this.
Licensing an Access Server without internet access requires contacting OpenVPN support for an offline activation procedure.
If you experience slowness with the web interface or license key activation, check that DNS resolution is working as expected.