Quick Start: Deploy Access Server with Access Server Link
Overview
Access Server Link is a feature introduced in Access Server 3.2.0 that simplifies the deployment and management of OpenVPN Access Server on AWS, Azure, and GCP. Instead of manually configuring DNS records and SSL certificates, Access Server Link automates these steps and provides a stable, trusted URL for accessing your Admin and Client Web UI from day one.
Access Server Link benefits:
A free, secure hostname (example:
yourcompany.openvpn.com) with an automated SSL certificate — no manual SSL certificate setup required afterward.A central place in the Access Server Hub to manage subscriptions and deployments.
Automatic DNS record updates if your server's public IP address changes.
Automatic reporting and status monitoring of your Access Server.
Prerequisites
Access Server 3.2.0 or newer.
An active OpenVPN account. Create one if you don't have one yet.
An active account in one of the supported cloud providers: AWS, Azure, or GCP.
🔑 Purchase a subscription
Sign in to your OpenVPN account and navigate to the Access Server product.
Select one of the following:
Start 14-Day Free Trial: Enter the number of VPN connections you want (default is 10), provide billing information, and complete the trial setup. Billing begins after the 14-day trial ends.
Try Free Version: A free subscription with two VPN connections is created automatically. No billing information is required.
Existing subscription: Click Activation Keys to purchase an additional subscription or use an existing one.
In the Access Server Hub, click Installation in the left panel.
Under Launch faster With Access Server Link, enter your desired hostname (
yourcompany). This becomes your Access Server Link URL for the Admin and Client Web UI (example:yourcompany.openvpn.com).Click Create Hostname and Continue.
Under Select A Cloud Service Provider, AWS, Azure, or GCP, then follow the steps for your provider below.
⚙️ If you select AWS
Select the nearest AWS region from the drop-down.
Under Set Your Credentials > Password, enter a password for the
openvpnuser. You'll use this to sign in to the Admin Web UI after deployment.Click Confirm and Deploy on AWS.
You are directed to AWS CloudFormation.
Complete the Quick create stack:
Field
Description
Stack name
Name for your CloudFormation stack. Default:
openvpn-accessserver.ActivationKey
Pre-populated with the AWS PAYG license key.
VpcId
Select the VPC for your instance.
SubnetId
Select a public subnet.
InstanceName
Name for the instance. Default:
OpenVPNAccessServer.InstanceType
Select an instance type. Default:
t3.small.KeyName
Select an existing EC2 key pair for SSH access.
Acknowledge that AWS CloudFormation will create IAM resources, then click Create stack.
🖥️ Gather Admin Web UI info from stack output
Once the stack completes, you can find your connection details for the Admin Web UI in the stack output.
Here's how to access the Admin Web UI after the stack is complete:
On the CloudFormation status page, click the Outputs tab. One output is displayed:
AdminPortal: The Access Server Link URL to access the Admin Web UI (Example:
https://yourcompany.openvpn.com/admin).
Open your web browser and navigate to the Admin Web UI using the AdminPortal URL.
Enter the username (
openvpn) and the password created in the previous steps.
⚙️ If you select Azure
Under Set Your Credentials > Password, enter a password for the
openvpnuser. You'll use this to sign in to the Admin Web UI after deployment.Click Confirm and Deploy on Azure.
You're directed to the Azure Custom deployment page.
Complete the Custom deployment form:
Field
Description
Subscription
Select the Azure subscription where you'll be billed.
Resource group
Select an existing resource group where your instance, security groups, virtual networks, etc., will be deployed, or create a new one.
Region
Select the nearest Azure region.
Virtual machine name
Name for the instance. Default:
OpenVPNAccessServer.Virtual machine size
Select a VM size.
Admin Username
SSH username. Default:
azureuser.SSH public key source
Select an existing key pair, or create one.
Virtual network
Select your virtual network.
Subnet
Select your subnet.
Click Review + create.
Click Create.
🖥️ Gather Admin Web UI info from deployment output
Once the deployment completes, you can find your connection details for the Admin Web UI in the Outputs tab.
Here's how to access the Admin Web UI after the deployment is complete:
After the deployment is complete, click the Outputs tab. One output is displayed:
adminPortal: The Access Server Link URL to access the Admin Web UI (Example:
https://yourcompany.openvpn.com/admin).
Open your web browser and navigate to the Admin Web UI using the adminPortal URL.
Enter the username (
openvpn) and the password created in the previous steps.
⚙️ If you select GCP
Select the nearest GCP region from the drop-down.
Select your Google Project ID. Hover over the tooltip for help finding it.
Under Set Your Credentials > Password, enter a password for the
openvpnuser. You'll use this to sign in to the Admin Web UI after deployment.Click Generate Deployment URL, and the Deployment URL will be generated.
Copy the Deployment URL to your clipboard, and then click Confirm and Deploy.
Click Continue to GCP.
You're directed to Google Cloud Infrastructure Manager.
Complete the deployment form:
Field
Description
Deployment ID
A unique name for this deployment within your project.
Region
Select the nearest GCP region.
Service account
Select your service account.
Source of Terraform configuration
Select GCS.
Source *
Paste the Deployment URL generated previously.
Click Continue.
Click Create deployment.
🖥️ Gather Admin Web UI info from deployment output
Once the deployment completes, you can find your connection details for the Admin Web UI in the Outputs tab.
Here's how to access the Admin Web UI after the deployment is complete:
After the deployment is completed, click the Outputs tab. The following values are displayed:
admin_url: The Access Server Link URL to access the Admin Web UI (Example:
https://yourcompany.openvpn.com/admin).admin_user: Username (
openvpn) to access the Admin Web UI.site_url: The Access Server Link URL to access the Client Web UI (Example:
https://yourcompany.openvpn.com/).
Open your web browser and navigate to the Admin Web UI using the admin_url URL.
Enter the username (
openvpn) and the password created in the previous steps.
When Access Server Link is enabled, your Access Server sends the following information to the Access Server Link backend in its status report:
Certificate Fingerprint
Node URL
Public IP address
Linux hostname
Admin Web UI Port
DNS records are kept up to date automatically. If your server's public IP address changes, the DNS record is updated within approximately 15-20 minutes.
The Admin and Client Web UI are reachable securely via your Access Server Link URL (yourcompany.openvpn.com), with identity verified by certificate fingerprint. VPN connections go directly to your Access Server via a separate VPN DNS record (example: def456.access-server.cloud). VPN traffic isn't proxied.
After deployment, confirm that Access Server Link is active and reporting correctly.
Status indicators
Status | Meaning |
|---|---|
🟢 Operating normally | Everything is working correctly. |
🔴 Errors found | Access Server Link is enabled, but a required configuration value (node identifier or subscription) is missing. The server cannot report its status. |
🟡 Warnings found | Admin Web UI port and Client Web UI port are set to different values. The server is still reporting, but the proxy may only be able to reach the Admin Web UI. |
From the Access Server Hub
Go to the Access Server Hub and refresh the page to update the Access Server Link Status.
Click My Access Servers in the left panel.
Confirm that Server status shows 🟢 Online.
Optionally, click Open Admin Web UI or Open Client Web UI to verify both are reachable.
From this page, you can see the following information:
Under Subscription Details:
You can click Upgrade Subscription if you want to scale up your Subscription.
Subscription Name: The name of your Subscription.
Subscription ID: Subscription identifier.
Connections in use: Number of VPN users connected to the Access Server.
Under Overview:
Access Server URL: This is the Access Server Link URL.
Mode: If you’re using Standalone or Cluster.
Access Server version: Current version of your Access Server.
Operating system: Access Server Linux operating system
Also, if you click View Server Details, you can see the following info:
Node name: Instance hostname.
Status: Access Server Link status.
IP Address: Public IP of your instance.
Node URL: Internal identifier used for API communication.
Server ID: Unique identifier for this deployment.
Connections: Number of VPN users connected to the Access Server.
Last Seen: The last time that the Access Server Link backend checks the Access Server node.
From the Access Server Admin Web UI
Sign in to the Access Server Admin Web UI using the Access Server Link URL.
Go to Web Services → Access Server Link.
Confirm that Access Server Link is toggled On.
Check that the Status shows 🟢 Operating normally.
From there, you can also check under Details:
Admin Web UI URL: This is the Access Server Link URL used to log in to the Admin Web UI. Example:
https://yourcompany.openvpn.com/adminClient Web UI URL: This is the Access Server Link URL used to log in to the Client Web UI. Example:
https://yourcompany.openvpn.comServer ID: Unique identifier for this deployment to differentiate the Access Server from others using the same Subscription.
Node URL: Internal identifier used for API communication. Example:
abc123.access-server.cloudVPN DNS Record: Hostname used to connect to the VPN tunnel. Example:
def456.access-server.cloud
Open a terminal or SSH client.
Connect using the appropriate SSH username for your cloud provider:
Cloud provider
Default SSH username
AWS
ubuntuAzure
azureuser(or the username you configured during deployment)GCP
Configured when adding SSH keys after VM creation. See Google Cloud Documentation.
Run the following command:
ssh -i /path/key-pair-name.pem ssh-username@instance-public-ipv4-addressReplace
/path/key-pair-name.pemwith your private key,<ssh-username>with your SSH username, and<instance-public-ipv4-address>with your instance's public IP.
To turn off Access Server Link from the Admin Web UI:
Sign in to the Admin Web UI.
Go to Web Services → Access Server Link.
Toggle Access Server Link to Off.
Click Save & Restart.
Click Turn Off Access Server Link.
Once disabled, your Access Server Link URL and VPN DNS record will no longer route to your server. Your Admin and Client Web UI and VPN will be reachable via your instance's public IP instead.
To re-enable Access Server Link:
Sign in to the Admin Web UI.
Go to Web Services → Access Server Link.
Toggle Access Server Link to On.
Click Save & Restart.
Click Turn On Access Server Link.
Changes may take a few minutes to take effect.
You can configure a custom domain name and SSL certificate for your web services alongside Access Server Link. Access Server Link uses a separate SNI-based certificate for API communication and can coexist with custom certificates.
Configure a custom domain: VPN Server → Network Settings → Server Address.
Configure a custom certificate: Certificate Management → Web Server Certificate.
You can also use the built-in ACME client to install certificates. Custom certificates and Access Server Link are fully compatible.
IP address changes
If your Access Server's public IP changes (for example, after a restart on an ephemeral IP), Access Server Link detects the change and updates DNS records automatically. The maximum expected downtime during an IP change is approximately 15-20 minutes.
Admin or Client Web UI unreachable
If the Admin Web UI is reachable via its public IP, but not responding via Access Server Link URL:
The system marks the server as unreachable after 10 minutes of failed connection attempts.
Check that your Access Server is running and that your cloud provider's security group or firewall allows inbound traffic on TCP port 943 (or your configured Admin Web UI Port).
Ensure the Admin and Client Web UI ports are set to the same value. A warning appears in the Admin Web UI if they differ.
"Untrusted Node Detected" error in Access Server Hub
This warning appears when the proxy detects a certificate fingerprint that doesn't match the one registered for your deployment. Common causes:
The deployment script was run a second time, generating a new key pair.
The server was reinitialized (for example, using
ovpn-init).The certificate was manually replaced.
When this error occurs, the Access Server Link URL won't route to your server, and the following message is displayed: Status: Offline.
To resolve:
Sign in to the Access Server Hub.
Click My Access Servers in the left panel.
Select your deployment and click Manage.
Click View Server Details.
Click the three-dot menu, then click Verify and Make Active Node.
Click Send Verification Code.
A 6-digit code is sent to your email address.
Enter the code in the prompt, then click Verify.
If successful, your Access Server will return to Active and Online status in the hub.
Admin UI port change
If you change the Admin Web UI port in your Access Server settings, the Admin Web UI will be temporarily unreachable via the Access Server Link URL for approximately 3-4 minutes while the change propagates. Access is restored automatically after this period.
OpenVPN Connect v2 compatibility
Access Server Link uses the REST API only — XML-RPC isn't supported. As a result, OpenVPN Connect v2 import from server and server-locked v1 profiles aren't compatible with Access Server Link. Use OpenVPN Connect v3 for all new deployments.