---
title: 'AWS BYOL EC2 VPN Server Setup: Quick Start Guide'
canonical: https://openvpn.net/as-docs/v3/aws-byol/
product: Access Server Docs
description: How to launch the AWS Marketplace appliance for Access Server and get your VPN server up and running in minutes.
---

# AWS BYOL EC2 VPN Server Setup: Quick Start Guide

OpenVPN Access Server is available as a bring-your-own-license (BYOL) offering in [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-y3m73u6jd5srk?sr=0-3&ref_=beagle&applicationId=AWSMPContessa). You can deploy Access Server in your own Amazon Virtual Private Cloud (VPC) and activate it with an Access Server subscription.

This guide walks you through the recommended **AWS BYOL Marketplace offering with AWS CloudFormation**, which is the recommended deployment method for new installations.

The AWS Marketplace BYOL offering also supports the traditional Amazon EC2 launch method. That method requires SSH access and completing the initial Access Server configuration from the command line. For new deployments, we recommend using AWS CloudFormation.

> **Note**
>
> The AWS CloudFormation deployment method documented here is part of the AWS Marketplace BYOL offering.

Deploying Access Server on AWS is well suited for organizations that need to:

- Give remote users [secure access](https://openvpn.net/use-cases/secure-remote-access/) to applications and private networks in AWS.
- Connect cloud and on-premises networks with [site-to-site VPN](https://openvpn.net/use-cases/site-to-site-vpn/) connections.
- Run a self-managed VPN server within their AWS environment.

> **Note**
>
> For sizing and performance guidance, refer to [System Requirements](https://openvpn.net/as-docs/v3/system-requirements.md).

## 🌐 Open the AWS Marketplace BYOL offering

Start with the **OpenVPN Access Server (BYOL)** offering in AWS Marketplace.

1. Open [OpenVPN Access Server (BYOL) in AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-y3m73u6jd5srk?sr=0-3&ref_=beagle&applicationId=AWSMPContessa).
2. Sign in to your AWS account if prompted.
3. Review the product details to confirm you're using the **BYOL** offering.

> **Tip**
>
> The AWS Marketplace product page defaults to the Amazon Machine Image (AMI) deployment option. This guide uses the recommended AWS CloudFormation deployment method, which you'll select before subscribing.

## 🔑 About BYOL subscriptions

The AWS BYOL offering doesn't include a paid Access Server subscription with the AWS infrastructure charges. Activate the deployed server using an OpenVPN subscription.

You can:

- Use a free subscription for two VPN connections.
- Start a trial.
- Purchase a subscription for the number of VPN connections your deployment requires.
- Use an existing Access Server subscription.

Your AWS infrastructure charges are billed separately through AWS.

## 🌍 Subscribe to the AWS Marketplace BYOL offering

AWS Marketplace defaults to the Amazon Machine Image deployment option. To use the recommended CloudFormation deployment, select the CloudFormation template before subscribing.

1. On the AWS Marketplace product page, select **View purchase options**.
2. Review:
   - Product details.
   - Offer summary.
   - Total cost.
   - Terms and conditions.
   - Purchase details.
3. Select **Subscribe**.
4. Wait while AWS processes the subscription request.

   Don't close or refresh the page while the request is processing.
5. When AWS confirms that you've subscribed to **OpenVPN Access Server (BYOL)**, select **Launch your software**.

   > **Note**
   >
   > AWS infrastructure charges for the EC2 instance and related resources will apply, and Access Server requires an OpenVPN subscription for VPN connections above two.

## 🚀 Deploy with AWS CloudFormation

From the AWS Marketplace launch page, choose the recommended CloudFormation deployment.

1. For the deployment method, select **AWS CloudFormation** instead of **Amazon EC2**.
2. Select the Access Server version.

   The latest available version is selected by default.
3. Select the AWS Region where you want to deploy Access Server.
4. Select **Launch with CloudFormation**.
   - AWS opens the CloudFormation **Create stack** workflow.

### ⚙️ Create the CloudFormation stack

#### Specify the template

1. For **Prepare template**, keep **Choose an existing template**.
2. Under **Specify template**, keep **Amazon S3 URL** selected.

   AWS Marketplace automatically populates the template URL.
3. Select **Next**.

#### Configure stack details

1. Enter a **Stack name**.
2. Configure the Access Server deployment parameters:

   | **Configuration** | **Details** |
   | --- | --- |
   | **Activation key** | Paste the activation key from the OpenVPN subscription you want to use with this Access Server deployment, or leave this blank to do at a later step. |
   | **Let's Encrypt Certificate** | Select **enabled** to automatically configure a browser-trusted Let's Encrypt certificate for the Admin Web UI and Client Web UI. Select **disabled** if you plan to manage the web SSL certificate separately. Access Server will launch with a self-signed certificate. |
   | **Public IP Address Type** | Select an **Elastic IP** or an AWS **Auto-assigned Public IP**. We recommend an Elastic IP because it remains unchanged when the instance is stopped and started, helping prevent client disconnections caused by IP address changes. |
   | **VPC ID** | Select the Amazon VPC where Access Server should be deployed. |
   | **Public Subnet ID** | Select the public subnet for the Access Server instance. |
   | **SSH Access CIDR** | Specify the CIDR block allowed to reach the instance over SSH on TCP port 22. Use a specific address such as `198.51.100.10/32` whenever possible. > **Important** > > **Security recommendation** > > Avoid allowing SSH from `0.0.0.0/0` for production deployments. We recommend you restrict access to a specific administrator IP address or trusted network. |
   | **Instance name** | Enter a descriptive name for the Access Server EC2 instance. |
   | **Instance type** | Select an EC2 instance type appropriate for your VPN workload. Refer to [System Requirements](https://openvpn.net/as-docs/v3/system-requirements.md) for sizing guidance. |
   | **AMI ID** | Keep the AMI ID automatically populated by AWS Marketplace. |
   | **EC2 KeyPair for SSH access** | Recommended. Enter the name of an existing EC2 key pair if you want SSH access to the instance. You can find available key pairs under **EC2 → Network & Security → Key Pairs**. If you leave this field blank, CloudFormation will auto-generate an EC2 key pair. |
   | **Admin password** | Optional. Enter an initial password for the `openvpn` administrative account. Leave the field blank to have CloudFormation generate a temporary password automatically. |
3. Select **Next**.

#### 🛡️ Configure permissions and stack options

1. Under **Permissions**, optionally assign an existing AWS IAM service role that CloudFormation can assume or create a new role.
2. Configure any additional stack deployment options, validations, or settings required for your environment.
3. Acknowledge that AWS CloudFormation may create IAM resources.
4. Select **Next**.

#### 📜 Review and create the stack

1. Review the stack configuration.
2. Confirm the parameters are correct.
3. Select **Submit**.
   - AWS begins creating the CloudFormation stack.

   > **Tip**
   >
   > If you regularly deploy Access Server with the same configuration, you can use the CloudFormation quick-create option to streamline future deployments.

### 🕵️‍♂️ Monitor the deployment

The CloudFormation stack displays the deployment timeline and the AWS resources created for Access Server.

1. Monitor the stack status while AWS creates the resources.
2. Wait until the stack reports: `CREATE_COMPLETE`.
3. Select the **Outputs** tab.

### 🔐 Get the Admin Web UI credentials

The CloudFormation outputs provide the information you need to access Access Server for the first time.

1. Locate:

   | **Output** | **Description** |
   | --- | --- |
   | **AdminPortal** | The URL for the Access Server Admin Web UI. The initial URL uses the public IP address assigned to the instance, including the Elastic IP when selected during deployment. |
   | **TempPassword** | The temporary password for the `openvpn` administrative account when you leave the Admin password parameter blank. |
   | **SSHKeyParameter** | If CloudFormation generated an EC2 key pair, use the corresponding output information for SSH access. |

   > **Important**
   >
   > After the CloudFormation stack reaches `CREATE_COMPLETE`, Access Server may require up to five additional minutes to finish system initialization. Sign-in attempts can fail during this period.
2. Copy the **TempPassword**, if CloudFormation generated one, and store it securely.
3. Select the link for the **AdminPortal** URL.

## 🔑 Sign in to the Admin Web UI and activate Access Server

1. After selecting the **AdminPortal** URL in a browser, the Admin Web UI login page displays.
2. Sign in with the `openvpn` administrative account and the **TempPassword** or the password you configured during deployment.
3. Review the End User License Agreement (EULA).
4. Select **Agree**.
   - The **Activate your Access Server** page displays unless you entered an activation key with the stack details; then skip to the next section.
5. Open the Access Server Hub in another browser tab or window.
6. Select **Subscriptions**.
7. To create a free subscription for this deployment:
   1. Select **Purchase a New Key**.
   2. Select **Free**.
   3. Select the **Copy** icon for the new activation key.
8. Return to the Admin Web UI.
9. Paste the activation key into the activation field.
10. Select **Activate**.
    - Access Server activates the subscription and unlocks the VPN connections included with it.

    > **Tip**
    >
    > If you already have an Access Server subscription that you want to use for this deployment, copy its activation key instead of creating a new free subscription.

## 💻 Walk through the onboarding wizard

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

1. Select whether VPN clients should have:
   - Internet access through Access Server.
   - Access to private resources in your AWS environment.
   - Both, if appropriate for your deployment.
2. If access to private resources is enabled, review the network CIDRs that Access Server detected.
3. Verify that the detected networks match the AWS VPC networks users should access.
4. Keep only the networks that VPN users should be allowed to access.
5. Select **Continue**.
6. Review the OpenVPN Connect download offered by the wizard.

   The wizard displays the download appropriate for the operating system of the device you're currently using.
7. Select **Download**.
8. Install OpenVPN Connect.
9. Return to the onboarding wizard.
10. Select **Continue**.
11. The wizard displays a prompt while it waits for a VPN connection.
12. Launch OpenVPN Connect on your device.
13. Connect using the profile included.
14. Confirm that the VPN connection succeeds.
15. Return to the Admin Web UI.
16. Select **Finish Wizard**.

    > **Tip**
    >
    > You can also close the onboarding wizard by selecting the **X** if you prefer to skip these steps.
17. After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
    - The Client Web UI
    - Users
    - Access Controls
    - Authentication
    - Activation

## 🚀 Alternative: Deploy with Amazon EC2

The AWS Marketplace BYOL offering also provides an **Amazon EC2** deployment method.

This is the traditional Access Server AWS Marketplace workflow. It requires:

- Selecting or creating an EC2 SSH key pair.
- Connecting to the instance with SSH.
- Completing the Access Server initial configuration from the command line.
- Configuring the Let's Encrypt certificate during the command-line setup.
- Signing in to the Admin Web UI after initialization completes.

We recommend the AWS CloudFormation method for new deployments.

### Configure Let's Encrypt during EC2 setup

During the initial command-line configuration, Access Server asks whether you want to configure a Let's Encrypt certificate.

When prompted, enter `y`.

Access Server requests and configures a browser-trusted Let's Encrypt certificate for the Admin Web UI and Client Web UI.

If you don't configure Let's Encrypt, Access Server uses its default self-signed certificate. The web connection remains encrypted, but browsers will display a certificate warning because they can't automatically verify the server's identity.

After the command-line configuration completes, record the Admin Web UI URL and administrative credentials, sign in, activate Access Server, and complete the onboarding wizard.

## 🚫 Disable source/dest checking (recommended)

If your VPN setup consists of a site-to-site connection between your cloud instances and your on-premises machines, ensure you disable source/destination check protection on Amazon; otherwise, routing won’t function properly.

### Turn off source/destination checks:

1. From **Instances** in the EC2 console, right-click on the VPN instance ID.
2. Select **Networking → Change source/destination check**.
3. Check **Stop** under **Source / Destination checking** and select **Save**.

Source/destination checking can also block traffic if you want VPC data to go directly to the IP addresses of your VPN clients in the VPN client subnet. For that use case, turn off the check as well.

## 🔁 Set up static routes (optional)

Access Server’s default routing uses network address translation (NAT). Traffic originating from the VPN clients appears to come from the local IP address of Access Server with NAT, and this is simpler than setting up routing.

However, when using NAT, traffic from the VPC itself can’t directly access a VPN client because the NAT engine prevents direct contact. You must configure routing instead of NAT to allow direct access to a VPN client.

To access this configuration:

1. Sign in to the Admin Web UI.
2. Navigate to **Access Controls → Global Access Rules**.
3. Set **IP Addresses and Subnets** to **Route** for **Reachable via**.
4. Configure your subnets for your network.

After setting up routing, the source IP address of packets coming from the VPN clients is kept intact, and direct access from the VPC network to the VPN client subnet is possible. However, because the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Amazon routing table for your VPC so that the return traffic flows properly. Refer to Amazon’s AWS VPC routing documentation: [Route tables for your VPC (Amazon)](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html).

## 🚀 Launch automation with user data (optional)

When you launch a BYOL EC2 instance from the AWS Marketplace, you can pass user data to perform automated configuration tasks during deployment. You can use this feature to preconfigure Access Server with specific settings, such as administrative credentials.

User data is supported when launching instances manually from the EC2 dashboard, or via the AWS API or CLI.

> **Tip**
>
> If you deploy from the Access Server Portal, user data isn't exposed directly. To use it, download the CloudFormation (CF) template, modify it to include your user data, and deploy it manually using AWS CloudFormation Stacks.

Here’s an example of user data sent during launch:

- Send a username and password for your administrative user. When you do this, you don’t need to SSH in to finish the setup wizard. You’ve already set your account credentials.

### Entering user data:

1. During the instance launch, select **Advanced details** to expand that section.
2. Scroll down to the text field, **User data**.
3. Enter your data for one or more of the available settings below. Ensure you enter each row as **key1=value1**, and don’t use quote keys or spaces on either side of the equal character. Example:

```
public_hostname=vpn.example.com
admin_user=admin1
admin_pw=p@$w0rd
```

### Available settings for pre-configuration with Access Server:

| Key | Description |
| --- | --- |
| public\_hostname | The hostname used by clients to contact the server. |
| admin\_pw | The administrative account initial password. > **Warning** > > This parameter is communicated to the instance via cleartext channel. |
| license | The Access Server license key. > **Tip** > > Without a license key, Access Server allows up to two concurrent connections. |
| reroute\_gw (boolean, default=0) | If 1, clients route internet traffic through the VPN. |
| reroute\_dns (boolean, default=0) | If 1, clients route DNS queries through the VPN. Note: If the VPC CIDR block is defined, it is made accessible to VPN clients via NAT. |

---

Prev: [AWS CloudFormation](https://openvpn.net/as-docs/v3/aws-cloudformation.md)
Next: [AWS PAYG](https://openvpn.net/as-docs/v3/aws-payg.md)
Index: https://openvpn.net/as-docs/llms.txt