---
title: Subscribe to Access Server on AWS — Pay As You Go
canonical: https://openvpn.net/as-docs/v3/aws-payg/
product: Access Server Docs
description: Create an Access Server VPN server with AWS where you pay as you go. This tutorial gets you started with the PAYG offering.
---

# Subscribe to Access Server on AWS — Pay As You Go

Access Server provides an [Amazon Web Services (AWS) VPN](https://aws.amazon.com/marketplace/pp/prodview-f5qcwyw2gy256?sr=0-11&ref_=beagle&applicationId=AWSMPContessa) that you can get up and running within minutes.

From the AWS Marketplace, you can launch Access Server. This VPN hosted in the cloud has the following benefits:

- Quickly extend your virtual private cloud networking to remote users and other sites.
- Create hub-and-spoke network topology, site-to-site, user-to-cloud, and various other secure VPN connections.
- Provide secure, remote access to applications deployed on your cloud platform.

> **Tip**
>
> Refer to the [system requirements](https://openvpn.net/as-docs/v3/system-requirements.md) to ensure your system works with Access Server.

Watch this video to deploy Access Server on AWS using our pay-as-you-go (PAYG) listing: [Introducing Access Server PAYG Flexible VPN Scaling on AWS](https://openvpn.net/as-docs/videos/video--access-server-payg-on-aws.md).

Read on for your guide to getting started with your VPN server on the web.

## 📄 Configure your AWS contract

1. Sign in to the AWS Marketplace.
2. Select the **Access Server / Self-Hosted VPN (PAYG)** listing.
3. Review the details and click **View purchase options**.
4. Select your desired options for the contract:
   - **Duration:** One month or a year.
   - **Auto-renewal:** Whether or not the contract renews automatically.
   - **Available units:** The connection plan that best fits your user needs.

     > **Tip**
     >
     > A connection is an actively connected user device, such as a headless server, a mobile tablet, or a remote laptop.
5. The contract cost displays.
6. Review the terms and conditions.
7. Select whether you need to add a purchase order.
8. Click **Subscribe**.
   1. Your contract is currently pending and you can set up your account on our site.
9. Click **Set up your account** to be directed to our site for the next steps.

## 🔑 Set up your OpenVPN account

> **Note**
>
> If you already have an OpenVPN account, sign in to your existing account and skip these steps.

1. Click to create a new account on our website.
2. Follow the steps to add your contact information and confirm your email.
   - Once you've successfully signed in, the Access Server Portal displays, starting on the **Deploy Access Server** screen.
   - You can also click **AWS Contract** in the navigation, displaying your available connections and email notification options.

## ⚙️ Launch with the CloudFormation script

1. From the **Install Access Server** page, select the nearest AWS region from the drop-down.
2. Click **Launch Script on AWS.**
   - **Optional:** You can click **Download The CloudFormation Script** to launch the script manually.
3. You are directed to AWS, where you can select your inputs for **Quick create stack**:
   - **Stack name:** You can enter a stack name; the default is **openvpn-accessserver**.
   - **ActivationKey:** This populates with the AWS PAYG license key.
   - **VpcId:** Select your VPC for the instance.
   - **SubnetId:** Select the public Subnet ID.
   - **InstanceName:** You can enter a name for the instance; the default is **OpenVPNAccessServer**.
   - **InstanceType:** Select the desired instance type; the default is **t3.small**.
   - **KeyName:** Select an existing EC2 KeyPair for SSH access to the instance.
4. Acknowledge that AWS CloudFormation will create IAM resources and click **Create stack**.

## 🖥️ Gather Admin Web UI info from stack output

Once the stack completes, you can find your connection details for the [Admin Web UI](https://openvpn.net/as-docs/v3/admin-web-ui-3-0-user-manual.md) in the stack output.

> **Important**
>
> The system requires up to five minutes for complete initialization. On AWS, this process occurs in two stages: Access Server is installed, and then reinstalled during initialization (`ovpn-init`). During this time, authentication attempts will **fail, and this is expected behavior**. Don't attempt to sign in until both stages are complete. Once initialization finishes, you can sign in successfully.

Here's how to access the Admin Web UI after the stack is complete:

1. On the CloudFormation status page, click the **Outputs** tab. Two outputs are displayed:
   - **AdminPortal:** The URL to access the Admin Web UI.
   - **TempPassword:** The password for authenticating the `openvpn` admin user account on the Admin Web UI.
2. Open your web browser and navigate to the Admin Web UI using the **AdminPortal** URL.
3. Enter the **username** (`openvpn`) and the **temporary password** displayed in the stack output.
4. Once signed in, we recommend changing the password under **Users → openvpn** user account.
5. Hop over to [First-Time Setup](https://openvpn.net/as-docs/v3/first-time-setup.md) for your first use and configuration of Access Server.

## 🖱️ Connect to your new AMI

Once your AMI is launched, SSH into the console using an SSH client and the private key pair you used during setup.

- **Instance username:** `ubuntu`
- Connect with SSH:

  ```
  ssh -i /path/key-pair-name.pem ubuntu@instance-public-ipv4-address
  ```

You can refer to [Connect to Access Server via SSH using PuTTY](https://openvpn.net/as-docs/tutorials/tutorial--connect-with-putty.md) for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow Amazon’s instructions on connecting to your instance.

## 🌍 Assign an Elastic IP address (recommended)

We recommend assigning an Elastic IP address to your Access Server instance to provide a persistent public IPv4 address. AWS recommends an Elastic IP when an EC2 instance requires a persistent public IP address.

> **Important**
>
> Before allocating the Elastic IP address, confirm that the AWS console is set to the same Region as your Access Server EC2 instance. For example, if the instance is in **US West (N. California)**, allocate and associate the Elastic IP address from that Region.
>
> An Elastic IP address allocated in a different Region can’t be associated with the instance.

1. In the AWS console, confirm that you're in the same region as your Access Server instance.
2. Navigate to **EC2**.
3. Under **Network & Security**, select **Elastic IPs**.
4. Click **Allocate Elastic IP address**.
5. Configure the address pool and optional tags.
6. Select **Allocate**.
7. Select the newly allocated Elastic IP address.
8. Select **Actions → Associate Elastic IP address**.
9. For **Resource type**, select **Instance**.
10. For **Instance**, select your Access Server instance.
11. For **Private IP address**, select the private IP address associated with the instance.
12. Select **Associate**.
    - AWS associates the persistent public IPv4 address with your Access Server EC2 instance.

### Configure Access Server to use the Elastic IP

1. Sign in to your Admin Web UI.
2. Select **VPN Server**.
3. Enter the **Elastic IP** in the **Hostname (or IP address)** field.
4. Click **Save** and **Restart**.
5. Review the details about updating the server address and select **Update Server Address**,

> **Important**
>
> Configure the Elastic IP before distributing connection profiles to users. Changing the configured hostname or IP address later can prevent existing client profiles from connecting until users download updated profiles.

## 🚫 Disable source/dest checking (recommended)

If your VPN setup consists of a site-to-site connection between your cloud instances and your on-premises machines, ensure you disable source/destination check protection on Amazon; otherwise, routing won’t function properly.

### Turn off source/destination checks:

1. From **Instances** in the EC2 console, right-click on the VPN instance ID.
2. Select **Networking → Change source/destination check**.
3. Check **Stop** under **Source / Destination checking** and select **Save**.

Source/destination checking can also block traffic if you want VPC data to go directly to the IP addresses of your VPN clients in the VPN client subnet. For that use case, turn off the check as well.

## 🔁 Set up static routes (optional)

Access Server’s default routing uses network address translation (NAT). Traffic originating from the VPN clients appears to come from the local IP address of Access Server with NAT, and this is simpler than setting up routing.

However, when using NAT, traffic from the VPC itself can’t directly access a VPN client because the NAT engine prevents direct contact. You must configure routing instead of NAT to allow direct access to a VPN client.

To access this configuration:

1. Sign in to the Admin Web UI.
2. Navigate to **Access Controls → Global Access Rules**.
3. Set **IP Addresses and Subnets** to **Route** for **Reachable via**.
4. Configure your subnets for your network.

After setting up routing, the source IP address of packets coming from the VPN clients is kept intact, and direct access from the VPC network to the VPN client subnet is possible. However, because the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Amazon routing table for your VPC so that the return traffic flows properly. Refer to Amazon’s AWS VPC routing documentation: [Route tables for your VPC (Amazon)](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html).

## 🚀 Launch automation with user data (optional)

When you launch a BYOL EC2 instance from the AWS Marketplace, you can pass user data to perform automated configuration tasks during deployment. You can use this feature to preconfigure Access Server with specific settings, such as administrative credentials.

User data is supported when launching instances manually from the EC2 dashboard, or via the AWS API or CLI.

> **Tip**
>
> If you deploy from the Access Server Portal, user data isn't exposed directly. To use it, download the CloudFormation (CF) template, modify it to include your user data, and deploy it manually using AWS CloudFormation Stacks.

Here’s an example of user data sent during launch:

- Send a username and password for your administrative user. When you do this, you don’t need to SSH in to finish the setup wizard. You’ve already set your account credentials.

### Entering user data:

1. During the instance launch, select **Advanced details** to expand that section.
2. Scroll down to the text field, **User data**.
3. Enter your data for one or more of the available settings below. Ensure you enter each row as **key1=value1**, and don’t use quote keys or spaces on either side of the equal character. Example:

```
public_hostname=vpn.example.com
admin_user=admin1
admin_pw=p@$w0rd
```

### Available settings for pre-configuration with Access Server:

| Key | Description |
| --- | --- |
| public\_hostname | The hostname used by clients to contact the server. |
| admin\_pw | The administrative account initial password. > **Warning** > > This parameter is communicated to the instance via cleartext channel. |
| license | The Access Server license key. > **Tip** > > Without a license key, Access Server allows up to two concurrent connections. |
| reroute\_gw (boolean, default=0) | If 1, clients route internet traffic through the VPN. |
| reroute\_dns (boolean, default=0) | If 1, clients route DNS queries through the VPN. Note: If the VPC CIDR block is defined, it is made accessible to VPN clients via NAT. |

## 🛡️ Further Security Recommendations

### Additional Security Steps You Can Take After Installation

We recommend you follow the tutorials below to improve your Access Server security after installation.

> **Note**
>
> Not every tutorial will apply to your installation. Follow the ones that do.

**Increase security with these tutorials:**

- [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — We recommend that everyone runs the latest Access Server version.
- [Tutorial: How to Replace the Legacy openvpn Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--replace-legacy-openvpn-account.md) — This tutorial is for sysadmins upgrading from an older Access Server version.
- [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — This tutorial is for new installations with a temporary password.
- [Tutorial: How to Install a Valid Web SSL Certificate in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--install-ssl-certificate.md) — We recommend that everyone add a valid SSL certificate from a trusted CA.
- [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — This is a security step where you can update the cipher suite string if you want.
- [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — This tutorial covers a narrow use case where you don't want the web UIs accessible online.
- [Tutorial: How to Secure the Root User Account on a Virtual Appliance](https://openvpn.net/as-docs/v3/tutorials/tutorial--secure-root-user.md) — This tutorial applies to ESXi or Hyper-V appliances.

---

Prev: [AWS BYOL](https://openvpn.net/as-docs/v3/aws-byol.md)
Next: [AWS Tiered](https://openvpn.net/as-docs/v3/aws-tiered.md)
Index: https://openvpn.net/as-docs/llms.txt