Subscribe to Access Server on AWS — Pay As You Go
Access Server provides an Amazon Web Services (AWS) VPN that you can get up and running within minutes.
From the AWS Marketplace, you can launch Access Server. This VPN hosted in the cloud has the following benefits:
Quickly extend your virtual private cloud networking to remote users and other sites.
Create hub-and-spoke network topology, site-to-site, user-to-cloud, and various other secure VPN connections.
Provide secure, remote access to applications deployed on your cloud platform.
Watch this video to deploy Access Server on AWS using our pay-as-you-go (PAYG) listing: Introducing Access Server PAYG Flexible VPN Scaling on AWS.
Read on for your guide to getting started with your VPN server on the web.
Sign in to the AWS Marketplace.
Select the Access Server / Self-Hosted VPN (PAYG) listing.
Review the details and click View purchase options.
Select your desired options for the contract:
Duration: One month or a year.
Auto-renewal: Whether or not the contract renews automatically.
Available units: The connection plan that best fits your user needs.
The contract cost displays.
Review the terms and conditions.
Select whether you need to add a purchase order.
Click Subscribe.
Your contract is currently pending and you can set up your account on our site.
Click Set up your account to be directed to our site for the next steps.
Click to create a new account on our website.
Follow the steps to add your contact information and confirm your email.
Once you've successfully signed in, the Access Server Portal displays, starting on the Deploy Access Server screen.
You can also click AWS Contract in the navigation, displaying your available connections and email notification options.
From the Install Access Server page, select the nearest AWS region from the drop-down.
Click Launch Script on AWS.
Optional: You can click Download The CloudFormation Script to launch the script manually.
You are directed to AWS, where you can select your inputs for Quick create stack:
Stack name: You can enter a stack name; the default is openvpn-accessserver.
ActivationKey: This populates with the AWS PAYG license key.
VpcId: Select your VPC for the instance.
SubnetId: Select the public Subnet ID.
InstanceName: You can enter a name for the instance; the default is OpenVPNAccessServer.
InstanceType: Select the desired instance type; the default is t3.small.
KeyName: Select an existing EC2 KeyPair for SSH access to the instance.
Acknowledge that AWS CloudFormation will create IAM resources and click Create stack.
Once the stack completes, you can find your connection details for the Admin Web UI in the stack output.
Here's how to access the Admin Web UI after the stack is complete:
On the CloudFormation status page, click the Outputs tab. Two outputs are displayed:
AdminPortal: The URL to access the Admin Web UI.
TempPassword: The password for authenticating the
openvpnadmin user account on the Admin Web UI.
Open your web browser and navigate to the Admin Web UI using the AdminPortal URL.
Enter the username (
openvpn) and the temporary password displayed in the stack output.Once signed in, we recommend changing the password under Users → openvpn user account.
Hop over to First-Time Setup for your first use and configuration of Access Server.
Once your AMI is launched, SSH into the console using an SSH client and the private key pair you used during setup.
Instance username:
ubuntuConnect with SSH:
ssh -i /path/key-pair-name.pem ubuntu@instance-public-ipv4-address
You can refer to Connect to Access Server via SSH using PuTTY for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow Amazon’s instructions on connecting to your instance.
We recommend assigning an Elastic IP address to your Access Server instance to provide a persistent public IPv4 address. AWS recommends an Elastic IP when an EC2 instance requires a persistent public IP address.
In the AWS console, confirm that you're in the same region as your Access Server instance.
Navigate to EC2.
Under Network & Security, select Elastic IPs.
Click Allocate Elastic IP address.
Configure the address pool and optional tags.
Select Allocate.
Select the newly allocated Elastic IP address.
Select Actions → Associate Elastic IP address.
For Resource type, select Instance.
For Instance, select your Access Server instance.
For Private IP address, select the private IP address associated with the instance.
Select Associate.
AWS associates the persistent public IPv4 address with your Access Server EC2 instance.
Configure Access Server to use the Elastic IP
Sign in to your Admin Web UI.
Select VPN Server.
Enter the Elastic IP in the Hostname (or IP address) field.
Click Save and Restart.
Review the details about updating the server address and select Update Server Address,
If your VPN setup consists of a site-to-site connection between your cloud instances and your on-premises machines, ensure you disable source/destination check protection on Amazon; otherwise, routing won’t function properly.
Turn off source/destination checks:
From Instances in the EC2 console, right-click on the VPN instance ID.
Select Networking → Change source/destination check.
Check Stop under Source / Destination checking and select Save.
Source/destination checking can also block traffic if you want VPC data to go directly to the IP addresses of your VPN clients in the VPN client subnet. For that use case, turn off the check as well.
Access Server’s default routing uses network address translation (NAT). Traffic originating from the VPN clients appears to come from the local IP address of Access Server with NAT, and this is simpler than setting up routing.
However, when using NAT, traffic from the VPC itself can’t directly access a VPN client because the NAT engine prevents direct contact. You must configure routing instead of NAT to allow direct access to a VPN client.
To access this configuration:
Sign in to the Admin Web UI.
Navigate to Access Controls → Global Access Rules.
Set IP Addresses and Subnets to Route for Reachable via.
Configure your subnets for your network.
After setting up routing, the source IP address of packets coming from the VPN clients is kept intact, and direct access from the VPC network to the VPN client subnet is possible. However, because the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Amazon routing table for your VPC so that the return traffic flows properly. Refer to Amazon’s AWS VPC routing documentation: Route tables for your VPC (Amazon).
When you launch a BYOL EC2 instance from the AWS Marketplace, you can pass user data to perform automated configuration tasks during deployment. You can use this feature to preconfigure Access Server with specific settings, such as administrative credentials.
User data is supported when launching instances manually from the EC2 dashboard, or via the AWS API or CLI.
Here’s an example of user data sent during launch:
Send a username and password for your administrative user. When you do this, you don’t need to SSH in to finish the setup wizard. You’ve already set your account credentials.
Entering user data:
During the instance launch, select Advanced details to expand that section.
Scroll down to the text field, User data.
Enter your data for one or more of the available settings below. Ensure you enter each row as key1=value1, and don’t use quote keys or spaces on either side of the equal character. Example:
public_hostname=vpn.example.com
admin_user=admin1
admin_pw=p@$w0rdAvailable settings for pre-configuration with Access Server:
Key | Description |
|---|---|
public_hostname | The hostname used by clients to contact the server. |
admin_pw | The administrative account initial password. |
license | The Access Server license key. |
reroute_gw (boolean, default=0) | If 1, clients route internet traffic through the VPN. |
reroute_dns (boolean, default=0) | If 1, clients route DNS queries through the VPN. Note: If the VPC CIDR block is defined, it is made accessible to VPN clients via NAT. |
Additional Security Steps You Can Take After Installation
We recommend you follow the tutorials below to improve your Access Server security after installation.
Increase security with these tutorials:
Tutorial: How to Secure the Root User Account on a Virtual Appliance — This tutorial applies to ESXi or Hyper-V appliances.
Tutorial: Keep Access Server Updated — We recommend that everyone runs the latest Access Server version.
Tutorial: How to Replace the Legacy openvpn Administrative Account — This tutorial is for sysadmins upgrading from an older Access Server version.
Tutorial: How to Change the Password for Your New Administrative Account — This tutorial is for new installations with a temporary password.
Tutorial: How to Install a Valid Web SSL Certificate in Access Server — We recommend that everyone add a valid SSL certificate from a trusted CA.
Tutorial: Harden the Web Server Cipher Suite String — This is a security step where you can update the cipher suite string if you want.
Tutorial: How to Isolate Access Server's Web Services — This tutorial covers a narrow use case where you don't want the web UIs accessible online.