---
title: AWS Marketplace Quick Start Guide for Access Server (Tiered/Fixed Connection Licensing)
canonical: https://openvpn.net/as-docs/v3/aws-tiered/
product: Access Server Docs
description: Launch OpenVPN Access Server on AWS EC2 using a tiered Marketplace AMI — pre-licensed for a fixed number of VPN connections and billed hourly through AWS. Covers EC2 setup, initial configuration, and connecting your first VPN client.
---

# AWS Marketplace Quick Start Guide for Access Server (Tiered/Fixed Connection Licensing)

OpenVPN Access Server is available on the [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-oci66vvwyhu3i?sr=0-1&ref_=beagle&applicationId=AWSMPContessa) as a Tiered offering with predefined VPN connection limits. You can deploy Access Server in your own Amazon Virtual Private Cloud (VPC), and AWS handles the Access Server software subscription based on the connection tier you purchased.

This guide walks you through the AWS Marketplace Tiered offering using AWS CloudFormation, the recommended deployment method for new installations.

Deploying Access Server on AWS is well suited for organizations that need to:

- Give remote users [secure access](https://openvpn.net/use-cases/secure-remote-access/) to applications and private networks in AWS.
- Connect cloud and on-premises networks with [site-to-site VPN](https://openvpn.net/use-cases/site-to-site-vpn/) connections.
- Run a self-managed VPN server within their AWS environment.

> **Note**
>
> For sizing and performance guidance, refer to [System Requirements](https://openvpn.net/as-docs/v3/system-requirements.md).

## 🌐 Choose the AWS Tiered offering

AWS Marketplace provides separate Access Server offerings for predefined VPN connection limits. Choose the tier that supports the number of concurrent VPN connections your deployment requires.

| Connection tier | AWS Marketplace offering |
| --- | --- |
| 5 connections | [OpenVPN Access Server — 5 Connected Devices](https://aws.amazon.com/marketplace/pp/prodview-fiozs66safl5a) |
| 10 connections | [OpenVPN Access Server — 10 Connected Devices](https://aws.amazon.com/marketplace/pp/prodview-oci66vvwyhu3i) |
| 25 connections | [OpenVPN Access Server — 25 Connected Devices](https://aws.amazon.com/marketplace/pp/prodview-2pbtlbvdt43ki) |
| 50 connections | [OpenVPN Access Server — 50 Connected Devices](https://aws.amazon.com/marketplace/pp/prodview-jb4kagbyuk47s) |
| 100 connections | [OpenVPN Access Server — 100 Connected Devices](https://aws.amazon.com/marketplace/pp/prodview-q2nbay5voekjw) |
| 250 connections | [OpenVPN Access Server — 250 Connected Devices](https://aws.amazon.com/marketplace/pp/prodview-4ly4bnobtf5ti) |
| 500 connections | [OpenVPN Access Server — 500 Connected Devices](https://aws.amazon.com/marketplace/pp/prodview-dm5irp7ktf3qi) |

1. Select the AWS Marketplace offering for the connection tier you need.
2. Sign in to your AWS account if prompted.
3. Verify that the product page shows the connection limit you selected.

> **Important**
>
> Each Tiered offering has a fixed concurrent VPN connection limit. If your connection requirements change, refer to the [AWS licensing options FAQ](https://openvpn.net/as-docs/faq-aws-license-options.md) to compare Tiered, Pay-As-You-Go (PAYG), and bring your own license (BYOL) options.

> **Tip**
>
> The AWS Marketplace product page provides Amazon Machine Image (AMI) and AWS CloudFormation deployment options. This guide uses the recommended AWS CloudFormation deployment method.

## 🔑 About Tiered subscriptions

With an AWS Tiered instance, you purchase a predefined number of VPN connections through AWS Marketplace.

The selected connection tier is tied to the AWS Marketplace subscription, so you don't need to activate a separate OpenVPN subscription key.

AWS Marketplace also offers other deployment options, including [Pay-As-You-Go (PAYG)](https://openvpn.net/as-docs/v3/aws-payg.md) and [Bring-Your-Own-License (BYOL)](https://openvpn.net/as-docs/v3/aws-byol.md). This guide focuses on tiered instances.

AWS bills both the Access Server software subscription and the AWS infrastructure charges through your AWS account.

For a detailed comparison of all AWS licensing options, refer to the [AWS licensing options FAQ](https://openvpn.net/as-docs/faq-aws-license-options.md).

If you have licensing issues with your Amazon tiered instance and it’s only allowing two connections, see our [AMI tiered instance licensing troubleshooting page](https://openvpn.net/as-docs/subscription-troubleshooting.md).

## 🌍 Subscribe to the AWS Marketplace Tiered offering

1. On the AWS Marketplace product page, confirm that the listing matches the connection tier you selected.
2. Select **View purchase options**.
3. Review:
   - Offer summary.
   - Purchase details.
   - Free trial details, if available.
   - Pricing details for the selected dimension.
   - Total cost.
   - Terms and conditions.
4. Under **Purchase details**, keep **Usage based** or select **Usage based with annual contract**, if available and appropriate for your deployment.
5. Request a purchase order if required by your organization.
6. Select **Subscribe**.
7. Wait while AWS creates the usage-based agreement.
   - Don't close or refresh the page while the request is processing.
8. When AWS confirms the purchase, select **Launch your software**.

## 🚀 Deploy with AWS CloudFormation

From the AWS Marketplace launch page, choose the recommended CloudFormation deployment.

1. For the deployment method, select **AWS CloudFormation** instead of **Amazon EC2**.
2. Select the Access Server version.

   The latest available version is selected by default.
3. Select the AWS Region where you want to deploy Access Server.
4. Select **Launch with CloudFormation**.
   - AWS opens the CloudFormation **Create stack** workflow.

### ⚙️ Create the CloudFormation stack

#### Specify the template

1. For **Prepare template**, keep **Choose an existing template**.
2. Under **Specify template**, keep **Amazon S3 URL** selected.

   AWS Marketplace automatically populates the template URL.
3. Select **Next**.

#### Configure stack details

1. Enter a **Stack name**.
2. Configure the Access Server deployment parameters:

   | **Configuration** | **Details** |
   | --- | --- |
   | **Let's Encrypt Certificate** | Select **enabled** to automatically configure a browser-trusted Let's Encrypt certificate for the Admin Web UI and Client Web UI. Select **disabled** if you plan to manage the web SSL certificate separately. Access Server will launch with a self-signed certificate. |
   | **Public IP Address Type** | Select an **Elastic IP** or an AWS **Auto-assigned Public IP**. We recommend an Elastic IP because it remains unchanged when the instance is stopped and started, helping prevent client disconnections caused by IP address changes. |
   | **VPC ID** | Select the Amazon VPC where Access Server should be deployed. |
   | **Public Subnet ID** | Select the public subnet for the Access Server instance. |
   | **SSH Access CIDR** | Specify the CIDR block allowed to reach the instance over SSH on TCP port 22. Use a specific address such as `198.51.100.10/32` whenever possible. > **Important** > > **Security recommendation** > > Avoid allowing SSH from `0.0.0.0/0` for production deployments. We recommend you restrict access to a specific administrator IP address or trusted network. |
   | **Instance name** | Enter a descriptive name for the Access Server EC2 instance. |
   | **Instance type** | Select an EC2 instance type appropriate for your VPN workload. Refer to [System Requirements](https://openvpn.net/as-docs/v3/system-requirements.md) for sizing guidance. |
   | **AMI ID** | Keep the AMI ID automatically populated by AWS Marketplace. |
   | **EC2 KeyPair for SSH access** | Recommended. Enter the name of an existing EC2 key pair if you want SSH access to the instance. You can find available key pairs under **EC2 → Network & Security → Key Pairs**. If you leave this field blank, CloudFormation will auto-generate an EC2 key pair. |
   | **Admin password** | Optional. Enter an initial password for the `openvpn` administrative account. Leave the field blank to have CloudFormation generate a temporary password automatically. |
3. Select **Next**.

#### 🛡️ Configure permissions and stack options

1. Under **Permissions**, optionally assign an existing AWS IAM service role that CloudFormation can assume or create a new role.
2. Configure any additional stack deployment options, validations, or settings required for your environment.
3. Acknowledge that AWS CloudFormation may create IAM resources.
4. Select **Next**.

#### 📜 Review and create the stack

1. Review the stack configuration.
2. Confirm the parameters are correct.
3. Select **Submit**.
   - AWS begins creating the CloudFormation stack.

   > **Tip**
   >
   > If you regularly deploy Access Server with the same configuration, you can use the CloudFormation quick-create option to streamline future deployments.

### 🕵️‍♂️ Monitor the deployment

The CloudFormation stack displays the deployment timeline and the AWS resources created for Access Server.

1. Monitor the stack status while AWS creates the resources.
2. Wait until the stack reports: `CREATE_COMPLETE`.
3. Select the **Outputs** tab.

### 🔐 Get the Admin Web UI credentials

The CloudFormation outputs provide the information you need to access Access Server for the first time.

1. Locate:

   | **Output** | **Description** |
   | --- | --- |
   | **AdminPortal** | The URL for the Access Server Admin Web UI. The initial URL uses the public IP address assigned to the instance, including the Elastic IP when selected during deployment. |
   | **TempPassword** | The temporary password for the `openvpn` administrative account when you leave the Admin password parameter blank. |
   | **SSHKeyParameter** | If CloudFormation generated an EC2 key pair, use the corresponding output information for SSH access. |

   > **Important**
   >
   > After the CloudFormation stack reaches `CREATE_COMPLETE`, Access Server may require up to five additional minutes to finish system initialization. Sign-in attempts can fail during this period.
2. Copy the **TempPassword**, if CloudFormation generated one, and store it securely.
3. Select the link for the **AdminPortal** URL.

## 🔑 Sign in to the Admin Web UI and activate Access Server

1. After selecting the **AdminPortal** URL in a browser, the Admin Web UI login page displays.
2. Sign in with the `openvpn` administrative account and the **TempPassword** or the password you configured during deployment.
3. Review the End User License Agreement (EULA).
4. Select **Agree**.

## 🚫 Disable source/dest checking (recommended)

If your VPN setup consists of a site-to-site connection between your cloud instances and your on-premises machines, ensure you disable source/destination check protection on Amazon; otherwise, routing won’t function properly.

### Turn off source/destination checks:

1. From **Instances** in the EC2 console, right-click on the VPN instance ID.
2. Select **Networking → Change source/destination check**.
3. Check **Stop** under **Source / Destination checking** and select **Save**.

Source/destination checking can also block traffic if you want VPC data to go directly to the IP addresses of your VPN clients in the VPN client subnet. For that use case, turn off the check as well.

## 🔁 Set up static routes (optional)

Access Server’s default routing uses network address translation (NAT). Traffic originating from the VPN clients appears to come from the local IP address of Access Server with NAT, and this is simpler than setting up routing.

However, when using NAT, traffic from the VPC itself can’t directly access a VPN client because the NAT engine prevents direct contact. You must configure routing instead of NAT to allow direct access to a VPN client.

To access this configuration:

1. Sign in to the Admin Web UI.
2. Navigate to **Access Controls → Global Access Rules**.
3. Set **IP Addresses and Subnets** to **Route** for **Reachable via**.
4. Configure your subnets for your network.

After setting up routing, the source IP address of packets coming from the VPN clients is kept intact, and direct access from the VPC network to the VPN client subnet is possible. However, because the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Amazon routing table for your VPC so that the return traffic flows properly. Refer to Amazon’s AWS VPC routing documentation: [Route tables for your VPC (Amazon)](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html).

## ⚙️ Next Steps

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.

### 🕒 Change default time zone

1. If the server uses a different time zone than you require, run:

   ```
   sudo dpkg-reconfigure tzdata
   ```
2. Follow the prompts to select the appropriate time zone.

### ⏰ Verify time synchronization

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.

### 🔄 Update operating-system software

1. Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:

   ```
   sudo apt-get update
   sudo apt-get upgrade
   ```
2. Review the packages before applying updates in production and reboot the server when required.

### 🛡️ Further security recommendations

Review the security guidance that applies to your deployment:

- [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — Keep Access Server current with supported security and feature updates.
- [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — Replace the temporary administrative password used during initial setup.
- [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
- [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

---

Prev: [AWS PAYG](https://openvpn.net/as-docs/v3/aws-payg.md)
Next: [Google Cloud](https://openvpn.net/as-docs/v3/google-cloud.md)
Index: https://openvpn.net/as-docs/llms.txt