Deploy Access Server on Microsoft Azure Using an ARM Template
Deploy OpenVPN Access Server on Azure using an ARM (Azure Resource Manager) template — covers launching the template from the Azure portal, configuring your virtual machine parameters, and completing initial Access Server setup.
Overview
Deploy OpenVPN Access Server on Microsoft Azure with an Azure Resource Manager (ARM) template generated from the Access Server Hub.
Access Server provides several deployment options for Microsoft Azure. This guide covers the ARM Template option that allows you to:
Deploy Access Server without manually installing the software.
Configure the Azure VM and networking for your environment.
Connect directly to the web-based Admin Web UI.
Complete initial Access Server configuration using the onboarding wizard.
Tip
Refer to our system requirements to ensure your system works with Access Server.
🚀 Deploy Access Server using the ARM template
Use the OpenVPN Azure Resource Manager (ARM) template to deploy a preconfigured Access Server virtual machine (VM) and its required Azure resources.
The ARM template automates the initial Access Server configuration and provides the Admin Web UI URL and temporary administrator password when deployment completes.
Sign in to the Access Server Hub on our site or create a new account.
Under Installation, select Azure.
Select ARM Template.
Select the OpenVPN subscription you want to use with the deployment.
Select Launch Now.
Sign in to your Microsoft Azure account if prompted.
Azure opens the ARM template deployment page.
Configure the following settings:
Setting
Description
Subscription
Select the Azure subscription for the deployment
Resource group
Select an existing resource group or create a new one.
Region
Select the Azure region where you want to deploy Access Server.
Virtual machine name
Enter a name for the Access Server VM.
VM architecture
Select the architecture appropriate for your deployment.
Virtual machine size
Select an available VM size that meets your Access Server capacity and performance requirements.
OS disk type
Select the storage type for the operating system disk.
OS disk size
Select the disk size for the Access Server VM.
Let's Encrypt Certificate
Leave this selected to configure a browser-trusted Let's Encrypt certificate during deployment.
Admin Username
Enter the administrative username for the Azure VM. The default is
azureuser.SSH public key source
Create a new key pair, select an existing key stored in Azure, or provide an existing public key.
SSH key
Complete the SSH key configuration for the option you selected.
Virtual network
Select an existing Azure virtual network or create a new one for the deployment.
Subnet
Select the subnet where you want to deploy the Access Server VM.
Note
Azure VM size availability depends on your subscription, region, quota, and current Azure capacity. If your preferred size isn't available, select another suitable VM size or region.
Select Review + Create.
Wait for Azure to validate the template.
Review the deployment Summary.
Select Create.
Azure begins deploying Access Server and its required resources. The deployment creates resources such as:
Network security group.
Virtual network.
Public IP address.
Network interface.
Access Server virtual machine.
The deployment also generates a temporary password for the default Access Server administrator account.
When the deployment completes:
Select the Outputs from the left menu.
Locate the deployment outputs:
adminPortal— the URL for the Access Server Admin Web UI.tempPassword— the temporary password generated for theopenvpnadministrator account.
Open the
adminPortalURL in your browser.Sign in with:
Username:
openvpnPassword: The value shown for
tempPassword.
Note
If you enabled the Let's Encrypt Certificate option, Access Server automatically configures a browser-trusted certificate during deployment. If certificate issuance isn't successful, you may see a browser warning for the self-signed certificate.
Review the Access Server End User License Agreement (EULA).
Select Agree.
The onboarding wizard displays for a new Access Server installation.
The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.
Select whether VPN clients should have:
Internet access through Access Server.
Access to private resources in your Azure virtual network.
Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Verify that the detected networks match the Azure virtual networks that VPN users should access.
Keep only the networks that VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
Tip
You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
The Client Web UI
Users
Access Controls
Authentication
Activation
After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.
🕒 Change default time zone
If the server uses a different time zone than you require, run:
sudo dpkg-reconfigure tzdata
Follow the prompts to select the appropriate time zone.
⏰ Verify time synchronization
Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.
Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.
🔄 Update operating-system software
Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
sudo apt-get update sudo apt-get upgrade
Review the packages before applying updates in production and reboot the server when required.
🛡️ Further security recommendations
Review the security guidance that applies to your deployment:
Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.
Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.
In order for your instance to function properly if you use Routing as your mode of operation inside Access Server instead of NAT, ensure you turn on IP forwarding:
From the Azure portal, enter network interfaces in the search box at the top.
Select Network interfaces from the search results.
Select the network interface of your Access Server virtual machine.
Select IP configurations.
Select the toggle to Enable IP forwarding.
Select Save.
The network interface change saves.
Note your private IP address here, as you will need it to create and assign a routing table, as explained below.
When you use Routing for your Access Server instead of NAT, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance.
Create a route table
Select Create a resource from your Azure portal.
Search for "route table".
Select the Route table from Microsoft when prompted and select Create.
Select the Resource group with your VPN server.
Enter a name for the routing table (choose any you would like).
Select Review + Create then Create.
Attach the route table to your VM
Navigate to your Access Server virtual machine's dashboard.
Under Networking and Virtual network/subnet select the Vnet for your VM.
Under Settings, select Subnets.
Select the subnet used by your computing resources (may be called default).
Select the Route table drop-down, and select your newly created routing table from the list.
Select Save.
Repeat this step for any additional subnets you may have under the same Vnet that the VPN server needs to communicate with.
Add routes
Now that the routing table is assigned, you need to add routes:
Navigate to your new routing table.
Under Settings of your route table, select Routes.
Select Add.
On the Add route page, enter a name, then the following:
Address Prefix: 172.27.224.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.
Select Add again to add a second record:
Address Prefix: 172.27.240.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.
You've completed the routing table configuration.
Note
The 172.x.x.x IP addresses above are private IP addresses used by Access Server as the internal DHCP system.
Important
If you change your VPN subnets using the Admin Web UI, ensure you edit your routing table configuration as well.