Deploy Access Server on Microsoft Azure Using an ARM Template⁠

Overview⁠

Deploy OpenVPN Access Server on Microsoft Azure with an Azure Resource Manager (ARM) template generated from the Access Server Hub.

Access Server provides several deployment options for Microsoft Azure. This guide covers the ARM Template option that allows you to:

Deploy Access Server without manually installing the software.
Configure the Azure VM and networking for your environment.
Connect directly to the web-based Admin Web UI.
Complete initial Access Server configuration using the onboarding wizard.

🚀 Deploy Access Server using the ARM template⁠

Use the OpenVPN Azure Resource Manager (ARM) template to deploy a preconfigured Access Server virtual machine (VM) and its required Azure resources.

The ARM template automates the initial Access Server configuration and provides the Admin Web UI URL and temporary administrator password when deployment completes.

Sign in to the Access Server Hub on our site or create a new account.
Under Installation, select Azure.
Select ARM Template.
Select the OpenVPN subscription you want to use with the deployment.
Select Launch Now.
Sign in to your Microsoft Azure account if prompted.
- Azure opens the ARM template deployment page.

Configure the following settings:

Setting	Description
Subscription	Select the Azure subscription for the deployment
Resource group	Select an existing resource group or create a new one.
Region	Select the Azure region where you want to deploy Access Server.
Virtual machine name	Enter a name for the Access Server VM.
VM architecture	Select the architecture appropriate for your deployment.
Virtual machine size	Select an available VM size that meets your Access Server capacity and performance requirements.
OS disk type	Select the storage type for the operating system disk.
OS disk size	Select the disk size for the Access Server VM.
Let's Encrypt Certificate	Leave this selected to configure a browser-trusted Let's Encrypt certificate during deployment.
Admin Username	Enter the administrative username for the Azure VM. The default is `azureuser`.
SSH public key source	Create a new key pair, select an existing key stored in Azure, or provide an existing public key.
SSH key	Complete the SSH key configuration for the option you selected.
Virtual network	Select an existing Azure virtual network or create a new one for the deployment.
Subnet	Select the subnet where you want to deploy the Access Server VM.

Select Review + Create.
Wait for Azure to validate the template.
Review the deployment Summary.
Select Create.

Azure begins deploying Access Server and its required resources. The deployment creates resources such as:

Network security group.
Virtual network.
Public IP address.
Network interface.
Access Server virtual machine.

The deployment also generates a temporary password for the default Access Server administrator account.

When the deployment completes:

Select the Outputs from the left menu.
Locate the deployment outputs:
- adminPortal — the URL for the Access Server Admin Web UI.
- tempPassword — the temporary password generated for the openvpn administrator account.
Open the adminPortal URL in your browser.
Sign in with:
- Username: openvpn
- Password: The value shown for tempPassword.
Note
If you enabled the Let's Encrypt Certificate option, Access Server automatically configures a browser-trusted certificate during deployment. If certificate issuance isn't successful, you may see a browser warning for the self-signed certificate.
Review the Access Server End User License Agreement (EULA).
Select Agree.
- The onboarding wizard displays for a new Access Server installation.

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

Select whether VPN clients should have:
- Internet access through Access Server.
- Access to private resources in your Azure virtual network.
- Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Verify that the detected networks match the Azure virtual networks that VPN users should access.
Keep only the networks that VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
Tip
You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
- The Client Web UI
- Users
- Access Controls
- Authentication
- Activation

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.

🕒 Change default time zone⁠

If the server uses a different time zone than you require, run:
```
sudo dpkg-reconfigure tzdata
```
Follow the prompts to select the appropriate time zone.

⏰ Verify time synchronization⁠

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.

🔄 Update operating-system software⁠

Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
```
sudo apt-get update
sudo apt-get upgrade
```
Review the packages before applying updates in production and reboot the server when required.

🛡️ Further security recommendations⁠

Review the security guidance that applies to your deployment:

Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

In order for your instance to function properly if you use Routing as your mode of operation inside Access Server instead of NAT, ensure you turn on IP forwarding:

From the Azure portal, enter network interfaces in the search box at the top.
Select Network interfaces from the search results.
Select the network interface of your Access Server virtual machine.
Select IP configurations.
Select the toggle to Enable IP forwarding.
Select Save.
The network interface change saves.

Note your private IP address here, as you will need it to create and assign a routing table, as explained below.

When you use Routing for your Access Server instead of NAT, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance.

Create a route table⁠

Select Create a resource from your Azure portal.
Search for "route table".
Select the Route table from Microsoft when prompted and select Create.
Select the Resource group with your VPN server.
Enter a name for the routing table (choose any you would like).
Select Review + Create then Create.

Attach the route table to your VM⁠

Navigate to your Access Server virtual machine's dashboard.
Under Networking and Virtual network/subnet select the Vnet for your VM.
Under Settings, select Subnets.
Select the subnet used by your computing resources (may be called default).
Select the Route table drop-down, and select your newly created routing table from the list.
Select Save.
Repeat this step for any additional subnets you may have under the same Vnet that the VPN server needs to communicate with.

Add routes⁠

Now that the routing table is assigned, you need to add routes:

Navigate to your new routing table.
Under Settings of your route table, select Routes.
Select Add.
On the Add route page, enter a name, then the following:
Address Prefix: 172.27.224.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.
Select Add again to add a second record:
Address Prefix: 172.27.240.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.

You've completed the routing table configuration.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Deploy Access Server on Microsoft Azure Using an ARM Template⁠

Overview⁠

🚀 Deploy Access Server using the ARM template⁠

Was this information helpful?