Subscribe to Access Server on Microsoft Azure — Pay As You Go
Create an Access Server VPN server with Microsoft Azure, where you pay as you go. This quick start guide helps you launch the PAYG offering.
Deploy OpenVPN Access Server as an Azure VPN that you can get up and running within minutes.
From the Azure Marketplace, you can launch Access Server. This VPN, hosted in the cloud, has the following benefits.
📄 Deploy Access Server on Microsoft Azure
This guide covers the SaaS Contract (Pay As You Go) option from Azure Marketplace.
Important
This option requires a new Access Server Hub account.
Under Installation, select Azure.
Under Azure Deployment Options, click the Azure Marketplace Options tab.
Select Buy with Azure to launch the SaaS Contract option.
Sign in with your Microsoft account.
Select your Plan from the drop-down based on desired connections.
Select Subscribe.
Enter your Project details:
Subscription
This auto populates.
Resource group
Select your group from the drop-down to assign this new image.
Name
Enter a name for your image.
Contract duration
Select between monthly and yearly.
Aut-renew
Select whether to set your plan to auto-renew.
Select Review + subscribe.
Review the product and plan details, then select Subscribe.
The SaaS subscription is in progress and will display a successful subscribed message when complete.
🔑 Configure your Azure account
In the Azure portal, select Configure your account.
You're redirected to the OpenVPN website.
On the OpenVPN site, the Link Your Azure Account to OpenVPN sign-in page appears.
Enter your OpenVPN account email and password, then select Sign In.
Enter your account details and select Confirm.
The page Deploy on Azure marketplace using our Azure Launcher displays.
Select Azure SaaS Subscriptions in the side navigation.
Your Azure SaaS subscription details display.
🖥️ Gather Admin Web UI info from virtual machine output
From the Azure deployment, select Outputs.
The URL for the Admin Web UI is displayed in the adminPortal field, along with the temporary password.
Open your web browser and navigate to the Admin Web UI using the provided IP address, such as:
https://<public_ip_of_instance>/admin
Note
During deployment, Let's Encrypt is enabled by default for the public IP address. If you don't enable Let's Encrypt, or certificate issuance isn't successful, Access Server uses its self-signed certificate. Your browser may display a certificate warning when you open the web interface.
Enter the admin username, openvpn, and your temporary password displayed in the output.
Once signed in, we recommend changing the password for the openvpn user account in the Admin Web UI.
🛠️ Finish Access Server configuration
We suggest some of these next steps for finishing setup:
We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: vpn.example.com. This provides an easier user experience than remembering the server's IP address.
Refer to Hostname and follow the steps.
Access Server supports using multiple authentication methods for VPN users.
Sign in to the Admin Web UI.
Navigate to Authentication.
Configure the authentication method appropriate for your organization.
Access Server supports:
Local authentication.
PAM.
RADIUS.
LDAP.
SAML.
Access Server can also use multiple authentication systems simultaneously.
Refer to Authentication System for more information.
With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.
Connection method | Procedure |
|---|---|
Download OpenVPN Connect from the Client Web UI |
|
Download a connection profile |
|
Admin distributes connection profiles or installers | Alternatively, as an admin, you can use these ways to connect your users:
|
Tip
Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure split-tunnel traffic, their IP address remains the same for internet traffic.
In order for your instance to function properly if you use Routing as your mode of operation inside Access Server instead of NAT, ensure you turn on IP forwarding:
From the Azure portal, enter network interfaces in the search box at the top.
Select Network interfaces from the search results.
Select the network interface of your Access Server virtual machine.
Select IP configurations.
Select the toggle to Enable IP forwarding.
Select Save.
The network interface change saves.
Note your private IP address here, as you will need it to create and assign a routing table, as explained below.
When you use Routing for your Access Server instead of NAT, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance.
Create a route table
Select Create a resource from your Azure portal.
Search for "route table".
Select the Route table from Microsoft when prompted and select Create.
Select the Resource group with your VPN server.
Enter a name for the routing table (choose any you would like).
Select Review + Create then Create.
Attach the route table to your VM
Navigate to your Access Server virtual machine's dashboard.
Under Networking and Virtual network/subnet select the Vnet for your VM.
Under Settings, select Subnets.
Select the subnet used by your computing resources (may be called default).
Select the Route table drop-down, and select your newly created routing table from the list.
Select Save.
Repeat this step for any additional subnets you may have under the same Vnet that the VPN server needs to communicate with.
Add routes
Now that the routing table is assigned, you need to add routes:
Navigate to your new routing table.
Under Settings of your route table, select Routes.
Select Add.
On the Add route page, enter a name, then the following:
Address Prefix: 172.27.224.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.
Select Add again to add a second record:
Address Prefix: 172.27.240.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.
You've completed the routing table configuration.
Note
The 172.x.x.x IP addresses above are private IP addresses used by Access Server as the internal DHCP system.
Important
If you change your VPN subnets using the Admin Web UI, ensure you edit your routing table configuration as well.