--- title: Subscribe to Access Server on Microsoft Azure — Pay As You Go canonical: https://openvpn.net/as-docs/v3/azure-payg/ product: Access Server Docs description: Create an Access Server VPN server with Microsoft Azure, where you pay as you go. This quick start guide helps you launch the PAYG offering. --- # Subscribe to Access Server on Microsoft Azure — Pay As You Go Deploy OpenVPN Access Server as an [Azure VPN](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/openvpn.openvpn-as-saas) that you can get up and running within minutes. From the Azure Marketplace, you can launch Access Server. This VPN, hosted in the cloud, has the following benefits. - Quickly extend your virtual private cloud networking to remote users and other sites. - Create hub-and-spoke network topology, site-to-site, user-to-cloud, and various other secure VPN connections. - Provide secure, remote access to applications deployed on your cloud platform. > **Tip** > > Refer to the [system requirements](https://openvpn.net/as-docs/v3/system-requirements.md) to ensure your system works with Access Server. ## 📄 Deploy Access Server on Microsoft Azure This guide covers the **SaaS Contract (Pay As You Go)** option from Azure Marketplace. 1. [Create an OpenVPN account](https://as-portal.openvpn.com/). > **Important** > > This option requires a new Access Server Hub account. 2. Under **Installation**, select **Azure**. 3. Under **Azure Deployment Options**, click the **Azure Marketplace Options** tab. 4. Select **Buy with Azure** to launch the SaaS Contract option. 5. Sign in with your Microsoft account. 6. Select your **Plan** from the drop-down based on desired connections. 7. Select **Subscribe**. 8. Enter your **Project details**: | | | | --- | --- | | **Subscription** | This auto populates. | | **Resource group** | Select your group from the drop-down to assign this new image. | | **Name** | Enter a name for your SaaS subscription. | | **Contract duration** | Select between monthly and yearly. | | **Auto-renew** | Select whether to set your plan to auto-renew. | 9. Select **Review + subscribe**. 10. Review the product and plan details, then select **Subscribe**. - The SaaS subscription is in progress and will display a successful **subscribed** message when complete. ## 🔑 Configure your Azure account 1. In the Azure portal, select **Configure your account**. - You're redirected to the OpenVPN website. 2. On the OpenVPN site, the **Link Your Azure Account to OpenVPN** sign-in page appears. 3. Enter your OpenVPN account email and password, then select **Sign In**. 4. Enter your account details and select **Confirm**. - The page **Deploy on Azure marketplace using our Azure Launcher** displays. 5. Select **Azure SaaS Subscriptions** in the side navigation. - Your Azure SaaS subscription details display. ## 🖥️ Gather Admin Web UI info from virtual machine output 1. From the Azure deployment, select **Outputs**. - The URL for the Admin Web UI is displayed in the **adminPortal** field, along with the temporary password. 2. Open your web browser and navigate to the Admin Web UI using the provided IP address, such as: 1. https://\/admin > **Note** > > During deployment, Let's Encrypt is enabled by default for the public IP address. If you don't enable Let's Encrypt, or certificate issuance isn't successful, Access Server uses its self-signed certificate. Your browser may display a certificate warning when you open the web interface. 3. Enter the admin username, **openvpn**, and your temporary password displayed in the output. 4. Once signed in, we recommend changing the password for the **openvpn** user account in the Admin Web UI. ## 🛠️ Finish Access Server configuration We suggest some of these next steps for finishing setup: ### 🌍 Setting up a hostname We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: `vpn.example.com`. This provides an easier user experience than remembering the server's IP address. Refer to [Hostname](https://openvpn.net/as-docs/v3/hostname.md) and follow the steps. ### 🔑 Setting up authentication Access Server supports using multiple authentication methods for VPN users. 1. Sign in to the Admin Web UI. 2. Navigate to **Authentication**. 3. Configure the authentication method appropriate for your organization. Access Server supports: - Local authentication. - PAM. - RADIUS. - LDAP. - SAML. Access Server can also use multiple authentication systems simultaneously. Refer to [Authentication System](https://openvpn.net/as-docs/v3/user-authentication-system.md) for more information. ### 👥 Connect users to Access Server With your VPN server configured, your [users can get connected](https://openvpn.net/as-docs/v3/connecting-260793.md). Choose one of the options below to connect to the server. | Connection method | Procedure | | --- | --- | | Download OpenVPN Connect from the Client Web UI | Navigate to the Client Web UI in a browser. Sign in with user credentials. Download the OpenVPN Connect installer offered for the user's operating system. After it downloads, install the software. Open the app and select the connection profile. The user connects to Access Server. | | Download a connection profile | Navigate to the Client Web UI in a browser. Sign in with their user credentials. Select the link under **Available Connection Profiles**. After the connection profile downloads, upload the file to a VPN client. | | Admin distributes connection profiles or installers | Alternatively, as an admin, you can use these ways to connect your users: Have your users install [OpenVPN Connect](https://openvpn.net/vpn-client/) from our website, then [download a connection profile](https://openvpn.net/as-docs/v3/connection-profiles/#connection-profile-types) from the Admin Web UI and distribute it to users. [Create an OpenVPN Connect installer from the Access Server command-line](https://openvpn.net/as-docs/v3/tutorials/tutorial--create-connection-profiles/#option-1--create-connection-profiles-using-the-cli) interface and distribute it to users. | > **Tip** > > Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure [split-tunnel traffic](https://blog.openvpn.net/split-tunneling-with-access-server), their IP address remains the same for internet traffic. ### 🔀 Enable IP forwarding (required for use with routing) You need **IP forwarding** when Access Server uses routing rather than NAT to provide access to private Azure networks. If you use NAT and don't require routed return traffic through the Access Server VM, skip this section. To enable IP forwarding: 1. In the Azure portal, search for `network interfaces`. 2. Select **Network interfaces**. 3. Select the network interface attached to the Access Server VM. 4. Select **IP configurations**. 5. Select the toggle to **Enable** IP forwarding. 6. Select **Save**. 7. Record the VM's private IP address. - You'll use the private IP as the next hop when you configure the Azure route table. ### 🔁 Create and assign a routing table (required for use with routing) When you use **Routing** for your Access Server instead of **NAT**, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance. #### Create a route table 1. In the Azure portal, select **Create a resource**. 2. Search for `route table`. 3. Select the Microsoft **Route table** resource. 4. Select **Create**. 5. Select the resource group containing your Access Server deployment. 6. Enter a name for the route table. 7. Select **Review + Create**. 8. Review the settings. 9. Select **Create**. #### Associate the route table with the subnet 1. Navigate to the Access Server VM. 2. Open its virtual network. 3. Under **Settings**, select **Subnets**. 4. Select the subnet used by your computing resources (may be called **default**). 5. For **Route table**, select the route table you created. 6. Select **Save**. 7. Repeat the procedure for other applicable subnets in the virtual network. #### Add the VPN client routes Add routes for the default Access Server VPN client subnets. 1. Open the route table. 2. Under **Settings**, select **Routes**. 3. Select **Add**. 4. Configure the first route: | Setting | Value | | --- | --- | | **Address Prefix** | `172.27.224.0/20` | | **Next hop type** | **Virtual appliance** | | **Next hop address** | The private IP address of the Access Server VM | 5. Save the route. 6. Select **Add** again. 7. Configure the second route: | Setting | Value | | --- | --- | | **Address Prefix** | `172.27.240.0/20` | | **Next hop type** | **Virtual appliance** | | **Next hop address** | The private IP address of the Access Server VM | 8. Save the route. - Traffic destined for the default Access Server VPN client networks can now use the Access Server VM as the **Virtual appliance** next hop. > **Important** > > `172.27.224.0/20` and `172.27.240.0/20` are the default Access Server VPN client subnets used by this configuration. > > If you change the VPN subnets in the Admin Web UI, update the Azure route table to match. ### 🛡️ Further Security Recommendations #### Additional Security Steps You Can Take After Installation We recommend you follow the tutorials below to improve your Access Server security after installation. > **Note** > > Not every tutorial will apply to your installation. Follow the ones that do. **Increase security with these tutorials:** - [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — We recommend that everyone runs the latest Access Server version. - [Tutorial: How to Replace the Legacy openvpn Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--replace-legacy-openvpn-account.md) — This tutorial is for sysadmins upgrading from an older Access Server version. - [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — This tutorial is for new installations with a temporary password. - [Tutorial: How to Install a Valid Web SSL Certificate in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--install-ssl-certificate.md) — We recommend that everyone add a valid SSL certificate from a trusted CA. - [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — This is a security step where you can update the cipher suite string if you want. - [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — This tutorial covers a narrow use case where you don't want the web UIs accessible online. - [Tutorial: How to Secure the Root User Account on a Virtual Appliance](https://openvpn.net/as-docs/v3/tutorials/tutorial--secure-root-user.md) — This tutorial applies to ESXi or Hyper-V appliances. --- Prev: [Azure BYOL](https://openvpn.net/as-docs/v3/azure.md) Next: [Azure ARM](https://openvpn.net/as-docs/v3/azure-arm.md) Index: https://openvpn.net/as-docs/llms.txt