Subscribe to Access Server on Microsoft Azure — Pay As You Go⁠

Deploy OpenVPN Access Server as an Azure VPN that you can get up and running within minutes.

From the Azure Marketplace, you can launch Access Server. This VPN, hosted in the cloud, has the following benefits.

Quickly extend your virtual private cloud networking to remote users and other sites.
Create hub-and-spoke network topology, site-to-site, user-to-cloud, and various other secure VPN connections.
Provide secure, remote access to applications deployed on your cloud platform.

📄 Deploy Access Server on Microsoft Azure⁠

This guide covers the SaaS Contract (Pay As You Go) option from Azure Marketplace.

Create an OpenVPN account.
Important
This option requires a new Access Server Hub account.
Under Installation, select Azure.
Under Azure Deployment Options, click the Azure Marketplace Options tab.
Select Buy with Azure to launch the SaaS Contract option.
Sign in with your Microsoft account.
Select your Plan from the drop-down based on desired connections.
Select Subscribe.

Enter your Project details:

Subscription	This auto populates.
Resource group	Select your group from the drop-down to assign this new image.
Name	Enter a name for your SaaS subscription.
Contract duration	Select between monthly and yearly.
Auto-renew	Select whether to set your plan to auto-renew.

Select Review + subscribe.
Review the product and plan details, then select Subscribe.
- The SaaS subscription is in progress and will display a successful subscribed message when complete.

🔑 Configure your Azure account⁠

In the Azure portal, select Configure your account.
- You're redirected to the OpenVPN website.
On the OpenVPN site, the Link Your Azure Account to OpenVPN sign-in page appears.
Enter your OpenVPN account email and password, then select Sign In.
Enter your account details and select Confirm.
- The page Deploy on Azure marketplace using our Azure Launcher displays.
Select Azure SaaS Subscriptions in the side navigation.
- Your Azure SaaS subscription details display.

🖥️ Gather Admin Web UI info from virtual machine output⁠

From the Azure deployment, select Outputs.
- The URL for the Admin Web UI is displayed in the adminPortal field, along with the temporary password.
Open your web browser and navigate to the Admin Web UI using the provided IP address, such as:
1. https://<public_ip_of_instance>/admin
Note
During deployment, Let's Encrypt is enabled by default for the public IP address. If you don't enable Let's Encrypt, or certificate issuance isn't successful, Access Server uses its self-signed certificate. Your browser may display a certificate warning when you open the web interface.
Enter the admin username, openvpn, and your temporary password displayed in the output.
Once signed in, we recommend changing the password for the openvpn user account in the Admin Web UI.

🛠️ Finish Access Server configuration⁠

We suggest some of these next steps for finishing setup:

With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.

Connection method	Procedure
Download OpenVPN Connect from the Client Web UI	Navigate to the Client Web UI in a browser. Sign in with user credentials. Download the OpenVPN Connect installer offered for the user's operating system. After it downloads, install the software. Open the app and select the connection profile. The user connects to Access Server.
Download a connection profile	Navigate to the Client Web UI in a browser. Sign in with their user credentials. Select the link under Available Connection Profiles. After the connection profile downloads, upload the file to a VPN client.
Admin distributes connection profiles or installers	Alternatively, as an admin, you can use these ways to connect your users: Have your users install OpenVPN Connect from our website, then download a connection profile from the Admin Web UI and distribute it to users. Create an OpenVPN Connect installer from the Access Server command-line interface and distribute it to users.

Connection method

Procedure

Download OpenVPN Connect from the Client Web UI

Navigate to the Client Web UI in a browser.
Sign in with user credentials.
Download the OpenVPN Connect installer offered for the user's operating system.
After it downloads, install the software.
Open the app and select the connection profile.
- The user connects to Access Server.

Download a connection profile

Navigate to the Client Web UI in a browser.
Sign in with their user credentials.
Select the link under Available Connection Profiles.
After the connection profile downloads, upload the file to a VPN client.

Admin distributes connection profiles or installers

Alternatively, as an admin, you can use these ways to connect your users:

Have your users install OpenVPN Connect from our website, then download a connection profile from the Admin Web UI and distribute it to users.
Create an OpenVPN Connect installer from the Access Server command-line interface and distribute it to users.

In order for your instance to function properly if you use Routing as your mode of operation inside Access Server instead of NAT, ensure you turn on IP forwarding:

From the Azure portal, enter network interfaces in the search box at the top.
Select Network interfaces from the search results.
Select the network interface of your Access Server virtual machine.
Select IP configurations.
Select the toggle to Enable IP forwarding.
Select Save.
The network interface change saves.

Note your private IP address here, as you will need it to create and assign a routing table, as explained below.

When you use Routing for your Access Server instead of NAT, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance.

Create a route table⁠

Select Create a resource from your Azure portal.
Search for "route table".
Select the Route table from Microsoft when prompted and select Create.
Select the Resource group with your VPN server.
Enter a name for the routing table (choose any you would like).
Select Review + Create then Create.

Attach the route table to your VM⁠

Navigate to your Access Server virtual machine's dashboard.
Under Networking and Virtual network/subnet select the Vnet for your VM.
Under Settings, select Subnets.
Select the subnet used by your computing resources (may be called default).
Select the Route table drop-down, and select your newly created routing table from the list.
Select Save.
Repeat this step for any additional subnets you may have under the same Vnet that the VPN server needs to communicate with.

Add routes⁠

Now that the routing table is assigned, you need to add routes:

Navigate to your new routing table.
Under Settings of your route table, select Routes.
Select Add.
On the Add route page, enter a name, then the following:
Address Prefix: 172.27.224.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.
Select Add again to add a second record:
Address Prefix: 172.27.240.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.

You've completed the routing table configuration.

Additional Security Steps You Can Take After Installation⁠

We recommend you follow the tutorials below to improve your Access Server security after installation.

Increase security with these tutorials:

Tutorial: How to Secure the Root User Account on a Virtual Appliance — This tutorial applies to ESXi or Hyper-V appliances.
Tutorial: Keep Access Server Updated — We recommend that everyone runs the latest Access Server version.
Tutorial: How to Replace the Legacy openvpn Administrative Account — This tutorial is for sysadmins upgrading from an older Access Server version.
Tutorial: How to Change the Password for Your New Administrative Account — This tutorial is for new installations with a temporary password.
Tutorial: How to Install a Valid Web SSL Certificate in Access Server — We recommend that everyone add a valid SSL certificate from a trusted CA.
Tutorial: Harden the Web Server Cipher Suite String — This is a security step where you can update the cipher suite string if you want.
Tutorial: How to Isolate Access Server's Web Services — This tutorial covers a narrow use case where you don't want the web UIs accessible online.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Subscribe to Access Server on Microsoft Azure — Pay As You Go⁠

📄 Deploy Access Server on Microsoft Azure⁠

🔑 Configure your Azure account⁠

🖥️ Gather Admin Web UI info from virtual machine output⁠

🛠️ Finish Access Server configuration⁠

Was this information helpful?