--- title: Azure Marketplace Quick Start Guide for Access Server (Tiered/Fixed Connection Licensing) canonical: https://openvpn.net/as-docs/v3/azure-tiered/ product: Access Server Docs description: Deploy OpenVPN Access Server from the Azure Marketplace Tiered listing — choose a connection tier, enable a Let’s Encrypt certificate for the public IP, and finish setup with the onboarding wizard --- # Azure Marketplace Quick Start Guide for Access Server (Tiered/Fixed Connection Licensing) ## Overview OpenVPN Access Server is available in Microsoft Azure Marketplace with **Tiered fixed connection licensing**. Choose a predefined **Connection tier** from 5 to 750 simultaneous VPN connections, deploy Access Server in your own Azure virtual machine (VM), and have Microsoft Azure handle both the Access Server software subscription and Azure infrastructure billing. This guide walks you through deploying the **OpenVPN Access Server (Tiered) / Self-Hosted VPN & ZTNA** listing from Azure Marketplace. With the [Azure Tiered deployment](https://marketplace.microsoft.com/en-us/product/openvpn.openvpn-as-app-tiered), you can: - Deploy Access Server without manually installing the software. - Choose a predefined connection tier. - Configure the Azure VM and networking for your environment. - Request a Let’s Encrypt certificate for the public IP address during deployment. - Set or retrieve credentials for the `openvpn` administrative account. - Complete first-time Access Server configuration with the onboarding wizard. - Optionally connect to the VM with SSH for administration or troubleshooting. For sizing and performance guidance, refer to [System Requirements](https://openvpn.net/as-docs/v3/system-requirements.md). For an overview of the available Azure deployment and licensing models, refer to [Azure licensing](https://openvpn.net/as-docs/v3/azure-deploy.md). ## Choose between Azure Tiered, PAYG, and BYOL Azure Marketplace provides different Access Server licensing options. Choose the one that fits how you want to purchase and manage VPN connections. | Licensing option | Access Server billing | Best fit | | --- | --- | --- | | **Tiered** | Microsoft Azure | You want a predefined, fixed connection tier billed through Azure. | | **PAYG** | Microsoft Azure | You want Azure-managed billing with more flexibility to change the number of connections later. | | **BYOL** | OpenVPN | You want to purchase and manage an Access Server Subscription directly through OpenVPN. | This guide covers the **Tiered** deployment. For PAYG, refer to the [Azure PAYG guide](https://openvpn.net/as-docs/v3/azure-payg.md). For BYOL, refer to the [Azure BYOL guide](https://openvpn.net/as-docs/v3/azure.md). ## About Tiered subscriptions With an Azure Tiered instance, you purchase a predefined number of simultaneous VPN connections through Microsoft Azure Marketplace. The selected **Connection tier** is tied to the Azure Marketplace subscription. You don't need to purchase or activate a separate OpenVPN subscription or license activation key. Azure bills both the Access Server software subscription and the Azure infrastructure charges through your Azure account. ### Available connection tiers Choose the tier that supports the number of simultaneous VPN connections your deployment requires. | Connection tier | Connection tier | Connection tier | | --- | --- | --- | | 5 connections | 45 connections | 200 connections | | 10 connections | 50 connections | 250 connections | | 15 connections | 60 connections | 300 connections | | 20 connections | 70 connections | 350 connections | | 25 connections | 80 connections | 400 connections | | 30 connections | 100 connections | 500 connections | | 35 connections | 125 connections | 750 connections | | 40 connections | 150 connections | \[empty\] | > **Important** > > Azure Tiered uses fixed connection licensing. If you later need a different connection count, we recommend migrating to a new licensing model rather than changing the tier on the existing instance. See [Migrate Azure Tiered](https://openvpn.net/as-docs/v3/tutorials/tutorial--migrate-azure-tiered-to-payg-or-subscription.md) for the tutorial steps to move to Azure PAYG or an Access Server subscription. ## 🚀 Step 1: Launch Access Server from Azure Marketplace Deploy the Tiered Access Server VM and choose the connection limit and initial configuration options. 1. Open the **[OpenVPN Access Server (Tiered) / Self-Hosted VPN & ZTNA](https://marketplace.microsoft.com/en-us/product/openvpn.openvpn-as-app-tiered)** listing. 2. Sign in to your Microsoft Azure account if prompted. 3. Select **Create**. 4. On the **Basics** tab, configure the deployment: | Setting | Description | | --- | --- | | **Resource group** | Select an existing resource group or create a new one. | | **Region** | Select the Azure region where you want to deploy Access Server. | | **Virtual machine name** | Enter a name for the Access Server VM. | | **Connection tier** | Select the number of simultaneous VPN connections for this deployment. | | **VM architecture** | Select the architecture appropriate for your deployment. | | **Virtual machine size** | Select an available VM size that meets your capacity and performance requirements. | | **OS Disk Type** | Select the disk type. | | **OS Disk Size** | Select the disk size. | | **Let's Encrypt Certificate for Public IP** | Enabled by default to request a Let’s Encrypt certificate for the VM's public IP address. | | **Admin Web UI password (optional)** | Enter a password for the `openvpn` administrative account. Leave it empty to use a generated temporary password. | | **Confirm Admin Web UI password** | Confirm the administrative password, if you entered one. | | **Admin Username** | Enter the administrative username used for SSH access. | | **SSH public key source** | Select an existing key, use an existing public key, or create a new key pair. | | **SSH public key** | Complete the SSH key configuration for the option you selected. | > **Note** > > Azure VM size availability depends on your subscription, region, quota, and current Azure capacity. If your preferred size isn't available, select another suitable VM size or region. Refer to [System Requirements](https://openvpn.net/as-docs/v3/system-requirements.md) when choosing the VM size. 5. For this quick start, leave the remaining settings at their defaults. 6. Select **Review + create**. 7. Review the deployment settings. 8. Select **Create**. 9. Wait for Azure to deploy the required resources, including the VM, network interface, public IP address, and network security group. - Access Server starts automatically as part of the deployment. You don't need to connect with SSH to initialize or start Access Server. ## 🖥️ Step 2: Get the Admin Web UI URL and password Azure provides the Admin Web UI URL and, when applicable, the generated temporary password in the deployment outputs. 1. Open the completed Azure deployment. 2. Select **Outputs**. 3. Locate the `adminWebUI` output. The `adminWebUI` field provides the Admin Web UI URL. The `initialAdminCredential` field provides the temporary password if you left **Admin Web UI password (optional)** empty during deployment. 1. Copy the Admin Web UI URL. For example: ``` https:///admin ``` 2. If you used the automatically generated password, record it for the first Admin Web UI session. > **Note** > > If **Let's Encrypt Certificate for Public IP** was enabled, and certificate issuance succeeds, Access Server uses a browser-trusted **IP address certificate** for its public IP. > > If you don't enable the option, or certificate issuance doesn't succeed, Access Server falls back to its self-signed web certificate. Your browser displays a certificate warning when you open the Admin Web UI. Refer to [SSL Certificates](https://openvpn.net/as-docs/v3/ssl-certificates.md) for more information. ## 🔑 Step 3: Sign in to the Admin Web UI Sign in to Access Server and accept the End User License Agreement (EULA). 1. Open the Admin Web UI URL from the `adminWebUI` output. 2. If Access Server is using its self-signed certificate, continue through the expected browser certificate warning. 3. Enter `openvpn` as the administrative username. 4. Enter either: - The password you configured during Azure deployment. - The temporary password from `initialAdminCredential`. 5. Sign in. 6. Review the Access Server EULA. 7. Select **Agree**. Because Azure Tiered is licensed through the Azure Marketplace subscription, there's no separate Access Server subscription activation step. The onboarding wizard displays for a fresh Access Server installation. ## 🚀 Step 4: Complete the onboarding wizard Use the **onboarding wizard** to configure initial VPN access and test your first connection. 1. Select whether VPN clients should have: - Internet access through Access Server. - Access to private resources in your Azure virtual network. - Both, if appropriate for your deployment. 2. If you enable private-resource access, review the detected network CIDRs. 3. Verify that the detected networks match the Azure networks VPN users should access. 4. Keep only the networks VPN users should be allowed to access. 5. Select **Continue**. 6. Review the OpenVPN Connect download the wizard offers. The wizard provides the installer appropriate for the operating system you're currently using. 7. Select **Download**. 8. Install the OpenVPN Connect app. 9. Return to the onboarding wizard. 10. Select **Continue**. The wizard waits for a VPN connection. 1. Launch the OpenVPN Connect app. 2. Connect using the connection profile provided during onboarding. 3. Confirm that the VPN connection succeeds. 4. Return to the Admin Web UI. 5. Select **Finish Wizard**. You can also close the onboarding wizard if you prefer to complete these tasks later. After you finish the wizard, Access Server can display an Admin Web UI tour introducing: - The Client Web UI. - Users. - Access Controls. - Authentication. - Activation. For more information, refer to the [onboarding wizard tutorial](https://openvpn.net/as-docs/v3/tutorials/tutorial--onboarding-wizard.md). ## 🖥️ Optional: Connect to the Azure VM with SSH You don't need SSH access to initialize Access Server for this Tiered deployment. Connect to the VM when you need operating-system access for administration or troubleshooting. 1. Locate the VM's public IP address in Azure. 2. Open a terminal. 3. Connect using the SSH username and authentication method you configured during deployment: ``` ssh @ ``` 4. Authenticate with your SSH key. For Windows SSH instructions using PuTTY, refer to [Connect with PuTTY](https://openvpn.net/as-docs/v3/tutorials/tutorial--connect-with-putty.md). ## 🛠️ Finish Access Server configuration ### 🌍 Setting up a hostname We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: `vpn.example.com`. This provides an easier user experience than remembering the server's IP address. Refer to [Hostname](https://openvpn.net/as-docs/v3/hostname.md) and follow the steps. ### 🔑 Setting up authentication Access Server supports using multiple authentication methods for VPN users. 1. Sign in to the Admin Web UI. 2. Navigate to **Authentication**. 3. Configure the authentication method appropriate for your organization. Access Server supports: - Local authentication. - PAM. - RADIUS. - LDAP. - SAML. Access Server can also use multiple authentication systems simultaneously. Refer to [Authentication System](https://openvpn.net/as-docs/v3/user-authentication-system.md) for more information. ### 👥 Connect users to Access Server With your VPN server configured, your [users can get connected](https://openvpn.net/as-docs/v3/connecting-260793.md). Choose one of the options below to connect to the server. | Connection method | Procedure | | --- | --- | | Download OpenVPN Connect from the Client Web UI | Navigate to the Client Web UI in a browser. Sign in with user credentials. Download the OpenVPN Connect installer offered for the user's operating system. After it downloads, install the software. Open the app and select the connection profile. The user connects to Access Server. | | Download a connection profile | Navigate to the Client Web UI in a browser. Sign in with their user credentials. Select the link under **Available Connection Profiles**. After the connection profile downloads, upload the file to a VPN client. | | Admin distributes connection profiles or installers | Alternatively, as an admin, you can use these ways to connect your users: Have your users install [OpenVPN Connect](https://openvpn.net/vpn-client/) from our website, then [download a connection profile](https://openvpn.net/as-docs/v3/connection-profiles/#connection-profile-types) from the Admin Web UI and distribute it to users. [Create an OpenVPN Connect installer from the Access Server command-line](https://openvpn.net/as-docs/v3/tutorials/tutorial--create-connection-profiles/#option-1--create-connection-profiles-using-the-cli) interface and distribute it to users. | > **Tip** > > Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure [split-tunnel traffic](https://blog.openvpn.net/split-tunneling-with-access-server), their IP address remains the same for internet traffic. ### 🔀 Enable IP forwarding (required for use with routing) You need **IP forwarding** when Access Server uses routing rather than NAT to provide access to private Azure networks. If you use NAT and don't require routed return traffic through the Access Server VM, skip this section. To enable IP forwarding: 1. In the Azure portal, search for `network interfaces`. 2. Select **Network interfaces**. 3. Select the network interface attached to the Access Server VM. 4. Select **IP configurations**. 5. Select the toggle to **Enable** IP forwarding. 6. Select **Save**. 7. Record the VM's private IP address. - You'll use the private IP as the next hop when you configure the Azure route table. ### 🔁 Create and assign a routing table (required for use with routing) When you use **Routing** for your Access Server instead of **NAT**, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance. #### Create a route table 1. In the Azure portal, select **Create a resource**. 2. Search for `route table`. 3. Select the Microsoft **Route table** resource. 4. Select **Create**. 5. Select the resource group containing your Access Server deployment. 6. Enter a name for the route table. 7. Select **Review + Create**. 8. Review the settings. 9. Select **Create**. #### Associate the route table with the subnet 1. Navigate to the Access Server VM. 2. Open its virtual network. 3. Under **Settings**, select **Subnets**. 4. Select the subnet used by your computing resources (may be called **default**). 5. For **Route table**, select the route table you created. 6. Select **Save**. 7. Repeat the procedure for other applicable subnets in the virtual network. #### Add the VPN client routes Add routes for the default Access Server VPN client subnets. 1. Open the route table. 2. Under **Settings**, select **Routes**. 3. Select **Add**. 4. Configure the first route: | Setting | Value | | --- | --- | | **Address Prefix** | `172.27.224.0/20` | | **Next hop type** | **Virtual appliance** | | **Next hop address** | The private IP address of the Access Server VM | 5. Save the route. 6. Select **Add** again. 7. Configure the second route: | Setting | Value | | --- | --- | | **Address Prefix** | `172.27.240.0/20` | | **Next hop type** | **Virtual appliance** | | **Next hop address** | The private IP address of the Access Server VM | 8. Save the route. - Traffic destined for the default Access Server VPN client networks can now use the Access Server VM as the **Virtual appliance** next hop. > **Important** > > `172.27.224.0/20` and `172.27.240.0/20` are the default Access Server VPN client subnets used by this configuration. > > If you change the VPN subnets in the Admin Web UI, update the Azure route table to match. ### 🛡️ Further Security Recommendations #### Additional Security Steps You Can Take After Installation We recommend you follow the tutorials below to improve your Access Server security after installation. > **Note** > > Not every tutorial will apply to your installation. Follow the ones that do. **Increase security with these tutorials:** - [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — We recommend that everyone runs the latest Access Server version. - [Tutorial: How to Replace the Legacy openvpn Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--replace-legacy-openvpn-account.md) — This tutorial is for sysadmins upgrading from an older Access Server version. - [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — This tutorial is for new installations with a temporary password. - [Tutorial: How to Install a Valid Web SSL Certificate in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--install-ssl-certificate.md) — We recommend that everyone add a valid SSL certificate from a trusted CA. - [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — This is a security step where you can update the cipher suite string if you want. - [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — This tutorial covers a narrow use case where you don't want the web UIs accessible online. - [Tutorial: How to Secure the Root User Account on a Virtual Appliance](https://openvpn.net/as-docs/v3/tutorials/tutorial--secure-root-user.md) — This tutorial applies to ESXi or Hyper-V appliances. ## ⚙️ Troubleshooting ### Only two connections An Azure Tiered deployment should use the number of connections associated with the **Connection tier** selected in Azure Marketplace. If the Admin Web UI shows only two connections, the Azure Tiered license hasn't been applied as expected. Refer to the Azure Tiered licensing troubleshooting topic for steps to diagnose the Marketplace licensing connection. ## Related resources - [Azure licensing](https://openvpn.net/as-docs/v3/azure-deploy.md) - [Azure PAYG](https://openvpn.net/as-docs/v3/azure-payg.md) - [Azure BYOL](https://openvpn.net/as-docs/v3/azure.md) - [Azure ARM template](https://openvpn.net/as-docs/v3/azure-arm.md) - [Azure Tiered migration](https://openvpn.net/as-docs/v3/tutorials/tutorial--migrate-azure-tiered-to-payg-or-subscription.md) - [Installation overview](https://openvpn.net/as-docs/v3/installation-overview.md) - [AWS Tiered](https://openvpn.net/as-docs/v3/aws-tiered.md) --- Prev: [Azure ARM](https://openvpn.net/as-docs/v3/azure-arm.md) Next: [Oracle Cloud](https://openvpn.net/as-docs/v3/oracle.md) Index: https://openvpn.net/as-docs/llms.txt