Azure Marketplace Quick Start Guide for Access Server (Tiered/Fixed Connection Licensing)⁠

Overview⁠

OpenVPN Access Server is available in Microsoft Azure Marketplace with Tiered fixed connection licensing. Choose a predefined Connection tier from 5 to 750 simultaneous VPN connections, deploy Access Server in your own Azure virtual machine (VM), and have Microsoft Azure handle both the Access Server software subscription and Azure infrastructure billing.

This guide walks you through deploying the OpenVPN Access Server (Tiered) / Self-Hosted VPN & ZTNA listing from Azure Marketplace.

With the Azure Tiered deployment, you can:

Deploy Access Server without manually installing the software.
Choose a predefined connection tier.
Configure the Azure VM and networking for your environment.
Request a Let’s Encrypt certificate for the public IP address during deployment.
Set or retrieve credentials for the openvpn administrative account.
Complete first-time Access Server configuration with the onboarding wizard.
Optionally connect to the VM with SSH for administration or troubleshooting.

For sizing and performance guidance, refer to System Requirements.

For an overview of the available Azure deployment and licensing models, refer to Azure licensing.

Choose between Azure Tiered, PAYG, and BYOL⁠

Azure Marketplace provides different Access Server licensing options. Choose the one that fits how you want to purchase and manage VPN connections.

Licensing option	Access Server billing	Best fit
Tiered	Microsoft Azure	You want a predefined, fixed connection tier billed through Azure.
PAYG	Microsoft Azure	You want Azure-managed billing with more flexibility to change the number of connections later.
BYOL	OpenVPN	You want to purchase and manage an Access Server Subscription directly through OpenVPN.

This guide covers the Tiered deployment.

For PAYG, refer to the Azure PAYG guide.

For BYOL, refer to the Azure BYOL guide.

About Tiered subscriptions⁠

With an Azure Tiered instance, you purchase a predefined number of simultaneous VPN connections through Microsoft Azure Marketplace.

The selected Connection tier is tied to the Azure Marketplace subscription. You don't need to purchase or activate a separate OpenVPN subscription or license activation key.

Azure bills both the Access Server software subscription and the Azure infrastructure charges through your Azure account.

Available connection tiers⁠

Choose the tier that supports the number of simultaneous VPN connections your deployment requires.

Connection tier	Connection tier	Connection tier
5 connections	45 connections	200 connections
10 connections	50 connections	250 connections
15 connections	60 connections	300 connections
20 connections	70 connections	350 connections
25 connections	80 connections	400 connections
30 connections	100 connections	500 connections
35 connections	125 connections	750 connections
40 connections	150 connections	[empty]

🚀 Step 1: Launch Access Server from Azure Marketplace⁠

Deploy the Tiered Access Server VM and choose the connection limit and initial configuration options.

Open the OpenVPN Access Server (Tiered) / Self-Hosted VPN & ZTNA listing.
Sign in to your Microsoft Azure account if prompted.
Select Create.

On the Basics tab, configure the deployment:

Setting	Description
Resource group	Select an existing resource group or create a new one.
Region	Select the Azure region where you want to deploy Access Server.
Virtual machine name	Enter a name for the Access Server VM.
Connection tier	Select the number of simultaneous VPN connections for this deployment.
VM architecture	Select the architecture appropriate for your deployment.
Virtual machine size	Select an available VM size that meets your capacity and performance requirements.
OS Disk Type	Select the disk type.
OS Disk Size	Select the disk size.
Let's Encrypt Certificate for Public IP	Enabled by default to request a Let’s Encrypt certificate for the VM's public IP address.
Admin Web UI password (optional)	Enter a password for the `openvpn` administrative account. Leave it empty to use a generated temporary password.
Confirm Admin Web UI password	Confirm the administrative password, if you entered one.
Admin Username	Enter the administrative username used for SSH access.
SSH public key source	Select an existing key, use an existing public key, or create a new key pair.
SSH public key	Complete the SSH key configuration for the option you selected.

For this quick start, leave the remaining settings at their defaults.
Select Review + create.
Review the deployment settings.
Select Create.
Wait for Azure to deploy the required resources, including the VM, network interface, public IP address, and network security group.
- Access Server starts automatically as part of the deployment. You don't need to connect with SSH to initialize or start Access Server.

🖥️ Step 2: Get the Admin Web UI URL and password⁠

Azure provides the Admin Web UI URL and, when applicable, the generated temporary password in the deployment outputs.

Open the completed Azure deployment.
Select Outputs.
Locate the adminWebUI output.

The adminWebUI field provides the Admin Web UI URL. The initialAdminCredential field provides the temporary password if you left Admin Web UI password (optional) empty during deployment.

Copy the Admin Web UI URL.
For example:
```
https://<PUBLIC_IP>/admin
```
If you used the automatically generated password, record it for the first Admin Web UI session.

🔑 Step 3: Sign in to the Admin Web UI⁠

Open the Admin Web UI URL from the adminWebUI output.
If Access Server is using its self-signed certificate, continue through the expected browser certificate warning.
Enter openvpn as the administrative username.
Enter either:
- The password you configured during Azure deployment.
- The temporary password from initialAdminCredential.
Sign in.
Review the Access Server EULA.
Select Agree.

Because Azure Tiered is licensed through the Azure Marketplace subscription, there's no separate Access Server subscription activation step.

The onboarding wizard displays for a fresh Access Server installation.

🚀 Step 4: Complete the onboarding wizard⁠

Use the onboarding wizard to configure initial VPN access and test your first connection.

Select whether VPN clients should have:
- Internet access through Access Server.
- Access to private resources in your Azure virtual network.
- Both, if appropriate for your deployment.
If you enable private-resource access, review the detected network CIDRs.
Verify that the detected networks match the Azure networks VPN users should access.
Keep only the networks VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download the wizard offers.
The wizard provides the installer appropriate for the operating system you're currently using.
Select Download.
Install the OpenVPN Connect app.
Return to the onboarding wizard.
Select Continue.

The wizard waits for a VPN connection.

Launch the OpenVPN Connect app.
Connect using the connection profile provided during onboarding.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.

You can also close the onboarding wizard if you prefer to complete these tasks later.

After you finish the wizard, Access Server can display an Admin Web UI tour introducing:

The Client Web UI.
Users.
Access Controls.
Authentication.
Activation.

For more information, refer to the onboarding wizard tutorial.

You don't need SSH access to initialize Access Server for this Tiered deployment. Connect to the VM when you need operating-system access for administration or troubleshooting.

Locate the VM's public IP address in Azure.
Open a terminal.
Connect using the SSH username and authentication method you configured during deployment:
```
ssh <Admin Username>@<PUBLIC_IP>
```
Authenticate with your SSH key.

For Windows SSH instructions using PuTTY, refer to Connect with PuTTY.

🛠️ Finish Access Server configuration⁠

With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.

Connection method	Procedure
Download OpenVPN Connect from the Client Web UI	Navigate to the Client Web UI in a browser. Sign in with user credentials. Download the OpenVPN Connect installer offered for the user's operating system. After it downloads, install the software. Open the app and select the connection profile. The user connects to Access Server.
Download a connection profile	Navigate to the Client Web UI in a browser. Sign in with their user credentials. Select the link under Available Connection Profiles. After the connection profile downloads, upload the file to a VPN client.
Admin distributes connection profiles or installers	Alternatively, as an admin, you can use these ways to connect your users: Have your users install OpenVPN Connect from our website, then download a connection profile from the Admin Web UI and distribute it to users. Create an OpenVPN Connect installer from the Access Server command-line interface and distribute it to users.

Connection method

Procedure

Download OpenVPN Connect from the Client Web UI

Navigate to the Client Web UI in a browser.
Sign in with user credentials.
Download the OpenVPN Connect installer offered for the user's operating system.
After it downloads, install the software.
Open the app and select the connection profile.
- The user connects to Access Server.

Download a connection profile

Navigate to the Client Web UI in a browser.
Sign in with their user credentials.
Select the link under Available Connection Profiles.
After the connection profile downloads, upload the file to a VPN client.

Admin distributes connection profiles or installers

Alternatively, as an admin, you can use these ways to connect your users:

Have your users install OpenVPN Connect from our website, then download a connection profile from the Admin Web UI and distribute it to users.
Create an OpenVPN Connect installer from the Access Server command-line interface and distribute it to users.

You need IP forwarding when Access Server uses routing rather than NAT to provide access to private Azure networks.

If you use NAT and don't require routed return traffic through the Access Server VM, skip this section.

To enable IP forwarding:

In the Azure portal, search for network interfaces.
Select Network interfaces.
Select the network interface attached to the Access Server VM.
Select IP configurations.
Select the toggle to Enable IP forwarding.
Select Save.
Record the VM's private IP address.
- You'll use the private IP as the next hop when you configure the Azure route table.

When you use Routing for your Access Server instead of NAT, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance.

Create a route table⁠

In the Azure portal, select Create a resource.
Search for route table.
Select the Microsoft Route table resource.
Select Create.
Select the resource group containing your Access Server deployment.
Enter a name for the route table.
Select Review + Create.
Review the settings.
Select Create.

Associate the route table with the subnet⁠

Navigate to the Access Server VM.
Open its virtual network.
Under Settings, select Subnets.
Select the subnet used by your computing resources (may be called default).
For Route table, select the route table you created.
Select Save.
Repeat the procedure for other applicable subnets in the virtual network.

Add the VPN client routes⁠

Add routes for the default Access Server VPN client subnets.

Open the route table.
Under Settings, select Routes.
Select Add.
Configure the first route:
Setting
Value
Address Prefix
172.27.224.0/20
Next hop type
Virtual appliance
Next hop address
The private IP address of the Access Server VM
Save the route.
Select Add again.
Configure the second route:
Setting
Value
Address Prefix
172.27.240.0/20
Next hop type
Virtual appliance
Next hop address
The private IP address of the Access Server VM
Save the route.
- Traffic destined for the default Access Server VPN client networks can now use the Access Server VM as the Virtual appliance next hop.

Setting	Value
Address Prefix	`172.27.224.0/20`
Next hop type	Virtual appliance
Next hop address	The private IP address of the Access Server VM

Setting	Value
Address Prefix	`172.27.240.0/20`
Next hop type	Virtual appliance
Next hop address	The private IP address of the Access Server VM

Additional Security Steps You Can Take After Installation⁠

We recommend you follow the tutorials below to improve your Access Server security after installation.

Increase security with these tutorials:

Tutorial: Keep Access Server Updated — We recommend that everyone runs the latest Access Server version.
Tutorial: How to Replace the Legacy openvpn Administrative Account — This tutorial is for sysadmins upgrading from an older Access Server version.
Tutorial: How to Change the Password for Your New Administrative Account — This tutorial is for new installations with a temporary password.
Tutorial: How to Install a Valid Web SSL Certificate in Access Server — We recommend that everyone add a valid SSL certificate from a trusted CA.
Tutorial: Harden the Web Server Cipher Suite String — This is a security step where you can update the cipher suite string if you want.
Tutorial: How to Isolate Access Server's Web Services — This tutorial covers a narrow use case where you don't want the web UIs accessible online.
Tutorial: How to Secure the Root User Account on a Virtual Appliance — This tutorial applies to ESXi or Hyper-V appliances.

Azure Marketplace Quick Start Guide for Access Server (Tiered/Fixed Connection Licensing)⁠

Overview⁠

Choose between Azure Tiered, PAYG, and BYOL⁠

About Tiered subscriptions⁠

Available connection tiers⁠

🚀 Step 1: Launch Access Server from Azure Marketplace⁠

🖥️ Step 2: Get the Admin Web UI URL and password⁠

🚀 Step 4: Complete the onboarding wizard⁠

🛠️ Finish Access Server configuration⁠

Create a route table⁠

Associate the route table with the subnet⁠

Add the VPN client routes⁠

Additional Security Steps You Can Take After Installation⁠

Only two connections⁠

Was this information helpful?

Azure Marketplace Quick Start Guide for Access Server (Tiered/Fixed Connection Licensing)⁠

Overview⁠

Choose between Azure Tiered, PAYG, and BYOL⁠

About Tiered subscriptions⁠

Available connection tiers⁠

🚀 Step 1: Launch Access Server from Azure Marketplace⁠

🖥️ Step 2: Get the Admin Web UI URL and password⁠

🔑 Step 3: Sign in to the Admin Web UI⁠

🚀 Step 4: Complete the onboarding wizard⁠

🛠️ Finish Access Server configuration⁠

Related resources⁠

Was this information helpful?