Deploy OpenVPN Access Server on Microsoft Azure — Quick Start Guide
Deploy OpenVPN Access Server on Microsoft Azure using a BYOL (bring your own license) Marketplace VM — covers launching the Azure VM, completing initial setup, activating your license key, connecting your first VPN client, and post-installation security hardening.
Deploy OpenVPN Access Server on Microsoft Azure using the Microsoft Azure Marketplace bring your own license (BYOL) image — covers virtual machine (VM) creation, SSH access, initial Access Server configuration, Let's Encrypt setup, and first-time Admin Web UI onboarding.
Access Server is available as a preconfigured VM image in Azure Marketplace. Deploy the Azure Marketplace image to create a Linux VM with Access Server installed and ready to provide secure remote access to your private resources.
With the Azure Marketplace BYOL deployment, you can:
Deploy Access Server without manually installing the software.
Configure the Azure VM and networking for your environment.
Connect to the instance using SSH to complete the initial configuration.
Configure a Let's Encrypt certificate for the instance's public IP address.
Complete the initial Access Server configuration using the onboarding wizard.
Tip
Refer to our system requirements to ensure your system works with Access Server.
This guide covers the BYOL deployment option. To compare licensing and deployment options, see Azure.
If you want Azure to bill you directly rather than managing a separate license activation key, see Azure PAYG.
🚀 Launch Access Server from Azure Marketplace
Access Server provides several deployment options for Microsoft Azure:
Azure Launcher (Access Server Link)
ARM Template
Linux on Azure
Docker on Azure
Azure Marketplace Options
This guide covers the Virtual Disk image (BYOL) option from Azure Marketplace.
Sign in to the Access Server Hub on our site or create a new account.
Under Installation, select Azure.
Under Azure Deployment Options, select Azure Marketplace Options.
Under Virtual Disk Image (BYOL), select Launch from Azure Marketplace.
Sign in to your Microsoft Azure account if prompted.
Review the OpenVPN Access Server BYOL listing in Azure Marketplace.
Select Get It Now.
Azure redirects you to the Azure portal.
Review the subscription and plan information.
Select Create.
On the Basics tab, configure the VM:
Setting
Description
Subscription
Select the Azure subscription for the deployment.
Resource group
Select an existing resource group or create a new one.
Virtual machine name
Enter a name for the Access Server VM.
Region
Select the Azure region where you want to deploy Access Server.
Image
Leave the OpenVPN Access Server Azure Marketplace image selected.
VM architecture
Select the architecture appropriate for your deployment.
Size
Select an available VM size that meets your Access Server capacity and performance requirements.
Authentication type
We recommend SSH public key.
Username
Enter the administrative username used to connect to the VM over SSH. Azure defaults to
azureuser.SSH public key source
Select an existing key, use an existing public key, or create a new key pair.
SSH key
Complete the SSH key configuration for the option you selected.
Note
Azure VM size availability depends on your subscription, region, quota, and current Azure capacity. If your preferred size isn't available, select another suitable VM size or region.
To customize Azure settings, selec Next and configure the applicable tabs.
For this quick start guide, leave the remaining settings at their defaults and select Review + create.
Review the deployment configuration.
Select Create.
Wait for Azure to deploy the required resources, including the VM, network interface, public IP address, and network security groups.
When the deployment completes, select Go to resource.
Note
We used the default options for the quick start guide, which are already optimal. Feel free to configure settings as you see fit.
💻 Connect to your VM
After deployment, connect to the Access Server VM to complete its initial configuration.
From the VM Overview page, locate the Public IP address.
Copy the public IP address.
Connect to the VM using SSH with the username and authentication method you configured during deployment.
For example:
ssh azureuser@<public-ip-address>
The Access Server initial configuration tool starts automatically when you first connect.
Tip
We provide instructions on how to connect to a common use case for Windows OS users with the PuTTY SSH Client: Connect to Access Server via SSH using PuTTY.
Access Server's initial configuration tool guides you through the first-time Access Server configuration.
For this quick start guide, we assume you use the default configuration values where available.
Review and accept the Access Server End User License Agreement (EULA).
Follow the configuration prompts.
Press ENTER to accept the default values for each configuration option used in this quick start.
When the initial configuration finishes, locate the Access Server sign-in information in the output:
Admin Web UI URL
Client Web UI URL
Administrative username
Generated administrative password
When prompted to enable Let's Encrypt for the public IP address, enter
Y.Note
If you don't enable Let's Encrypt, or certificate issuance isn't successful, Access Server uses its self-signed certificate. Your browser may display a certificate warning when you open the web interface.
After the initial configuration completes:
Open the Admin Web UI URL displayed in the output. For example:
https://<public-ip-address>/admin.Sign in with the username and generated password displayed.
Review the Access Server license agreement.
Select Agree.
The onboarding wizard displays for a new Access Server installation.
The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.
Select whether VPN clients should have:
Internet access through Access Server.
Access to private resources in your Azure virtual network.
Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Verify that the detected networks match the Azure virtual networks that VPN users should access.
Keep only the networks that VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
Tip
You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
The Client Web UI
Users
Access Controls
Authentication
Activation
After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.
🕒 Change default time zone
If the server uses a different time zone than you require, run:
sudo dpkg-reconfigure tzdata
Follow the prompts to select the appropriate time zone.
⏰ Verify time synchronization
Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.
Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.
🔄 Update operating-system software
Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
sudo apt-get update sudo apt-get upgrade
Review the packages before applying updates in production and reboot the server when required.
🛡️ Further security recommendations
Review the security guidance that applies to your deployment:
Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.
Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.
In order for your instance to function properly if you use Routing as your mode of operation inside Access Server instead of NAT, ensure you turn on IP forwarding:
From the Azure portal, enter network interfaces in the search box at the top.
Select Network interfaces from the search results.
Select the network interface of your Access Server virtual machine.
Select IP configurations.
Select the toggle to Enable IP forwarding.
Select Save.
The network interface change saves.
Note your private IP address here, as you will need it to create and assign a routing table, as explained below.
When you use Routing for your Access Server instead of NAT, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance.
Create a route table
Select Create a resource from your Azure portal.
Search for "route table".
Select the Route table from Microsoft when prompted and select Create.
Select the Resource group with your VPN server.
Enter a name for the routing table (choose any you would like).
Select Review + Create then Create.
Attach the route table to your VM
Navigate to your Access Server virtual machine's dashboard.
Under Networking and Virtual network/subnet select the Vnet for your VM.
Under Settings, select Subnets.
Select the subnet used by your computing resources (may be called default).
Select the Route table drop-down, and select your newly created routing table from the list.
Select Save.
Repeat this step for any additional subnets you may have under the same Vnet that the VPN server needs to communicate with.
Add routes
Now that the routing table is assigned, you need to add routes:
Navigate to your new routing table.
Under Settings of your route table, select Routes.
Select Add.
On the Add route page, enter a name, then the following:
Address Prefix: 172.27.224.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.
Select Add again to add a second record:
Address Prefix: 172.27.240.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Select OK when done.
You've completed the routing table configuration.
Note
The 172.x.x.x IP addresses above are private IP addresses used by Access Server as the internal DHCP system.
Important
If you change your VPN subnets using the Admin Web UI, ensure you edit your routing table configuration as well.