Microsoft Azure VPN Quick Start Guide for Access Server
The Microsoft Azure BYOL instance lets you quickly launch on your Microsoft Azure account to get your VPN server up and running. Here's how.
Access Server provides a Microsoft Azure Marketplace VPN that you can get up and running within minutes.
By using the Access Server virtual machine (VM) from the Azure Marketplace, you can launch a VPN hosted in the cloud, with the following benefits:
Read on for your guide to get started with your VPN server on the web.
Launch the VM
To launch a new VM with Access Server software:
Sign in to the Access Server Hub on our site or create a new account.
Click Deploy Access Server and click the Microsoft Azure option.
Under Azure Deployment Options, click Azure Marketplace Options.
Click Launch from Azure Marketplace.
From the Azure Marketplace, click Get It Now to launch the app.
Enter a name and select the basic configuration options. We recommend using SSH for authentication.
When you get to the Networking tab, you'll see that we've preconfigured the security groups for you.
Review the configuration and click Create.
Once the deployment is complete, go to your resource and copy the public IP address.
Note
We used the default options for the quick start guide, which are already optimal. Feel free to configure settings as you see fit.
💻 Connect to your VM
When your deployment is complete, you can click on Go to resource to open your virtual machine dashboard. You’ll find your VPN server's IP address under Public IP address.
The Access Server appliance is a Linux-based appliance managed via an SSH connection. You can connect to the instance using an SSH client with the same credentials you previously used to initiate it. For more information on connecting to your instance using SSH, refer to the Microsoft Azure documentation.
We provide instructions on how to connect to a common use case for Windows OS users with the PuTTY SSH Client: Connect to Access Server via SSH using PuTTY.
The initial Access Server configuration tool runs automatically the first time you sign into the instance.
For this guide, we assume you choose the default values by pressing ENTER for each choice.
You can now connect to the Admin Web UI with ‘openvpn’ and the generated password with the URL https://[youripaddress]/admin.
Tip
Replace "[youripaddress]" with the static IP address of your server.
Now that you've installed Access Server, follow these next steps.
When you complete the installation process on the command line, the output displays the URLs for your admin UI and client UI as well as the username and randomly generated password for the admin account.
Admin UI | The Admin UI is the web-based GUI for managing your Access Server. We refer to it as the Admin Web UI. Typically, it is the address of your server with /admin/ appended, for example https://192.0.2.222/admin/. When you sign in to the Admin Web UI, you can manage the configuration, certificate, users, and so on as an administrative user. The web-based GUI provides simplified management of complex VPN features rather than having to run Linux-based commands and scripts. |
Client UI | The Client Web UI is the web-based GUI where users sign in to download clients or configuration files. Typically, it is the address of your server, https://192.0.2.222 as an example. TipThe web services run on port TCP 943, by default, so you can visit them at https://192.168.70.222:943/ and https://192.168.70.222:943/admin/ as well. The OpenVPN TCP daemon that runs on TCP port 443 redirects incoming browser requests so that it is slightly easier for users to open the web interface by leaving the :943 part out. |
Administrative User
For the first use of the Admin Web UI, sign in with the openvpn user created during setup. The user’s password is randomly generated and displays in the output at the completion of setup.
You can now open a browser and enter your Admin Web UI address.
Invalid Certificate
Access Server’s web interface comes with a self-signed certificate. This allows you to sign in to the Admin Web UI right away. Since it’s self-signed, it triggers an expected warning. We recommend adding your own SSL certificate in the Admin Web UI to resolve this.
By clicking through to the site, you can continue to the web interface. At the login screen, enter the username and password for your openvpn user.
We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: vpn.example.com. This provides an easier user experience than remembering the server's IP address.
Refer to Hostname and follow the steps.
Access Server supports using multiple authentication methods for VPN users.
Sign in to the Admin Web UI.
Navigate to Authentication.
Configure the authentication method appropriate for your organization.
Access Server supports:
Local authentication.
PAM.
RADIUS.
LDAP.
SAML.
Access Server can also use multiple authentication systems simultaneously.
Refer to Authentication System for more information.
With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.
Connection method | Procedure |
|---|---|
Download OpenVPN Connect from the Client Web UI |
|
Download a connection profile |
|
Admin distributes connection profiles or installers | Alternatively, as an admin, you can use these ways to connect your users:
|
Tip
Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure split-tunnel traffic, their IP address remains the same for internet traffic.
After confirming that users can connect successfully, complete any operating-system maintenance and security hardening required for your production deployment.
🕒 Change default time zone
If the server uses a different time zone than you require, run:
sudo dpkg-reconfigure tzdata
Follow the prompts to select the appropriate time zone.
⏰ Verify time synchronization
Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.
Before installing another NTP service, verify which time synchronization service is already active on the Droplet and configure it according to your operating-system requirements.
🔄 Update operating-system software
Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
sudo apt-get update sudo apt-get upgrade
Review the packages before applying updates in production and reboot the server when required.
🛡️ Further security recommendations
Review the security guidance that applies to your deployment:
Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.
Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.
In order for your instance to function properly if you use “Routing” as your mode of operation inside Access Server instead of NAT, ensure you turn on IP forwarding:
From the Azure portal, enter network interfaces in the search box at the top.
Select Network interfaces from the search results.
Select the network interface of your Access Server virtual machine.
Click IP configurations.
Click on the toggle to Enable IP forwarding.
Click Save.
The network interface change saves.
Note your private IP address here, as you will need it to create and assign a routing table, as explained below.
When you use “Routing” for your Access Server instead of NAT, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance.
Create a route table
Click on Create a resource from your Azure portal.
Search for "route table".
Select the Route table from Microsoft when prompted and click Create.
Select the Resource group with your VPN server.
Enter a name for the routing table (choose any you would like).
Click Review + Create then Create.
Attach the route table to your VM
Navigate to your Access Server virtual machine's dashboard.
Under Networking and Virtual network/subnet click on the Vnet for your VM.
Under Settings, click on Subnets.
Click on the subnet used by your computing resources (may be called default).
Click on the Route table drop-down and select your newly created routing table from the list.
Click Save.
Repeat this step for any additional subnets you may have under the same Vnet that the VPN server needs to communicate with.
Add routes
Now that the routing table is assigned, you need to add routes:
Navigate to your new routing table.
Under Settings of your route table, click Routes.
Click Add.
On the Add route page, enter a name, then the following:
Address Prefix: 172.27.224.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Click OK when done.
Click Add again to add a second record:
Address Prefix: 172.27.240.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Click OK when done.
You've completed the routing table configuration.
Note
The 172.x.x.x IP addresses above are private IP addresses used by Access Server as the internal DHCP system.
Important
If you change your VPN subnets using the Admin Web UI, ensure you edit your routing table configuration as well.