--- title: Deploy OpenVPN Access Server on Microsoft Azure — Quick Start Guide canonical: https://openvpn.net/as-docs/v3/azure/ product: Access Server Docs description: Deploy OpenVPN Access Server on Microsoft Azure using a BYOL (bring your own license) Marketplace VM — covers launching the Azure VM, completing initial setup, activating your license key, connecting your first VPN client, and post-installation security hardening. --- # Deploy OpenVPN Access Server on Microsoft Azure — Quick Start Guide Deploy OpenVPN Access Server on Microsoft Azure using the [Microsoft Azure Marketplace](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/openvpn.openvpnas?tab=Overview) bring your own license (BYOL) image — covers virtual machine (VM) creation, SSH access, initial Access Server configuration, Let's Encrypt setup, and first-time Admin Web UI onboarding. Access Server is available as a preconfigured VM image in Azure Marketplace. Deploy the Azure Marketplace image to create a Linux VM with Access Server installed and ready to provide [secure remote access](https://openvpn.net/use-cases/secure-remote-access/) to your private resources. With the Azure Marketplace BYOL deployment, you can: - Deploy Access Server without manually installing the software. - Configure the Azure VM and networking for your environment. - Connect to the instance using SSH to complete the initial configuration. - Configure a Let's Encrypt certificate for the instance's public IP address. - Complete the initial Access Server configuration using the onboarding wizard. > **Tip** > > Refer to our [system requirements](https://openvpn.net/as-docs/v3/system-requirements.md) to ensure your system works with Access Server. This guide covers the BYOL deployment option. To compare licensing and deployment options, see [Azure](https://openvpn.net/as-docs/v3/azure-deploy.md). If you want Azure to bill you directly rather than managing a separate license activation key, see [Azure PAYG](https://openvpn.net/as-docs/v3/azure-payg.md). ## 🚀 Launch Access Server from Azure Marketplace Access Server provides several deployment options for Microsoft Azure: - Azure Launcher (Access Server Link) - ARM Template - Linux on Azure - Docker on Azure - Azure Marketplace Options This guide covers the **Virtual Disk image (BYOL)** option from Azure Marketplace. 1. Sign in to the [Access Server Hub](https://as-portal.openvpn.com/deployment) on our site or create a new account. 2. Under **Installation**, select **Azure**. 3. Under **Azure Deployment Options**, select **Azure Marketplace Options**. 4. Under **Azure Virtual Disk Image**, select **Launch from Azure Marketplace**. 5. Sign in to your Microsoft Azure account if prompted. 6. Review the OpenVPN Access Server BYOL listing in Azure Marketplace. 7. Select **Get It Now**. - Azure redirects you to the Azure portal. 8. Review the subscription and plan information. 9. Select **Create**. 10. On the **Basics** tab, configure the VM: | **Setting** | **Description** | | --- | --- | | Subscription | Select the Azure subscription for the deployment. | | Resource group | Select an existing resource group or create a new one. | | Virtual machine name | Enter a name for the Access Server VM. | | Region | Select the Azure region where you want to deploy Access Server. | | Image | Leave the OpenVPN Access Server Azure Marketplace image selected. | | VM architecture | Select the architecture appropriate for your deployment. | | Size | Select an available VM size that meets your Access Server capacity and performance requirements. | | Authentication type | We recommend **SSH public key**. | | Username | Enter the administrative username used to connect to the VM over SSH. Azure defaults to `azureuser`. | | SSH public key source | Select an existing key, use an existing public key, or create a new key pair. | | SSH key | Complete the SSH key configuration for the option you selected. | > **Note** > > Azure VM size availability depends on your subscription, region, quota, and current Azure capacity. If your preferred size isn't available, select another suitable VM size or region. 11. To customize Azure settings, selec **Next** and configure the applicable tabs. 12. For this quick start guide, leave the remaining settings at their defaults and select **Review + create**. 13. Review the deployment configuration. 14. Select **Create**. 15. Wait for Azure to deploy the required resources, including the VM, network interface, public IP address, and network security groups. 16. When the deployment completes, select **Go to resource**. > **Note** > > We used the default options for the quick start guide, which are already optimal. Feel free to configure settings as you see fit. ## 💻 Connect to your VM After deployment, connect to the Access Server VM to complete its initial configuration. 1. From the **VM Overview** page, locate the **Public IP address**. 2. Copy the public IP address. 3. Connect to the VM using SSH with the username and authentication method you configured during deployment. - For example: ``` ssh azureuser@ ``` The Access Server initial configuration tool starts automatically when you first connect. > **Tip** > > We provide instructions on how to connect to a common use case for Windows OS users with the PuTTY SSH Client: [Connect to Access Server via SSH using PuTTY](https://openvpn.net/as-docs/v3/tutorials/tutorial--connect-with-putty.md). ## 🛠️ Complete the initial Access Server configuration Access Server's initial configuration tool guides you through the first-time Access Server configuration. For this quick start guide, we assume you use the default configuration values where available. 1. Review and accept the Access Server End User License Agreement (EULA). 2. Follow the configuration prompts. 3. Press **ENTER** to accept the default values for each configuration option used in this quick start. 4. When the initial configuration finishes, locate the Access Server sign-in information in the output: - Admin Web UI URL - Client Web UI URL - Administrative username - Generated administrative password ``` Initial Configuration Complete! You can now continue configuring OpenVPN Access Server by directing your Web browser to this URL: OpenVPN Access Server URL: During normal operation, OpenVPN AS can be accessed via these URLs: Admin UI: https://192.0.2.10:943/admin/ Client UI: https://192.0.2.10:943/ To login please use the "openvpn" account with "FKadk2254" password. See the Release Notes for this release at: https://openvpn.net/vpn-server-resources/release-notes/ ``` 5. When prompted to enable Let's Encrypt for the public IP address, enter `Y`. > **Note** > > If you don't enable Let's Encrypt, or certificate issuance isn't successful, Access Server uses its self-signed certificate. Your browser may display a certificate warning when you open the web interface. ## 🌐 Sign in to the Admin Web UI After the initial configuration completes: 1. Open the Admin Web UI URL displayed in the output. For example: `https:///admin`. 2. Sign in with the username and generated password displayed. 3. Review the Access Server license agreement. 4. Select **Agree**. - The onboarding wizard displays for a new Access Server installation. ## 🚀 Walk through the onboarding wizard The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection. 1. Select whether VPN clients should have: - Internet access through Access Server. - Access to private resources in your Azure virtual network. - Both, if appropriate for your deployment. 2. If access to private resources is enabled, review the network CIDRs that Access Server detected. 3. Verify that the detected networks match the Azure virtual networks that VPN users should access. 4. Keep only the networks that VPN users should be allowed to access. 5. Select **Continue**. 6. Review the OpenVPN Connect download offered by the wizard. The wizard displays the download appropriate for the operating system of the device you're currently using. 7. Select **Download**. 8. Install OpenVPN Connect. 9. Return to the onboarding wizard. 10. Select **Continue**. 11. The wizard displays a prompt while it waits for a VPN connection. 12. Launch OpenVPN Connect on your device. 13. Connect using the profile included. 14. Confirm that the VPN connection succeeds. 15. Return to the Admin Web UI. 16. Select **Finish Wizard**. > **Tip** > > You can also close the onboarding wizard by selecting the **X** if you prefer to skip these steps. 17. After completing the wizard, the Admin Web UI opens and presents a short product tour covering: - The Client Web UI - Users - Access Controls - Authentication - Activation ## ⚙️ Next Steps After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment. ### 🕒 Change default time zone 1. If the server uses a different time zone than you require, run: ``` sudo dpkg-reconfigure tzdata ``` 2. Follow the prompts to select the appropriate time zone. ### ⏰ Verify time synchronization Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication. Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements. ### 🔄 Update operating-system software 1. Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run: ``` sudo apt-get update sudo apt-get upgrade ``` 2. Review the packages before applying updates in production and reboot the server when required. ### 🛡️ Further security recommendations Review the security guidance that applies to your deployment: - [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — Keep Access Server current with supported security and feature updates. - [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — Replace the temporary administrative password used during initial setup. - [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening. - [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable. Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements. ## 🔀 Enable IP forwarding (required for use with routing) You need **IP forwarding** when Access Server uses routing rather than NAT to provide access to private Azure networks. If you use NAT and don't require routed return traffic through the Access Server VM, skip this section. To enable IP forwarding: 1. In the Azure portal, search for `network interfaces`. 2. Select **Network interfaces**. 3. Select the network interface attached to the Access Server VM. 4. Select **IP configurations**. 5. Select the toggle to **Enable** IP forwarding. 6. Select **Save**. 7. Record the VM's private IP address. - You'll use the private IP as the next hop when you configure the Azure route table. ## 🔁 Create and assign a routing table (required for use with routing) When you use **Routing** for your Access Server instead of **NAT**, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance. ### Create a route table 1. In the Azure portal, select **Create a resource**. 2. Search for `route table`. 3. Select the Microsoft **Route table** resource. 4. Select **Create**. 5. Select the resource group containing your Access Server deployment. 6. Enter a name for the route table. 7. Select **Review + Create**. 8. Review the settings. 9. Select **Create**. ### Associate the route table with the subnet 1. Navigate to the Access Server VM. 2. Open its virtual network. 3. Under **Settings**, select **Subnets**. 4. Select the subnet used by your computing resources (may be called **default**). 5. For **Route table**, select the route table you created. 6. Select **Save**. 7. Repeat the procedure for other applicable subnets in the virtual network. ### Add the VPN client routes Add routes for the default Access Server VPN client subnets. 1. Open the route table. 2. Under **Settings**, select **Routes**. 3. Select **Add**. 4. Configure the first route: | Setting | Value | | --- | --- | | **Address Prefix** | `172.27.224.0/20` | | **Next hop type** | **Virtual appliance** | | **Next hop address** | The private IP address of the Access Server VM | 5. Save the route. 6. Select **Add** again. 7. Configure the second route: | Setting | Value | | --- | --- | | **Address Prefix** | `172.27.240.0/20` | | **Next hop type** | **Virtual appliance** | | **Next hop address** | The private IP address of the Access Server VM | 8. Save the route. - Traffic destined for the default Access Server VPN client networks can now use the Access Server VM as the **Virtual appliance** next hop. > **Important** > > `172.27.224.0/20` and `172.27.240.0/20` are the default Access Server VPN client subnets used by this configuration. > > If you change the VPN subnets in the Admin Web UI, update the Azure route table to match. --- Prev: [Azure](https://openvpn.net/as-docs/v3/azure-deploy.md) Next: [Azure PAYG](https://openvpn.net/as-docs/v3/azure-payg.md) Index: https://openvpn.net/as-docs/llms.txt