Deploy OpenVPN Access Server on Microsoft Azure — Quick Start Guide
Deploy OpenVPN Access Server on Microsoft Azure using the Microsoft Azure Marketplace bring your own license (BYOL) image — covers virtual machine (VM) creation, SSH access, initial Access Server configuration, Let's Encrypt setup, and first-time Admin Web UI onboarding.
Access Server is available as a preconfigured VM image in Azure Marketplace. Deploy the Azure Marketplace image to create a Linux VM with Access Server installed and ready to provide secure remote access to your private resources.
With the Azure Marketplace BYOL deployment, you can:
Deploy Access Server without manually installing the software.
Configure the Azure VM and networking for your environment.
Connect to the instance using SSH to complete the initial configuration.
Configure a Let's Encrypt certificate for the instance's public IP address.
Complete the initial Access Server configuration using the onboarding wizard.
This guide covers the BYOL deployment option. To compare licensing and deployment options, see Azure.
If you want Azure to bill you directly rather than managing a separate license activation key, see Azure PAYG.
🚀 Launch Access Server from Azure Marketplace
Access Server provides several deployment options for Microsoft Azure:
Azure Launcher (Access Server Link)
ARM Template
Linux on Azure
Docker on Azure
Azure Marketplace Options
This guide covers the Virtual Disk image (BYOL) option from Azure Marketplace.
Sign in to the Access Server Hub on our site or create a new account.
Under Installation, select Azure.
Under Azure Deployment Options, select Azure Marketplace Options.
Under Azure Virtual Disk Image, select Launch from Azure Marketplace.
Sign in to your Microsoft Azure account if prompted.
Review the OpenVPN Access Server BYOL listing in Azure Marketplace.
Select Get It Now.
Azure redirects you to the Azure portal.
Review the subscription and plan information.
Select Create.
On the Basics tab, configure the VM:
Setting
Description
Subscription
Select the Azure subscription for the deployment.
Resource group
Select an existing resource group or create a new one.
Virtual machine name
Enter a name for the Access Server VM.
Region
Select the Azure region where you want to deploy Access Server.
Image
Leave the OpenVPN Access Server Azure Marketplace image selected.
VM architecture
Select the architecture appropriate for your deployment.
Size
Select an available VM size that meets your Access Server capacity and performance requirements.
Authentication type
We recommend SSH public key.
Username
Enter the administrative username used to connect to the VM over SSH. Azure defaults to azureuser.
SSH public key source
Select an existing key, use an existing public key, or create a new key pair.
SSH key
Complete the SSH key configuration for the option you selected.
To customize Azure settings, selec Next and configure the applicable tabs.
For this quick start guide, leave the remaining settings at their defaults and select Review + create.
Review the deployment configuration.
Select Create.
Wait for Azure to deploy the required resources, including the VM, network interface, public IP address, and network security groups.
When the deployment completes, select Go to resource.
💻 Connect to your VM
After deployment, connect to the Access Server VM to complete its initial configuration.
From the VM Overview page, locate the Public IP address.
Copy the public IP address.
Connect to the VM using SSH with the username and authentication method you configured during deployment.
For example:
ssh azureuser@<public-ip-address>
The Access Server initial configuration tool starts automatically when you first connect.
Access Server's initial configuration tool guides you through the first-time Access Server configuration.
For this quick start guide, we assume you use the default configuration values where available.
Review and accept the Access Server End User License Agreement (EULA).
Follow the configuration prompts.
Press ENTER to accept the default values for each configuration option used in this quick start.
When the initial configuration finishes, locate the Access Server sign-in information in the output:
Admin Web UI URL
Client Web UI URL
Administrative username
Generated administrative password
Initial Configuration Complete!
You can now continue configuring OpenVPN Access Server by
directing your Web browser to this URL:
OpenVPN Access Server URL:
During normal operation, OpenVPN AS can be accessed via these URLs:
Admin UI: https://192.0.2.10:943/admin/
Client UI: https://192.0.2.10:943/
To login please use the "openvpn" account with "FKadk2254" password.
See the Release Notes for this release at:
https://openvpn.net/vpn-server-resources/release-notes/
When prompted to enable Let's Encrypt for the public IP address, enter Y.
After the initial configuration completes:
Open the Admin Web UI URL displayed in the output. For example: https://<public-ip-address>/admin.
Sign in with the username and generated password displayed.
Review the Access Server license agreement.
Select Agree.
The onboarding wizard displays for a new Access Server installation.
The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.
Select whether VPN clients should have:
Internet access through Access Server.
Access to private resources in your Azure virtual network.
Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Verify that the detected networks match the Azure virtual networks that VPN users should access.
Keep only the networks that VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
The Client Web UI
Users
Access Controls
Authentication
Activation
After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.
🕒 Change default time zone
If the server uses a different time zone than you require, run:
sudo dpkg-reconfigure tzdata
Follow the prompts to select the appropriate time zone.
⏰ Verify time synchronization
Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.
Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.
🔄 Update operating-system software
Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
sudo apt-get update
sudo apt-get upgrade
Review the packages before applying updates in production and reboot the server when required.
🛡️ Further security recommendations
Review the security guidance that applies to your deployment:
Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.
You need IP forwarding when Access Server uses routing rather than NAT to provide access to private Azure networks.
If you use NAT and don't require routed return traffic through the Access Server VM, skip this section.
To enable IP forwarding:
In the Azure portal, search for network interfaces.
Select Network interfaces.
Select the network interface attached to the Access Server VM.
Select IP configurations.
Select the toggle to Enable IP forwarding.
Select Save.
Record the VM's private IP address.
You'll use the private IP as the next hop when you configure the Azure route table.
When you use Routing for your Access Server instead of NAT, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance.
Create a route table
In the Azure portal, select Create a resource.
Search for route table.
Select the Microsoft Route table resource.
Select Create.
Select the resource group containing your Access Server deployment.
Enter a name for the route table.
Select Review + Create.
Review the settings.
Select Create.
Associate the route table with the subnet
Navigate to the Access Server VM.
Open its virtual network.
Under Settings, select Subnets.
Select the subnet used by your computing resources (may be called default).
For Route table, select the route table you created.
Select Save.
Repeat the procedure for other applicable subnets in the virtual network.
Add the VPN client routes
Add routes for the default Access Server VPN client subnets.
Open the route table.
Under Settings, select Routes.
Select Add.
Configure the first route:
Setting
Value
Address Prefix
172.27.224.0/20
Next hop type
Virtual appliance
Next hop address
The private IP address of the Access Server VM
Save the route.
Select Add again.
Configure the second route:
Setting
Value
Address Prefix
172.27.240.0/20
Next hop type
Virtual appliance
Next hop address
The private IP address of the Access Server VM
Save the route.
Traffic destined for the default Access Server VPN client networks can now use the Access Server VM as the Virtual appliance next hop.
