DigitalOcean VPN Server Guide for Droplet and Access Server

Abstract

Deploy OpenVPN Access Server on a DigitalOcean Droplet in minutes using the Marketplace image — covers creating your Droplet, completing initial setup, activating your license, connecting your first VPN client, and hardening your deployment.

OpenVPN Access Server is available as a pre-configured image in the DigitalOcean Marketplace, so you can deploy a cloud-hosted VPN server on a Droplet — DigitalOcean's Linux-based virtual machine — without manually installing or configuring the software stack.

This guide walks you through deploying Access Server on DigitalOcean, from creating your Droplet to connecting your first VPN client. It covers initial configuration, license activation, hostname setup, and recommended security hardening steps for a production deployment.

Deploying Access Server on DigitalOcean is well-suited for teams that need to:

Give remote users secure remote access to cloud-hosted applications and private networks.
Connect cloud infrastructure using site-to-site or hub-and-spoke network topology.
Run a self-managed VPN server without the overhead of on-premises hardware.

For performance guidance on selecting the right Droplet size, see system requirements. For encryption-heavy workloads, a CPU-optimized Droplet is recommended over a Basic plan.

🖥️Create a Droplet

Use the Access Server image from the DigitalOcean Marketplace to create your Droplet.

Sign in to the Access Server Hub on our site or create a new account.
From the Installation page, select DigitalOcean.
Select Launch From DigitalOcean Marketplace.
Sign in to your DigitalOcean account if prompted.
Select Create OpenVPN Access Server Droplet.

Configure the Droplet options for your deployment:

Configuration	Details
Datacenter region	Select a region close to your users and the resources they access through the VPN.
VPC Network	Select the DigitalOcean VPC containing the private resources you want Access Server to reach.
Image	Keep the selected OpenVPN Access Server marketplace image.
Droplet plan	Select a Droplet class appropriate for your expected VPN workload. You can begin with a Basic plan and resize later if needed.
CPU Options	Select the appropriate vCPU, memory, storage, and transfer capacity. VPN encryption and decryption can benefit from additional CPU resources.
Authentication	Add an SSH key for administrative access. We recommend SSH key authentication rather than a password.
Droplet name	Enter a descriptive name for the Access Server Droplet or keep the DigitalOcean-generated name.
Project	Assign the Droplet to the appropriate DigitalOcean project.
Additional options	Configure backups, monitoring, IPv6, user data, or other DigitalOcean options as required for your deployment.

Review the configuration.
Select Create Droplet.

Note

This guide assumes you use an SSH key pair to connect to your Droplet.

Tips for selecting a Droplet

A Basic CPU Droplet can be suitable for smaller Access Server deployments. If VPN throughput becomes CPU-constrained, consider a CPU-optimized Droplet.
Access Server requires relatively little local storage for its application data and logs. Choose additional storage based on your organization's logging and retention requirements.
Access Server primarily uses IPV4 and provides limited IPv6 support.

🖥️ Connect to your instance

After DigitalOcean finishes deploying the Droplet, connect to it using SSH.

In the DigitalOcean Control Panel, locate the public IP address for your Droplet.
Open an SSH client.
Connect using the administrative account and SSH key configured when you created the Droplet.
The initial configuration tool runs automatically on first connection — review the EULA and enter yes to accept.
Follow the prompts from the Access Server configuration tool.
For this guide, accept the default values by pressing Enter for each prompt.
Once Initial Configuration Complete! displays, record:
- The Admin Web UI URL.
- The Client Web UI URL.
- The openvpn administrative username.
- The randomly generated administrative password, if you didn't define a password during setup.
```
During normal operation, OpenVPN AS can be accessed via these URLs:
Admin  UI: https://192.0.2.49:943/admin/
Client UI: https://192.0.2.49:943/
To login please use the "openvpn" account with "aBCdefGHIjk" password.
```
Important
Store the temporary administrative password securely. You'll use it for the first sign-in to the Admin Web UI.
Enter y to have a browser-trusted Let's Encrypt certificate automatically configured for the Admin Web UI and Client Web UI.
Tip
If you plan to manage the web SSL certificate separately, select n and Access Server will launch with a self-signed certificate you can replace on your own.

Tip

We provide instructions on how to connect with a common use case for Windows OS users with the PuTTY SSH Client: Connect to Access Server via SSH Using PuTTY.

🔑 Sign in to the Admin Web UI and activate Access Server

Access Server uses a bring-your-own-license (BYOL) model with the DigitalOcean Marketplace image. Before you can use the included free VPN connections, activate Access Server with a subscription from the Access Server portal.

Open the Admin Web UI URL displayed during installation. For example: https://192.0.2.49:943/admin/.
Sign in with the openvpn administrative account and the password displayed during setup.
Review the End User License Agreement (EULA).
Select Agree.
- The Activate your Access Server page displays.
Open the Access Server Hub in another browser tab or window.
Select Subscriptions.
To create a free subscription for this deployment:
1. Select Purchase a New Key.
2. Select Free.
3. Select the Copy icon for the new activation key.
Return to the Admin Web UI.
Paste the activation key into the activation field.
Select Activate.
- Access Server activates the subscription and unlocks the VPN connections included with it.
Tip
If you already have an Access Server subscription that you want to use for this deployment, copy its activation key instead of creating a new free subscription.

🚀 Walk through the onboarding wizard

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

Select whether VPN clients should have:
- Internet access through Access Server.
- Access to private resources behind the DigitalOcean Droplet.
- Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Tip
Access Server may automatically display private networks that are reachable from the Droplet. For example, a DigitalOcean deployment might display CIDRs such as:
10.48.0.0/20
10.124.0.0/20
Compare the detected networks with the VPC configuration in your DigitalOcean account.
Keep only the networks that VPN users should be allowed to access.
Important
The detected CIDRs depend on your DigitalOcean networking configuration and may differ from the examples shown here. Verify each network before granting access rather than assuming all detected private networks should be available to VPN users.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
Tip
You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
- The Client Web UI
- Users
- Access Controls
- Authentication
- Activation

🌍 Understand the Access Server web interfaces

Access Server provides two web interfaces.

Admin Web UI	The administrative interface for configuring Access Server. Administrators use it to manage users, authentication, network access, certificates, VPN settings, licensing, logging, and other settings. The URL typically ends in `/admin/`, such as `https://vpn.example.com/admin/`. See the user manual.
Client Web UI	The user-facing interface for downloading OpenVPN Connect and connection profiles. Users sign in with their VPN credentials. Its URL is typically the Access Server hostname without `/admin/`, such as `https://vpn.example.com/`. See the user manual.

The URLs initially displayed during installation use the server's IP address and TCP port 943.

🌍 Setting up a hostname

We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: vpn.example.com. This provides an easier user experience than remembering the server's IP address.

Refer to Hostname and follow the steps.

🔑 Setting up authentication

Access Server supports using multiple authentication methods for VPN users.

Sign in to the Admin Web UI.
Navigate to Authentication.
Configure the authentication method appropriate for your organization.

Access Server supports:

Local authentication.
PAM.
RADIUS.
LDAP.
SAML.

Access Server can also use multiple authentication systems simultaneously.

Refer to Authentication System for more information.

📱 Connect users to Access Server

With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.

Connection method	Procedure
Download OpenVPN Connect from the Client Web UI	Navigate to the Client Web UI in a browser. Sign in with user credentials. Download the OpenVPN Connect installer offered for the user's operating system. After it downloads, install the software. Open the app and click on the connection profile. The user connects to Access Server.
Download a connection profile	Navigate to the Client Web UI in a browser. Sign in with their user credentials. Click on the link under Available Connection Profiles. After the connection profile downloads, upload the file to a VPN client.
Admin distributes connection profiles or installers	Alternatively, as an admin, you can use these ways to connect your users: Have your users install OpenVPN Connect from our website, then download a connection profile from the Admin Web UI and distribute it to users. Create an OpenVPN Connect installer from the Access Server command-line interface and distribute it to users.

Tip

Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure split-tunnel traffic, their IP address remains the same for internet traffic.

⚙️ Next Steps

After confirming that users can connect successfully, complete any operating-system maintenance and security hardening required for your production deployment.

🕒 Change default time zone

If the server uses a different time zone than you require, run:
```
sudo dpkg-reconfigure tzdata
```
Follow the prompts to select the appropriate time zone.

⏰ Verify time synchronization

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the Droplet and configure it according to your operating-system requirements.

🔄 Update operating-system software

Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
```
sudo apt-get update
sudo apt-get upgrade
```
Review the packages before applying updates in production and reboot the server when required.

🛡️ Further security recommendations

Review the security guidance that applies to your deployment:

Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

In this section: