DigitalOcean VPN Server Guide for Droplet and Access Server⁠

OpenVPN Access Server is available as a pre-configured image in the DigitalOcean Marketplace, so you can deploy a cloud-hosted VPN server on a Droplet — DigitalOcean's Linux-based virtual machine — without manually installing or configuring the software stack.

This guide walks you through deploying Access Server on DigitalOcean, from creating your Droplet to connecting your first VPN client. It covers initial configuration, license activation, hostname setup, and recommended security hardening steps for a production deployment.

Deploying Access Server on DigitalOcean is well-suited for teams that need to:

Give remote users secure remote access to cloud-hosted applications and private networks.
Connect cloud infrastructure using site-to-site or hub-and-spoke network topology.
Run a self-managed VPN server without the overhead of on-premises hardware.

For performance guidance on selecting the right Droplet size, see system requirements. For encryption-heavy workloads, a CPU-optimized Droplet is recommended over a Basic plan.

🖥️Create a Droplet⁠

Use the Access Server image from the DigitalOcean Marketplace to create your Droplet.

Sign in to the Access Server Hub on our site or create a new account.
From the Installation page, select DigitalOcean.
Select Launch From DigitalOcean Marketplace.
Sign in to your DigitalOcean account if prompted.
Select Create OpenVPN Access Server Droplet.

Configure the Droplet options for your deployment:

Configuration	Details
Datacenter region	Select a region close to your users and the resources they access through the VPN.
VPC Network	Select the DigitalOcean VPC containing the private resources you want Access Server to reach.
Image	Keep the selected OpenVPN Access Server marketplace image.
Droplet plan	Select a Droplet class appropriate for your expected VPN workload. You can begin with a Basic plan and resize later if needed.
CPU Options	Select the appropriate vCPU, memory, storage, and transfer capacity. VPN encryption and decryption can benefit from additional CPU resources.
Authentication	Add an SSH key for administrative access. We recommend SSH key authentication rather than a password.
Droplet name	Enter a descriptive name for the Access Server Droplet or keep the DigitalOcean-generated name.
Project	Assign the Droplet to the appropriate DigitalOcean project.
Additional options	Configure backups, monitoring, IPv6, user data, or other DigitalOcean options as required for your deployment.

Review the configuration.
Select Create Droplet.

After DigitalOcean finishes deploying the Droplet, connect to it using SSH.

In the DigitalOcean Control Panel, locate the public IP address for your Droplet.
Open an SSH client.
Connect using the administrative account and SSH key configured when you created the Droplet.
The initial configuration tool runs automatically on first connection — review the EULA and enter yes to accept.
Follow the prompts from the Access Server configuration tool.
For this guide, accept the default values by pressing Enter for each prompt.
Once Initial Configuration Complete! displays, record:
- The Admin Web UI URL.
- The Client Web UI URL.
- The openvpn administrative username.
- The randomly generated administrative password, if you didn't define a password during setup.
```
During normal operation, OpenVPN AS can be accessed via these URLs:
Admin  UI: https://192.0.2.49:943/admin/
Client UI: https://192.0.2.49:943/
To login please use the "openvpn" account with "aBCdefGHIjk" password.
```
Important
Store the temporary administrative password securely. You'll use it for the first sign-in to the Admin Web UI.
Enter y to have a browser-trusted Let's Encrypt certificate automatically configured for the Admin Web UI and Client Web UI.
Tip
If you plan to manage the web SSL certificate separately, select n and Access Server will launch with a self-signed certificate you can replace on your own.

Access Server uses a bring-your-own-license (BYOL) model with the DigitalOcean Marketplace image. Before you can use the included free VPN connections, activate Access Server with a subscription from the Access Server portal.

Open the Admin Web UI URL displayed during installation. For example: https://192.0.2.49:943/admin/.
Sign in with the openvpn administrative account and the password displayed during setup.
Review the End User License Agreement (EULA).
Select Agree.
- The Activate your Access Server page displays.
Open the Access Server Hub in another browser tab or window.
Select Subscriptions.
To create a free subscription for this deployment:
1. Select Purchase a New Key.
2. Select Free.
3. Select the Copy icon for the new activation key.
Return to the Admin Web UI.
Paste the activation key into the activation field.
Select Activate.
- Access Server activates the subscription and unlocks the VPN connections included with it.
Tip
If you already have an Access Server subscription that you want to use for this deployment, copy its activation key instead of creating a new free subscription.

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

Select whether VPN clients should have:
- Internet access through Access Server.
- Access to private resources behind the DigitalOcean Droplet.
- Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Tip
Access Server may automatically display private networks that are reachable from the Droplet. For example, a DigitalOcean deployment might display CIDRs such as:
10.48.0.0/20
10.124.0.0/20
Compare the detected networks with the VPC configuration in your DigitalOcean account.
Keep only the networks that VPN users should be allowed to access.
Important
The detected CIDRs depend on your DigitalOcean networking configuration and may differ from the examples shown here. Verify each network before granting access rather than assuming all detected private networks should be available to VPN users.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
Tip
You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
- The Client Web UI
- Users
- Access Controls
- Authentication
- Activation

Access Server provides two web interfaces.

Admin Web UI	The administrative interface for configuring Access Server. Administrators use it to manage users, authentication, network access, certificates, VPN settings, licensing, logging, and other settings. The URL typically ends in `/admin/`, such as `https://vpn.example.com/admin/`. See the user manual.
Client Web UI	The user-facing interface for downloading OpenVPN Connect and connection profiles. Users sign in with their VPN credentials. Its URL is typically the Access Server hostname without `/admin/`, such as `https://vpn.example.com/`. See the user manual.

The URLs initially displayed during installation use the server's IP address and TCP port 943.

With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.

Connection method	Procedure
Download OpenVPN Connect from the Client Web UI	Navigate to the Client Web UI in a browser. Sign in with user credentials. Download the OpenVPN Connect installer offered for the user's operating system. After it downloads, install the software. Open the app and select the connection profile. The user connects to Access Server.
Download a connection profile	Navigate to the Client Web UI in a browser. Sign in with their user credentials. Select the link under Available Connection Profiles. After the connection profile downloads, upload the file to a VPN client.
Admin distributes connection profiles or installers	Alternatively, as an admin, you can use these ways to connect your users: Have your users install OpenVPN Connect from our website, then download a connection profile from the Admin Web UI and distribute it to users. Create an OpenVPN Connect installer from the Access Server command-line interface and distribute it to users.

Connection method

Procedure

Download OpenVPN Connect from the Client Web UI

Navigate to the Client Web UI in a browser.
Sign in with user credentials.
Download the OpenVPN Connect installer offered for the user's operating system.
After it downloads, install the software.
Open the app and select the connection profile.
- The user connects to Access Server.

Download a connection profile

Navigate to the Client Web UI in a browser.
Sign in with their user credentials.
Select the link under Available Connection Profiles.
After the connection profile downloads, upload the file to a VPN client.

Admin distributes connection profiles or installers

Alternatively, as an admin, you can use these ways to connect your users:

Have your users install OpenVPN Connect from our website, then download a connection profile from the Admin Web UI and distribute it to users.
Create an OpenVPN Connect installer from the Access Server command-line interface and distribute it to users.

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.

🕒 Change default time zone⁠

If the server uses a different time zone than you require, run:
```
sudo dpkg-reconfigure tzdata
```
Follow the prompts to select the appropriate time zone.

⏰ Verify time synchronization⁠

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.

🔄 Update operating-system software⁠

Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
```
sudo apt-get update
sudo apt-get upgrade
```
Review the packages before applying updates in production and reboot the server when required.

🛡️ Further security recommendations⁠

Review the security guidance that applies to your deployment:

Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

DigitalOcean VPN Server Guide for Droplet and Access Server⁠

🖥️Create a Droplet⁠

Was this information helpful?