Official Docker VPN Server with Access Server | OpenVPN
This guide walks you through launching Access Server in a Docker container.
Docker is a tool that a sysadmin can use to deploy an application in a sandbox, called a container, to run on a host operating system. Using a Docker container has a lower overhead than a virtual machine.
Access Server gives you the following benefits:
A self-hosted VPN solution.
A simplified, rapid deployment of secure remote access and site-to-site solutions.
A web-based administration interface.
Built-in OpenVPN Connect app distribution with bundled connection profiles.
Prerequisites
Before you can proceed with the steps here, ensure you have the following on your preferred host system:
Docker Engine installed.
A public IP address or domain name pointed to the public IP address.
Follow the next sections to run Docker commands from the terminal.
The first step is to add the Access Server image to your system.
Run the following in the terminal:
docker pull openvpn/openvpn-asThe
pullcommand gets the openvpn-as image from the Docker registry and saves it to your system.
If you want to see all the images on your system, use the
docker imagescommand.% docker images REPOSITORY TAG IMAGE ID CREATED SIZE openvpn/openvpn-as latest 22785eb5796a 12 days ago 657MB
Now you can run a Docker container based on the openvpn-as image.
Run the Docker container based on the Access Server image with these parameters:
docker run -d \ --name=openvpn-as --device /dev/net/tun \ --cap-add=MKNOD --cap-add=NET_ADMIN \ -p 943:943 -p 443:443 -p 1194:1194/udp \ -v <path to data>:/openvpn \ --restart=unless-stopped \ openvpn/openvpn-asProvides access to the TUN device for VPN traffic.
Allows the container to create device nodes.
Grants the container the necessary network administration capabilities.
Opens up the necessary ports: 943 for the Admin Web UI, 443 for TCP, and 1194 for UDP.
Location for storing the Access Server configuration files. Replace <path to data> with your preferred file path.
Tells Docker to automatically restart the container if it stops unexpectedly or the Docker daemon restarts, but not if you explicitly stop it.
The Docker client loads the openvpn/openvpn-as image in a container. You can see the running container in the Docker Desktop app or with the command
docker ps.
You've installed Access Server, and the container is running. You can now sign in to the Admin Web UI, a web-based GUI for managing your VPN server, with or without Linux knowledge.
The Admin Web UI is available at https://DOCKER-HOST-IP:943/admin.
Find the temporary password
The default user is openvpn, and you can find the temporary password created with the initial Access Server configuration in the container logs:
With the container running, display the logs with this command:
docker logs openvpn-as 2>&1 | grep -i 'Auto-generated pass = .*'Expected output:
Auto-generated pass = "<password>". Setting in db...
If the previous command doesn't give an output, run:
docker logs -f openvpn-asThe Access Server Initial Configuration Tool output displays.
Scroll to find the line, Auto-generated pass = "<password>". Setting in db...
Use the generated password with the openvpn username to sign in to the Admin Web UI.
Sign in as an administrator
To access and sign in to the Admin Web UI:
Open a web browser.
Enter the Admin Web UI URL, available at https://DOCKER-HOST-IP:943/admin.
A security warning displays. Access Server uses a self-signed SSL certificate. We recommend replacing it with a signed certificate. Refer to SSL Certificates.
Proceed through the security warning.
The Admin Login displays.
Enter the openvpn username with the temporary password and select Sign In.
The EULA displays for you to read through, accept, and proceed to the Admin Web UI configuration pages.
Access Server includes the sacli tool for managing configuration from the command line. When running Access Server in Docker, you need to execute sacli commands from the container.
You can run sacli commands in two ways:
Option 1: Run sacli directly from the host
Run a single
saclicommand from the host system without entering the container:docker exec -it openvpn-as /bin/bash sacli version
This method is useful for quick commands or scripting.
Option 2: Enter the container and run sacli
Open an interactive shell inside the container:
docker exec -it openvpn-as /bin/bashThen run
saclicommands directly:sacli version
This method is useful when running multiple commands or troubleshooting.
For your devices to properly connect to your VPN server, you need to update the domain or public IP address:
Sign in to the Admin Web UI.
Select VPN Server.
Change the Hostname (or IP Address) field to a public IP address or your domain name.
Select Save and Restart.
The following are known issues or limitations if you deploy Access Server from a Docker image:
Failover mode: This feature isn't supported.
Layer 2 (bridging): This mode isn't supported.
Fixed license keys: This license key model isn't supported. Using fixed keys can cause license invalidation because the hardware specification fingerprint isn't persistent.
DCO: DCO support depends on the Linux kernel version running on your Docker host:
Linux kernel 6.16 or newer: The latest Access Server Docker image ships with Access Server 3.2.2, which includes DCO support built into the kernel. No additional installation is needed on the Docker host as Access Server uses DCO automatically.
Linux kernel older than 6.16: To use DCO, you need to install it manually on the Docker host before running the container. See Step 1: Install DCO for instructions.
Clustering: You can use Access Servers, deployed from Docker images, to build cluster functionality with the following limitations:
You can only run one cluster node per Host system at a time.
Hosts must be available directly from the internet, not via a load balancer, proxy, or ingress controller.
Performance: The additional abstraction layer can cause performance degradation and increase latency. We don't recommend deploying highly loaded installations using Docker.
PAM authentication method: We recommend avoiding PAM as your authentication method because user credentials stored inside the container aren't persistent.
Logs: Access Server forwards logs to Docker, so it can't handle logging in the Access Server configuration. See the Docker logging documentation to set up rotation, forwarding, etc.
IPv6: We don't recommend Access Server inside a Docker container if you plan to use IPv6 for VPN clients because IPv6 support in the Docker network toolset is limited/experimental.
Expand the section below to help you find your answer, or contact our support team for help.
You can replace your Docker container with a new Access Server image, but you must first save your configuration data outside of the Docker image.
Access Server stores the configuration files on a defined volume/folder. To move to a new image, you need to copy the files from that location or use the same volume/folder to run a new Access Server image. The specific steps depend on the defined folder directory for storing these files as set in the docker run command, -v <path to data>:/openvpn. That folder on the host contains the /etc directory, making upgrades and rollbacks possible.
If you need to reset the openvpn admin user password, you can do so with Access Server's sacli tool, which you can do from an interactive shell.
From the host system, open an interactive shell:
docker exec -it openvpn-as /bin/bashReset the openvpn admin password:
sacli --user "openvpn" --new_pass '<PASSWORD>' SetLocalPassword sacli start
When upgrading to the latest Access Server version, refer to our tutorial:
You can also deploy Access Server using the official Helm chart, which uses the same Docker image. Helm manages the deployment as a Kubernetes workload and handles configuration, persistent storage, and service exposure automatically.