Deploy OpenVPN Access Server on Google Cloud Platform — Quick Start Guide
Set up a VPN server on Google Cloud Platform using OpenVPN Access Server from the GCP Marketplace — covers instance launch, IP forwarding configuration for site-to-site or NAT mode, Admin Web UI first-time setup, and subscription activation.
Deploy OpenVPN Access Server from a Google Cloud Marketplace to quickly set up a self-hosted VPN server on Google Cloud Platform (GCP).
The Access Server Google Cloud Marketplace image streamlines the initial deployment by providing:
An optional Public Static IP, enabled by default.
A browser-trusted Let's Encrypt certificate for the public IP, enabled by default.
The Admin Web UI URL, administrative username, and temporary password directly in the Google Cloud Console after deployment.
The Access Server Onboarding Wizard for initial configuration and your first VPN connection.
With Access Server on Google Cloud, you can provide secure remote access to applications and private resources hosted in your VPC, connect remote users to your Google Cloud environment, and build site-to-site VPN connectivity when needed.
For more information about running Access Server on GCP, refer to the Google Cloud VPN Solution page.
Tip
Refer to our system requirements to ensure your system works with Access Server.
🚀 Launch the instance
Access Server provides several deployment options for Google Cloud Platform (GCP):
Google Cloud Launcher (Access Server Link)
Google Cloud Marketplace
This guide covers deployment from Google Cloud Marketplace.
Sign in to the Access Server Hub on our site or create a new account.
Under Installation, select Google Cloud.
Under Google Cloud Deployment Options, select Google Cloud Marketplace Options.
Select Launch from Google Cloud Marketplace.
Sign in to your Google Cloud account if prompted.
Review the Access Server listing in Google Cloud Marketplace.
Select Get Started.
Review and accept the applicable agreements,
Enable billing for your Google Cloud project if prompted.
Select Deploy.
If Google Cloud reports that required APIs aren't enabled, review the listed APIs.
Select Enable.
Google Cloud enables the required APIs and returns you to the deployment configuration.
Configure the deployment settings for your environment.
Setting
Description
Deployment name
Name for the deployment. The default is
openvpn-1.Deployment Service Account
Select an existing service account or create a new one for the deployment.
Select a Service Account
Drop-down for available service accounts, if you select existing account.
Service account name
Name for the new service account, if you create one.
Service account ID
Identifier for the new service account.
Service account description
Optional description for the service account.
Region
Google Cloud region where you want to deploy Access Server.
Zone
Availability zone within the selected region.
Machine type category
Select General, Compute optimized, or Memory optimized.
Series
Select the Compute Engine machine series appropriate for your workload.
Machine type
Select the preset virtual hardware resources combination for your workload.
Boot disk type
Select the storage type for the boot disk.
Boot disk size in GB
Specify the boot disk capacity.
Existing VPC name
Enter the exact name for the Google VPC where you want to deploy Access Server or leave blank to create a new one.
Existing subnet name
Enter the exact name for the subnet for the Access Server instance or leave blank to create a new one.
Subnet IP CIDR range
Specify the subnet CIDR range when required by your network configuration.
IP forwarding
Enable for site-to-site VPN deployments where Access Server must route traffic between networks. Disable when using NAT mode for standard remote access.
Use a static external IP address
Enabled by default. We recommend keeping this enabled so the Access Server instance retains a persistent external IP address.
Enable Let's Encrypt certificate for the external IP address
Enabled by default. Access Server requests a browser-trusted certificate for the external IP address.
Important
If you disable Public Static IP, the instance's external IP address can change. Because the Let's Encrypt certificate is issued for the public IP, changing that address can also require updating the Access Server configuration and certificate.
Allow HTTPS (VPN traffic)
Enabled by default. Allows HTTPS VPN traffic.
Source IP ranges for HTTPS traffic
Specify the source networks allowed to reach the HTTPS service.
Allow TCP port 943 (Admin/User GUI traffic)
Enabled by default. Allows access to the Admin Web UI and Client Web UI on TCP 943.
Source IP ranges for TCP port 943 traffic
Specify the source networks allowed to access the web interfaces on TCP 943.
Allow UDP port 1194 (VPN traffic)
Enabled by default. Allows OpenVPN UDP traffic on port 1194.
Source IP ranges for UDP port 1194 traffic
Specify the source networks allowed to reach UDP port 1194.
Allow TCP port 22 (SSH traffic)
Enabled by default. Allows SSH access to the Compute Engine instance.
Source IP ranges for TCP port 22 traffic
Specify the source networks allowed to connect over SSH.
Tip
For administrative services such as TCP 943 and SSH, restrict the source IP ranges to trusted administrative networks whenever possible rather than allowing unrestricted internet access.
Review the deployment configuration.
Select Deploy.
Wait for Google Cloud to finish deploying the Access Server Compute Engine instance.
In the DETAILS panel, locate and save:
Admin URL
Admin User
Admin Password (Temporary)
Note
The Access Server services and Let’s Encrypt certificate may take a few minutes to finish initializing after the Google Cloud Marketplace deployment completes.
Deployment recommendations
Leave Public Static IP enabled so you have a persistent public address. Otherwise, Google Cloud assigns an ephemeral IP address, which can change when the instance is stopped or otherwise reconfigured. Using a static external IP provides a consistent endpoint for VPN client connections, DNS records, the Admin Web UI, the Client Web UI, and the Let's Encrypt certificate issued for the public IP.
Leave Let's Encrypt Certificate enabled so Access Server can request a browser-trusted Let's Encrypted certificate for the instance's external IP address during deployment. This lets you open the Admin Web UI and Client Web UI securely, without the browser certificate warnings typically shown for self-signed certificates.
Configure IP forwarding based on how you plan to use Access Server. Enable it for site-to-site VPN deployments where Access Server routes traffic between networks. Disable it for NAT mode for standard remote access connections.
After deployment, the Google Cloud Console displays information about your Access Server Compute Engine instance under Outputs in the Details tab:
Admin Password: A temporary password to sign in for the first time.
Admin Url: The Admin Web UI URL used to configure and manage Access Server.
Admin User: The initial administrative username.
Instance Self Link: API resource URL that uniquely identifies the deployed Compute Engine instance in Google Cloud. Requires authenticated Google Cloud API access.
Site Url: The Client Web UI URL where users can sign in and download OpenVPN Connect and connection profiles.
To sign in:
Open the Admin URL in a web browser.
With Let's Encrypt Certificate enabled during deployment, Access Server uses a browser-trusted certificate for the external IP address, so you shouldn't receive the certificate trust warning associated with the default self-signed certificate.
Sign in with the admin user and temporary password.
Read through the End User License Agreement (EULA).
Select Agree.
The Onboarding Wizard displays on a fresh Access Server installation.
The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.
Select whether VPN clients should have:
Internet access through Access Server.
Access to private resources in your GCP environment.
Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Verify that the detected networks match the GCP VPC networks users should access.
Keep only the networks that VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
Tip
You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
The Client Web UI
Users
Access Controls
Authentication
Activation
We recommend changing the temporary password for the admin user.
Sign in to the Admin Web UI.
Select Users.
Select the admin user.
Select Reset Password.
Enter a new password in the password field.
Select Reset.
Password changed.
You can now create more users and test the VPN.
If you left Public Static IP enabled during deployment, Google Cloud assigns the Access Server Compute Engine instance a persistent external IP address.
You can verify the address in the Google Cloud Console.
We recommend keeping a static external IP for production deployments so the address used by VPN clients and the Access Server web interfaces remains consistent.
If you disabled Public Static IP during deployment and later need a persistent address, refer to Google Cloud documentation for reserving and assigning a static external IP address.
By default, Access Server uses the instance's external IP address as its server address.
For production deployment, we recommend configuring a DNS hostname, such as vpn.example.com.
A hostname provides a recognizable endpoint for VPN users and administrators and avoids tying connection configuration directly to an IP address.
Refer to Setting Up Your Access Server Hostname for the Admin/Client Web UIs.
Note
If you configure a hostname after deployment, configure an appropriate web certificate for that hostname as well. The Let’s Encrypt certificate created during the default Google Cloud Marketplace deployment is issued for the instance's external IP address.
If your Access Server deployment requires a subscription activation key, you can obtain one from the Access Server Hub.
For instructions, refer to Purchase and Activate an Access Server Subscription License (Admin Web UI).
Note
Some new BYOL deployments require activation during the first-run Admin Web UI experience. If Activate your Access Server displays after you accept the license agreement, enter a valid activation key before continuing with the Onboarding Wizard.
When Let’s Encrypt Certificate is enabled during the Google Cloud Marketplace deployment, Access Server automatically configures a browser-trusted certificate for the instance's external IP address. You don't need to replace it simply to remove a browser certificate warning.
You may need to configure a different certificate if you:
Disabled Let's Encrypt Certificate during deployment.
Configure a custom hostname for the Access Server web interfaces.
Need to use a certificate issued by a different certificate authority.
For certificate configuration options, refer to:
By default, Access Server gives VPN clients access to your VPC using network address translation (NAT). Using this method, traffic originating from the VPN clients appears to come from Access Server’s local IP address.
However, one drawback of this method is that traffic from the VPC itself can’t directly access a VPN client as the NAT engine prevents it. To make a VPN client directly addressable via the VPC, configure Access Server with routing instead of NAT. When you enable and configure routing, Access Server keeps the source IP address of VPN-client packets intact, and it’s possible to have direct access from the VPC network to the VPN client. However, the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, so it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Google routing table for your VPC so that the return traffic flows properly. To learn how to do this, refer to this document on Google VPC routing:
Note
A site-to-site VPN tunnel with routing requires you to turn on the IP forwarding option when you create the instance. If this option is off, any static routing within the VPN network fails. You must relaunch your instance with the correct parameter to correct this issue.
After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.
🕒 Change default time zone
If the server uses a different time zone than you require, run:
sudo dpkg-reconfigure tzdata
Follow the prompts to select the appropriate time zone.
⏰ Verify time synchronization
Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.
Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.
🔄 Update operating-system software
Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
sudo apt-get update sudo apt-get upgrade
Review the packages before applying updates in production and reboot the server when required.
🛡️ Further security recommendations
Review the security guidance that applies to your deployment:
Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.
Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.