---
title: Deploy OpenVPN Access Server on Google Cloud Platform — Quick Start Guide
canonical: https://openvpn.net/as-docs/v3/google-cloud/
product: Access Server Docs
description: Set up a VPN server on Google Cloud Platform using OpenVPN Access Server from the GCP Marketplace — covers instance launch, IP forwarding configuration for site-to-site or NAT mode, Admin Web UI first-time setup, and subscription activation.
---

# Deploy OpenVPN Access Server on Google Cloud Platform — Quick Start Guide

Deploy OpenVPN Access Server from a Google Cloud Marketplace to quickly set up a self-hosted VPN server on Google Cloud Platform (GCP).

The Access Server Google Cloud Marketplace image streamlines the initial deployment by providing:

- An optional **Public Static IP**, enabled by default.
- A browser-trusted **Let's Encrypt certificate** for the public IP, enabled by default.
- The Admin Web UI URL, administrative username, and temporary password directly in the Google Cloud Console after deployment.
- The Access Server **Onboarding Wizard** for initial configuration and your first VPN connection.

With Access Server on Google Cloud, you can provide [secure remote access](https://openvpn.net/use-cases/secure-remote-access/) to applications and private resources hosted in your VPC, connect remote users to your Google Cloud environment, and build site-to-site VPN connectivity when needed.

For more information about running Access Server on GCP, refer to the [Google Cloud VPN Solution](https://openvpn.net/google-cloud-vpn/) page.

> **Tip**
>
> Refer to our [system requirements](https://openvpn.net/as-docs/v3/system-requirements.md) to ensure your system works with Access Server.

## 🚀 Launch the instance

Access Server provides several deployment options for Google Cloud Platform (GCP):

- [Google Cloud Launcher](https://openvpn.net/as-docs/v3/access-server-link.md) (Access Server Link)
- [Linux on GCP](https://openvpn.net/as-docs/linux-distributions.md)
- [Docker on GCP](https://openvpn.net/as-docs/v3/docker.md)
- Google Cloud Marketplace

This guide covers deployment from **Google Cloud Marketplace**.

1. Sign in to the [Access Server Hub](https://as-portal.openvpn.com/deployment) on our site or create a new account.
2. Under **Installation**, select **Google Cloud**.
3. Under **Google Cloud Deployment Options**, select **Google Cloud Marketplace Options**.
4. Select **Launch from Google Cloud Marketplace**.
5. Sign in to your Google Cloud account if prompted.
6. Review the Access Server listing in Google Cloud Marketplace.
7. Select **Get Started**.
8. Review and accept the applicable agreements,
9. Enable billing for your Google Cloud project if prompted.
10. Select **Deploy**.
11. If Google Cloud reports that required APIs aren't enabled, review the listed APIs.
12. Select **Enable**.
    - Google Cloud enables the required APIs and returns you to the deployment configuration.
13. Configure the deployment settings for your environment.

    | **Setting** | **Description** |
    | --- | --- |
    | **Deployment name** | Name for the deployment. The default is `openvpn-1`. |
    | **Deployment Service Account** | Select an existing service account or create a new one for the deployment. |
    | **Select a Service Account** | Drop-down for available service accounts, if you select existing account. |
    | **Service account name** | Name for the new service account, if you create one. |
    | **Service account ID** | Identifier for the new service account. |
    | **Service account description** | Optional description for the service account. |
    | **Region** | Google Cloud region where you want to deploy Access Server. |
    | **Zone** | Availability zone within the selected region. |
    | **Machine type category** | Select **General, Compute optimized**, or **Memory optimized**. |
    | **Series** | Select the Compute Engine machine series appropriate for your workload. |
    | **Machine type** | Select the preset virtual hardware resources combination for your workload. |
    | **Boot disk type** | Select the storage type for the boot disk. |
    | **Boot disk size in GB** | Specify the boot disk capacity. |
    | **Existing VPC name** | Enter the exact name for the Google VPC where you want to deploy Access Server or leave blank to create a new one. |
    | **Existing subnet name** | Enter the exact name for the subnet for the Access Server instance or leave blank to create a new one. |
    | **Subnet IP CIDR range** | Specify the subnet CIDR range when required by your network configuration. |
    | **IP forwarding** | Enable for **site-to-site VPN** deployments where Access Server must route traffic between networks. Disable when using **NAT mode** for standard remote access. |
    | **Use a static external IP address** | Enabled by default. We recommend keeping this enabled so the Access Server instance retains a persistent external IP address. |
    | **Enable Let's Encrypt certificate for the external IP address** | Enabled by default. Access Server requests a browser-trusted certificate for the external IP address. > **Important** > > If you disable **Public Static IP**, the instance's external IP address can change. Because the Let's Encrypt certificate is issued for the public IP, changing that address can also require updating the Access Server configuration and certificate. |
    | **Allow HTTPS (VPN traffic)** | Enabled by default. Allows HTTPS VPN traffic. |
    | **Source IP ranges for HTTPS traffic** | Specify the source networks allowed to reach the HTTPS service. |
    | **Allow TCP port 943 (Admin/User GUI traffic)** | Enabled by default. Allows access to the Admin Web UI and Client Web UI on TCP 943. |
    | **Source IP ranges for TCP port 943 traffic** | Specify the source networks allowed to access the web interfaces on TCP 943. |
    | **Allow UDP port 1194 (VPN traffic)** | Enabled by default. Allows OpenVPN UDP traffic on port 1194. |
    | **Source IP ranges for UDP port 1194 traffic** | Specify the source networks allowed to reach UDP port 1194. |
    | **Allow TCP port 22 (SSH traffic)** | Enabled by default. Allows SSH access to the Compute Engine instance. |
    | **Source IP ranges for TCP port 22 traffic** | Specify the source networks allowed to connect over SSH. |

    > **Tip**
    >
    > For administrative services such as TCP 943 and SSH, restrict the source IP ranges to trusted administrative networks whenever possible rather than allowing unrestricted internet access.
14. Review the deployment configuration.
15. Select **Deploy**.
16. Wait for Google Cloud to finish deploying the Access Server Compute Engine instance.
17. In the **DETAILS panel**, locate and save:
    - Admin URL
    - Admin User
    - Admin Password (Temporary)

    > **Note**
    >
    > The Access Server services and Let’s Encrypt certificate may take a few minutes to finish initializing after the Google Cloud Marketplace deployment completes.

> **Important**
>
> **Deployment recommendations**
>
> - Leave **Public Static IP** enabled so you have a persistent public address. Otherwise, Google Cloud assigns an ephemeral IP address, which can change when the instance is stopped or otherwise reconfigured. Using a static external IP provides a consistent endpoint for VPN client connections, DNS records, the Admin Web UI, the Client Web UI, and the Let's Encrypt certificate issued for the public IP.
> - Leave **Let's Encrypt Certificate** enabled so Access Server can request a browser-trusted Let's Encrypted certificate for the instance's external IP address during deployment. This lets you open the Admin Web UI and Client Web UI securely, without the browser certificate warnings typically shown for self-signed certificates.
> - Configure **IP forwarding** based on how you plan to use Access Server. Enable it for site-to-site VPN deployments where Access Server routes traffic between networks. Disable it for NAT mode for standard remote access connections.

## 🌐 Sign in to the Admin Web UI for the first time

After deployment, the Google Cloud Console displays information about your Access Server Compute Engine instance under **Outputs** in the **Details** tab:

- **Admin Password:** A temporary password to sign in for the first time.
- **Admin Url:** The Admin Web UI URL used to configure and manage Access Server.
- **Admin User:** The initial administrative username.
- **Instance Self Link:** API resource URL that uniquely identifies the deployed Compute Engine instance in Google Cloud. Requires authenticated Google Cloud API access.
- **Site Url:** The Client Web UI URL where users can sign in and download OpenVPN Connect and connection profiles.

To sign in:

1. Open the **Admin URL** in a web browser.
   - With **Let's Encrypt Certificate** enabled during deployment, Access Server uses a browser-trusted certificate for the external IP address, so you shouldn't receive the certificate trust warning associated with the default self-signed certificate.
2. Sign in with the admin user and temporary password.
3. Read through the End User License Agreement (EULA).
4. Select **Agree**.
   - The **Onboarding Wizard** displays on a fresh Access Server installation.

## 💻 Walk through the onboarding wizard

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

1. Select whether VPN clients should have:
   - Internet access through Access Server.
   - Access to private resources in your GCP environment.
   - Both, if appropriate for your deployment.
2. If access to private resources is enabled, review the network CIDRs that Access Server detected.
3. Verify that the detected networks match the GCP VPC networks users should access.
4. Keep only the networks that VPN users should be allowed to access.
5. Select **Continue**.
6. Review the OpenVPN Connect download offered by the wizard.

   The wizard displays the download appropriate for the operating system of the device you're currently using.
7. Select **Download**.
8. Install OpenVPN Connect.
9. Return to the onboarding wizard.
10. Select **Continue**.
11. The wizard displays a prompt while it waits for a VPN connection.
12. Launch OpenVPN Connect on your device.
13. Connect using the profile included.
14. Confirm that the VPN connection succeeds.
15. Return to the Admin Web UI.
16. Select **Finish Wizard**.

    > **Tip**
    >
    > You can also close the onboarding wizard by selecting the **X** if you prefer to skip these steps.
17. After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
    - The Client Web UI
    - Users
    - Access Controls
    - Authentication
    - Activation

## 🔒 Update the admin user account password

We recommend changing the temporary password for the admin user.

1. Sign in to the Admin Web UI.
2. Select **Users**.
3. Select the admin user.
4. Select **Reset Password**.
5. Enter a new password in the password field.
6. Select **Reset**.
   - **Password changed.**

You can now create more users and test the VPN.

## 📝 Verify the static external IP address

If you left **Public Static IP** enabled during deployment, Google Cloud assigns the Access Server Compute Engine instance a persistent external IP address.

You can verify the address in the Google Cloud Console.

We recommend keeping a static external IP for production deployments so the address used by VPN clients and the Access Server web interfaces remains consistent.

If you disabled **Public Static IP** during deployment and later need a persistent address, refer to Google Cloud documentation for reserving and assigning a static external IP address.

## 🌍 Change default hostname (Admin Web UI)

By default, Access Server uses the instance's external IP address as its server address.

For production deployment, we recommend configuring a DNS [hostname](https://openvpn.net/as-docs/v3/hostname.md), such as `vpn.example.com`.

A hostname provides a recognizable endpoint for VPN users and administrators and avoids tying connection configuration directly to an IP address.

Refer to [Setting Up Your Access Server Hostname for the Admin/Client Web UIs](https://openvpn.net/as-docs/v3/tutorials/tutorial--custom-hostname.md).

> **Note**
>
> If you configure a hostname after deployment, configure an appropriate web certificate for that hostname as well. The Let’s Encrypt certificate created during the default Google Cloud Marketplace deployment is issued for the instance's external IP address.

## 🔑 Purchase and activate a subscription

If your Access Server deployment requires a subscription activation key, you can obtain one from the [Access Server Hub](https://as-portal.openvpn.com/billing/activation-keys/subscriptions).

For instructions, refer to [Purchase and Activate an Access Server Subscription License (Admin Web UI)](https://openvpn.net/as-docs/v3/tutorials/tutorial--activate-subscription-license.md).

> **Note**
>
> Some new BYOL deployments require activation during the first-run Admin Web UI experience. If **Activate your Access Server** displays after you accept the license agreement, enter a valid activation key before continuing with the Onboarding Wizard.

## 🔐 Configure a web server certificate, if needed

When **Let’s Encrypt Certificate** is enabled during the Google Cloud Marketplace deployment, Access Server automatically configures a browser-trusted certificate for the instance's external IP address. You don't need to replace it simply to remove a browser certificate warning.

You may need to configure a different certificate if you:

- Disabled **Let's Encrypt Certificate** during deployment.
- Configure a custom hostname for the Access Server web interfaces.
- Need to use a certificate issued by a different certificate authority.

For certificate configuration options, refer to:

- [Tutorial: How to Install a Valid Web SSL Certificate in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--install-ssl-certificate.md)
- [Tutorial: How to Use ACME Client to Issue Web SSL Certificates for the Access Server UI](https://openvpn.net/as-docs/v3/tutorials/tutorial--acme-web-ssl-certificates.md)
- [Tutorial: Install Web SSL Certificates on Access Server Using Google Trust Services, ZeroSSL, SSL.com, or Actalis](https://openvpn.net/as-docs/v3/tutorials/tutorial--acme-ssl-certificate-access-server.md)
- [Tutorial: Issue Let's Encrypt SSL Certificates via the Access Server Web API, Including IP Address Certificates](https://openvpn.net/as-docs/v3/tutorials/tutorial--acme-ssl-certificate-web-api.md)
- [Tutorial: Install a Let's Encrypt Wildcard SSL Certificate on Access Server with Certbot](https://openvpn.net/as-docs/v3/tutorials/tutorial--lets-encrypt-ssl-certificate-access-server.md)

## 🔁 Set up static routes (optional)

By default, Access Server gives VPN clients access to your VPC using network address translation (NAT). Using this method, traffic originating from the VPN clients appears to come from Access Server’s local IP address.

However, one drawback of this method is that traffic from the VPC itself can’t directly access a VPN client as the NAT engine prevents it. To make a VPN client directly addressable via the VPC, configure Access Server with routing instead of NAT. When you enable and configure routing, Access Server keeps the source IP address of VPN-client packets intact, and it’s possible to have direct access from the VPC network to the VPN client. However, the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, so it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Google routing table for your VPC so that the return traffic flows properly. To learn how to do this, refer to this document on Google VPC routing:

[Routes \| VPC \| Google Cloud](https://cloud.google.com/vpc/docs/routes)

> **Note**
>
> A site-to-site VPN tunnel with routing requires you to turn on the **IP forwarding** option when you create the instance. If this option is off, any static routing within the VPN network fails. You must relaunch your instance with the correct parameter to correct this issue.

## ⚙️ Next Steps

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.

### 🕒 Change default time zone

1. If the server uses a different time zone than you require, run:

   ```
   sudo dpkg-reconfigure tzdata
   ```
2. Follow the prompts to select the appropriate time zone.

### ⏰ Verify time synchronization

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.

### 🔄 Update operating-system software

1. Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:

   ```
   sudo apt-get update
   sudo apt-get upgrade
   ```
2. Review the packages before applying updates in production and reboot the server when required.

### 🛡️ Further security recommendations

Review the security guidance that applies to your deployment:

- [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — Keep Access Server current with supported security and feature updates.
- [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — Replace the temporary administrative password used during initial setup.
- [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
- [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

## See also

- [GCP Frequently Asked Questions](https://openvpn.net/as-docs/faq-gcp.md)
- [Support for Access Server on Google Cloud Platform](https://openvpn.net/as-docs/support-for-gcp.md)
- [Google Cloud VPN Solution](https://openvpn.net/google-cloud-vpn/)
- [Secure Remote Access](https://openvpn.net/use-cases/secure-remote-access/)
- [Tutorial: Connect your GCP VPC to CloudConnexa by Deploying a Connector](https://openvpn.net/use-cases/secure-remote-access/)

---

Prev: [AWS Tiered](https://openvpn.net/as-docs/v3/aws-tiered.md)
Next: [DigitalOcean](https://openvpn.net/as-docs/v3/digitalocean.md)
Index: https://openvpn.net/as-docs/llms.txt