Deploy OpenVPN Access Server on Google Cloud Platform — Quick Start Guide⁠

After deployment, the Google Cloud Console displays information about your Access Server Compute Engine instance under Outputs in the Details tab:

• Admin Password: A temporary password to sign in for the first time.

• Admin Url: The Admin Web UI URL used to configure and manage Access Server.

• Admin User: The initial administrative username.

• Instance Self Link: API resource URL that uniquely identifies the deployed Compute Engine instance in Google Cloud. Requires authenticated Google Cloud API access.

• Site Url: The Client Web UI URL where users can sign in and download OpenVPN Connect and connection profiles.

To sign in:

1. Open the Admin URL in a web browser.

   • With Let's Encrypt Certificate enabled during deployment, Access Server uses a browser-trusted certificate for the external IP address, so you shouldn't receive the certificate trust warning associated with the default self-signed certificate.

2. Sign in with the admin user and temporary password.

3. Read through the End User License Agreement (EULA).

4. Select Agree.

   • The Onboarding Wizard displays on a fresh Access Server installation.

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

1. Select whether VPN clients should have:

   • Internet access through Access Server.

   • Access to private resources in your GCP environment.

   • Both, if appropriate for your deployment.

2. If access to private resources is enabled, review the network CIDRs that Access Server detected.

3. Verify that the detected networks match the GCP VPC networks users should access.

4. Keep only the networks that VPN users should be allowed to access.

5. Select Continue.

6. Review the OpenVPN Connect download offered by the wizard.

   The wizard displays the download appropriate for the operating system of the device you're currently using.

7. Select Download.

8. Install OpenVPN Connect.

9. Return to the onboarding wizard.

10. Select Continue.

11. The wizard displays a prompt while it waits for a VPN connection.

12. Launch OpenVPN Connect on your device.

13. Connect using the profile included.

14. Confirm that the VPN connection succeeds.

15. Return to the Admin Web UI.

16. Select Finish Wizard.

17. After completing the wizard, the Admin Web UI opens and presents a short product tour covering:

    • The Client Web UI

    • Users

    • Access Controls

    • Authentication

    • Activation

We recommend changing the temporary password for the admin user.

1. Sign in to the Admin Web UI.

2. Select Users.

3. Select the admin user.

4. Select Reset Password.

5. Enter a new password in the password field.

6. Select Reset.

   • Password changed.

You can now create more users and test the VPN.

If you left Public Static IP enabled during deployment, Google Cloud assigns the Access Server Compute Engine instance a persistent external IP address.

You can verify the address in the Google Cloud Console.

We recommend keeping a static external IP for production deployments so the address used by VPN clients and the Access Server web interfaces remains consistent.

If you disabled Public Static IP during deployment and later need a persistent address, refer to Google Cloud documentation for reserving and assigning a static external IP address.

By default, Access Server uses the instance's external IP address as its server address.

For production deployment, we recommend configuring a DNS hostname, such as vpn.example.com.

A hostname provides a recognizable endpoint for VPN users and administrators and avoids tying connection configuration directly to an IP address.

Refer to Setting Up Your Access Server Hostname for the Admin/Client Web UIs.

If your Access Server deployment requires a subscription activation key, you can obtain one from the Access Server Hub.

For instructions, refer to Purchase and Activate an Access Server Subscription License (Admin Web UI).

When Let’s Encrypt Certificate is enabled during the Google Cloud Marketplace deployment, Access Server automatically configures a browser-trusted certificate for the instance's external IP address. You don't need to replace it simply to remove a browser certificate warning.

You may need to configure a different certificate if you:

• Disabled Let's Encrypt Certificate during deployment.

• Configure a custom hostname for the Access Server web interfaces.

• Need to use a certificate issued by a different certificate authority.

For certificate configuration options, refer to:

• Tutorial: How to Install a Valid Web SSL Certificate in Access Server

• Tutorial: How to Use ACME Client to Issue Web SSL Certificates for the Access Server UI

• Tutorial: Install Web SSL Certificates on Access Server Using Google Trust Services, ZeroSSL, SSL.com, or Actalis

• Tutorial: Issue Let's Encrypt SSL Certificates via the Access Server Web API, Including IP Address Certificates

• Tutorial: Install a Let's Encrypt Wildcard SSL Certificate on Access Server with Certbot

By default, Access Server gives VPN clients access to your VPC using network address translation (NAT). Using this method, traffic originating from the VPN clients appears to come from Access Server’s local IP address.

However, one drawback of this method is that traffic from the VPC itself can’t directly access a VPN client as the NAT engine prevents it. To make a VPN client directly addressable via the VPC, configure Access Server with routing instead of NAT. When you enable and configure routing, Access Server keeps the source IP address of VPN-client packets intact, and it’s possible to have direct access from the VPC network to the VPN client. However, the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, so it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Google routing table for your VPC so that the return traffic flows properly. To learn how to do this, refer to this document on Google VPC routing:

Routes | VPC | Google Cloud

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.