Microsoft Hyper-V Virtual Appliance Quick Start Guide
We deliver Access Server for Microsoft Hyper-V as a downloadable disk image that can be deployed on Hyper-V.
The Access Server Hyper-V appliance is based on Ubuntu 24.04 LTS.
The appliance includes Hyper-V guest support software.
We advise setting a minimum of 1GB of RAM for the virtual machine.
The appliance is delivered as a disk image to be attached to a new VM.
You must use a Generation 2 type VM with secure boot disabled.
This guide provides the steps to download the virtual hard disk (VHD) file, create a new virtual machine with the Hyper-V Manager, attach the VHD, and then get started with the Access Server web interface.
🖥️ Download the Access Server virtual hard disk (VHD) image
Follow the steps below to download the Access Server Hyper-V .zip file, and unpack the .vhdx file inside to a suitable location for storing virtual machine hard disk images.
Sign in to the Access Server portal. If you don't have a free account, create one.
Click Install Access Server, and then click the Windows Icon.
The Hyper-V disk image tab displays.
Click Download Hyper-V Disk Image.
Extract the zip file.
Once you've downloaded the VHD, you can create a generation 2 type virtual machine (VM).
Launch Hyper-V Manager.
Ensure that Hyper-V has an external virtual network switch.
Create a Generation 2 type virtual machine.
Give this new VM at least 1GB of RAM.
For the network interface select the external virtual network switch.
For the virtual hard disk, choose Use an existing hard disk.
Select the .vhdx file extracted earlier.
Then complete the wizard.
Edit the settings of the new VM and uncheck Enable secure boot.
You can now start the VM and connect to the console.
Once you've created the virtual machine, sign in to the console. You can access the appliance console directly from the Hyper-V Manager using these credentials:
Username: root
Password: openvpnas
After signing in, you'll immediately see the Access Server version details and the Admin Web UI URL. Wait a few seconds for the login credentials for the 'openvpn' user to appear.
Example screen output after signing in to the appliance console:
OpenVPN Access Server Appliance 3.0.2 openvpn2 tty1 Web UI: https://192.0.2.84:943/admin To login please use the "openvpn" account with "U8zqy2CzYgAt" password. openvpn2 login:
Open a browser and enter the Admin Web UI URL to manage your Access Server configuration.
SSH Access: If you prefer SSH to connect, you'll need to create a new user since SSH via credentials for the root user is disabled by default. Follow these steps:
Create a new user:
adduser --gecos GECOS USERNAMEReplace USERNAME with your desired username.
At the prompt, enter and confirm a password.
Add sudo privileges:
adduser USERNAME sudoYou can SSH to your Access Server virtual machine using the new user credentials.
Optional: You can configure SSH access by adding an SSH key to the root account or modifying the
sshd_configfile. For these methods, please look for online documentation.
Administrative User
For the first use of the Admin Web UI, sign in with the openvpn user created during setup. The user’s password is randomly generated and displays in the output at the completion of setup.
You can now open a browser and enter your Admin Web UI address.
Invalid Certificate
Access Server’s web interface comes with a self-signed certificate. This allows you to sign in to the Admin Web UI right away. Since it’s self-signed, it triggers an expected warning. We recommend adding your own SSL certificate in the Admin Web UI to resolve this.
By clicking through to the site, you can continue to the web interface. At the login screen, enter the username and password for your openvpn user.
To purchase and activate a subscription license for Access Server:
Sign in or create a new account on our website for the Access Server product.
Select the 14-day trial or to deploy your first Access Server.
If you select the 14-day trial:
Enter the number of VPN connections you want (10 is the default).
Complete the trial setup. Billing begins after the 14-day trial ends.
If you select to deploy your first Access Server:
A free subscription with 2 VPN connections is created automatically.
No billing information is required.
Copy your new activation key.
Sign in to your Access Server’s Admin Web UI.
Select Activation.
Select Activate License Key
Paste the activation key into the field.
Select Activate License Key.
Access Server loads the subscription.
We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: vpn.example.com. This provides an easier user experience than remembering the server's IP address.
Refer to Hostname and follow the steps.
Access Server supports using multiple authentication methods for VPN users.
Sign in to the Admin Web UI.
Navigate to Authentication.
Configure the authentication method appropriate for your organization.
Access Server supports:
Local authentication.
PAM.
RADIUS.
LDAP.
SAML.
Access Server can also use multiple authentication systems simultaneously.
Refer to Authentication System for more information.
With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.
Connection method | Procedure |
|---|---|
Download OpenVPN Connect from the Client Web UI |
|
Download a connection profile |
|
Admin distributes connection profiles or installers | Alternatively, as an admin, you can use these ways to connect your users:
|
We recommend the following steps to improve your security and detail each step below:
Change the root user's password.
Change the Admin Web UI admin user's password.
Perform software updates periodically.
Ensure you change the default root password to one of your choosing.
Connect to the appliance and sign in as the root user.
Enter this command to change the root user password:
passwd
Change the initial admin user's password for the Admin Web UI:
Sign in to the Admin Web UI.
Click Users.
Click the openvpn user.
Click Reset Password in the user details on the side.
Enter a new password, and click Reset.
The virtual appliance is delivered as a starting point that you should update to get the latest security patches and Access Server release.
Sign in to the Access Server appliance console as a root user.
Run these commands one at a time:
apt updateapt upgradeapt upgrade openvpn-asWe recommend that you reboot the appliance after installing updates to ensure they apply correctly.
Check these subsections if you need help.
If you receive the error message, "IndexError: list index out of range," your appliance is deployed on a network without a DHCP service to assign a valid IP address. To resolve this, set a static IP address. You can then sign into the appliance again and restart the openvpnas service with this command:
systemctl restart openvpnasThis is normal behavior due to how the underlying operating system interacts with Hyper-V; this doesn't signify a defect. Your appliance works as expected.
There can be a couple of reasons for this. First, ensure you create an external virtual switch and attach the VM to it. You can do this from Hyper-V Manager.
If an IP address is assigned to your Hyper-V host but not to the virtual machine, you may have a firewall blocking DHCP requests, or you may be on a network that doesn't use DHCP. In that case, setting a static IP on the appliance may solve this problem.
In some networks, you may need to allow the Hyper-V host to communicate with the network with the ability to spoof MAC addresses. That is because the virtual machines need their own MAC addresses to participate in the network, but both the Hyper-V host network traffic and the virtual machine traffic go out through the same Hyper-V host’s network card.
You may have left Secure boot on by default. It must be disabled for the Access Server appliance. Depending on your Hyper-V version, you can find this in the VM settings under the Firmware or Security section depending on your Hyper-V version. You can uncheck Enable secure boot there.
Another possibility is that you are using a generation 1 virtual machine. This is not supported. In this case, create a new virtual machine of generation 2 type, as you can't change the type after creation.
If you see read failure kernel messages complaining about an inability to read data from /dev/sr0, resolve this by either removing any virtual CD/DVD drive from the VM, or attaching an ISO image to that drive. If the error message is about a device other than /dev/sr0, please contact us for advice.
This is a one-time error message during initial startup just before the SSH host keys are automatically generated. Afterward, the SSH service functions normally.