Skip to main content

Deploy OpenVPN Access Server on IBM Cloud — Quick Start Guide

Abstract

Deploy OpenVPN Access Server on IBM Cloud using the Marketplace image — covers instance creation, initial configuration, Admin Web UI first-time setup, subscription activation, and connecting your first VPN client.

Deploy OpenVPN Access Server on IBM Cloud using the Terraform offering in IBM Cloud — covers configuring the workspace, deploying the virtual server instance, and completing first-time Access Server setup.

Access Server is available from the IBM Cloud catalog as a bring your own license (BYOL) deployment. The Terraform template provisions the IBM Cloud resources required to run Access Server and provide secure remote access to your network.

⚙️ Before you start

Before deploying Access Server, you need:

  • An IBM Cloud account with permissions to create the required resources.

  • An Access Server subscription.

  • An SSH key created or imported on IBM Cloud VPC.

The Terraform deployment requires the name of an existing IBM Cloud VPC SSH key. To create or import one:

  1. Sign in to IBM Cloud.

  2. Navigate to Infrastructure → Compute → SSH keys.

  3. Select Create.

  4. Create a new key pair or import an existing public SSH key.

  5. Note the name assigned to the SSH key.

    Important

    Enter the IBM Cloud SSH key name, not the contents of the public key file. For example, enter openvpn-key, not the value beginning with ssh-rsa or ssh-ed25519.

🚀 Launch Access Server from IBM Cloud

  1. Sign in to the Access Server Hub on our site or create a new account.

  2. Under Installation, select IBM Cloud.

  3. Select Launch from IBM Cloud Marketplace.

  4. Review the Access Server offering and the Terraform delivery method.

  5. Sign in to IBM Cloud or create an account if prompted.

  6. Configure the workspace:

    Setting

    Description

    Name

    Enter a name for the Terraform workspace.

    Location

    Select where IBM Cloud stores and runs the workspace.

    Resource group

    Select the IBM Cloud resource group for the workspace.

    Tags

    Optionally add tags to organize the workspace.

    Note

    The workspace Location determines where IBM Cloud Schematics runs and stores the Terraform workspace. It is separate from the IBM Cloud region where you deploy the Access Server resources.

  7. Configure the required input variables:

    Parameter

    Description

    Value

    instance_profile

    VM size and family profile (e.g., cx2-2x4).

    Refer to IBM documentation for instance profiles information. Default: cx2-2x4.

    region

    IBM Cloud region name.

    Select your region from the drop-down menu.

    region_zone

    Availability zone name within the specified region.

    The availability zone within the region you selected.

    ssh_public_key

    Pre-created SSH public key name for instance access.

    Enter your SSH public key's name.

    prefix

    Prefix added to the name of all resources that will be created.

    Use a unique prefix for each new resource (like VPC, subnet, security group, gateway, floating, IP, etc.). Default: openvpn-as.

    Tip

    If you want to create one or more Access Server in the same region and zone with existing VPCs, use a unique prefix to avoid creating resources with the same names.

  8. Define any optional variables you want (For quick-start deployment, leave optional variables at their default values):

    Parameter

    Description

    Value

    dns_domain_name

    DNS domain name (e.g., example.com).

    Define this if you will manage DNS on IBM.

    dns_entry_name

    DNS entry name (e.g., www).

    Define this if you will manage DNS on IBM.

    dns_responsible_person

    Email address of the responsible person for the DNS entry

    Define this if you will manage DNS on IBM.

    vpc_existing_name

    The name of the existing VPC to use.

    Define this to launch an image on an existing VPC.

    enable_letsencrypt

    Automatically request and install a Let's Encrypt TLS certificate for the instance's public (floating) IP address.

    The default is true.

    image_name

    Image name for the Linux server.

    Enter a name for the Linux server, or leave the generated value.

  9. Agree to the license agreement and select Install.

    • IBM Cloud creates the Schematics workspace and runs the Terraform commands. The Terraform deployment creates the required IBM Cloud resources and generates the credentials required for the initial Access Server Admin Web UI sign-in.

    Note

    Cart creation and the Terraform commands typically take a few minutes to complete.

    Important

    After the Terraform Commands job completes successfully, you don't need to select Generate plan or Apply plan for the initial deployment. The installation workflow has already applied the Terraform configuration and created the resources.

🔒 Sign in to the Admin Web UI for the first time

After the Terraform Commands job completes successfully, retrieve the Access Server sign-in information from the Terraform outputs.

  1. Expand the Terraform commands successful message.

  2. Scroll near the end of the job log to find Outputs:.

  3. Locate these values:

    Output

    Description

    admin_password

    Generated password for the administrative account.

    admin_url

    URL for the Access Server Admin Web UI.

    admin_user

    Administrative username. The default is openvpn.

    openvpn_instance_id

    IBM Cloud ID for the virtual server instance.

    openvpn_public_ip

    Public IP address assigned to the Access Server instance.

    site_url

    URL for the Access Server Admin and Client Web UIs.

  4. Open the admin_url value in your browser.

  5. Sign in with the values shown for:

    • Username: admin_user

    • Password: admin_password

  6. Review the Access Server End User License Agreement (EULA).

  7. Select Agree.

🚀 Walk through the onboarding wizard

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

  1. Select whether VPN clients should have:

    • Internet access through Access Server.

    • Access to private network resources.

    • Both, if appropriate for your deployment.

  2. If access to private resources is enabled, review the network CIDRs that Access Server detected.

  3. Verify that the detected networks match the IBM Cloud resources that VPN users should access.

  4. Keep only the networks that VPN users should be allowed to access.

  5. Select Continue.

  6. Review the OpenVPN Connect download offered by the wizard.

    The wizard displays the download appropriate for the operating system of the device you're currently using.

  7. Select Download.

  8. Install OpenVPN Connect.

  9. Return to the onboarding wizard.

  10. Select Continue.

  11. The wizard displays a prompt while it waits for a VPN connection.

  12. Launch OpenVPN Connect on your device.

  13. Connect using the profile included.

  14. Confirm that the VPN connection succeeds.

  15. Return to the Admin Web UI.

  16. Select Finish Wizard.

    Tip

    You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.

  17. After completing the wizard, the Admin Web UI opens and presents a short product tour covering:

    • The Client Web UI

    • Users

    • Access Controls

    • Authentication

    • Activation

🔍 Review the deployed IBM Cloud resources

You can review the resources created by Terraform in IBM Cloud.

  1. Expand the IBM Cloud navigation menu.

  2. Select Infrastructure → Compute → Virtual server instances.

  3. Open the Access Server instance to review details such as its status and IP addresses.

You can review the associated networking resources under Infrastructure → Network, including:

  • VPC

  • Subnet

  • Security groups

  • Public gateway

  • Floating IP

⚙️ Next Steps

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.

🕒 Change default time zone

  1. If the server uses a different time zone than you require, run:

    sudo dpkg-reconfigure tzdata

  2. Follow the prompts to select the appropriate time zone.

⏰ Verify time synchronization

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.

🔄 Update operating-system software

  1. Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:

    sudo apt-get update
sudo apt-get upgrade

  2. Review the packages before applying updates in production and reboot the server when required.

🛡️ Further security recommendations

Review the security guidance that applies to your deployment:

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

In this section:

The VPN server software, hosted on a Linux operating system.