IBM VPN Server Setup & Quick Start Guide

Abstract

The IBM Cloud VPN lets you quickly launch Access Server to get your VPN server up and running. Here's how.

Access Server provides an IBM Cloud VPN that you can get up and running within minutes.

Working with IBM Cloud, you choose from one of its services to run on virtualized hardware. By using the Access Server offering in their marketplace, you can launch a VPN hosted in the cloud with the following benefits:

Read on for your guide to getting started with your VPN server on the web.

⚙️ Before you start

You need an SSH key to launch the VPC. You'll use this key to connect to the VPC's virtual console to complete Access Server's installation. To create the key:

Sign in to IBM Cloud.
Expand the navigation menu and click Infrastructure > Compute > SSH keys.
Click Create.
Fill out your details for the key and click Create.

🛡️ Launch the VPC

To get started:

Sign in to the Access Server Hub on our site or create a new account.
Click Get Access Server and click IBM Cloud under Cloud provider (IaaS).
Review the installation video for reference if you'd like.
Click Go To The Marketplace and sign in to your IBM Cloud account if necessary.
On the product details page, select the Product version.
Set up the Name, Location, Resource group, and Tags.

Define the required values:

Parameter	Description	Value
instance_profile	VM size and family profile (e.g., cx2-2x4).	Refer to IBM documentation for instance profiles information. Default: `cx2-2x4`.
region	IBM Cloud region name.	Select your region from the drop-down menu.
region_zone	Availability zone name within the specified region.	The availability zone within the region you selected.
ssh_public_key	Pre-created SSH public key name for instance access.	Enter your SSH public key's name.
prefix	Prefix added to the name of all resources that will be created.	Use a unique prefix for each new resource (like VPC, subnet, security group, gateway, floating, IP, etc.). Default: `openvpn-as`. Tip If you want to create one or more Access Server in the same region and zone with existing VPCs, use a unique `prefix` to avoid creating resources with the same names.

Define any optional variables you want:

Parameter	Description	Value
dns_domain_name	DNS domain name (e.g., example.com).	Define this if you will manage DNS on IBM.
dns_entry_name	DNS entry name (e.g., www).	Define this if you will manage DNS on IBM.
dns_responsible_person	Email address of the responsible person for the DNS entry	Define this if you will manage DNS on IBM.
vpc_existing_name	The name of the existing VPC to use.	Define this to launch an image on an existing VPC.

Check the license agreement and click Install.
After the cart is created successfully and the terraform commands run, you can push Generate plan to estimate costs.
Note
The cart creation and Terraform commands typically take 2-5 minutes to complete.
Run Apply plan to create all needed resources.

🔒 Sign in to the Admin Web UI for the first time

Once the new image is launched, you can view all the needed info about it:

Expand the navigation menu.
Click Infrastructure > Compute > Virtual server instances.
The new instance details are displayed, such as name, status, and IP address.
Check the other created resources in these locations under Network:
- VPC
- Subnet
- Security groups
- Public Gateway
- Floating IP
Use the floating IP address to connect via terminal:
```
ssh -i /path/to/your/key.pem root@<floating_ip>
```

Find the temporary password you'll need to sign in to the Admin Web UI:

cat /usr/local/openvpn_as/init.log | grep -i '"openvpn" account with .* password'

Access The Admin Web UI via these URLs:
- Admin Web UI: https://PUBLIC_IP:943/admin
- Client Web UI: https://PUBLIC_IP:943/
You can now follow additional steps here: First-Time Setup.

🔑 Purchase and activate a subscription

To purchase and activate a subscription license for Access Server:

Sign in or create a new account on our website for the Access Server product.
Select Start 14-Day Free Trial or Try Free Version.
Tip
If you already have a subscription, click Activation Keys and purchase more.
If you select Start 14-Day Free Trial:
- Enter the number of VPN connections you want (10 is the default).
- Provide billing information.
- Complete the trial setup. Billing begins after the 14-day trial ends.
If you select Try Free Version:
- A free subscription with 2 VPN connections is created automatically.
- No billing information is required.
Click to copy your new activation key.
Sign in to your Access Server’s Admin Web UI.
Click Activation.
Click Activate License Key
Paste the activation key into the field.
Click Activate License Key.
- Access Server loads the subscription.

⚙️ Next Steps

After confirming that users can connect successfully, complete any operating-system maintenance and security hardening required for your production deployment.

🕒 Change default time zone

If the server uses a different time zone than you require, run:
```
sudo dpkg-reconfigure tzdata
```
Follow the prompts to select the appropriate time zone.

⏰ Verify time synchronization

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the Droplet and configure it according to your operating-system requirements.

🔄 Update operating-system software

Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
```
sudo apt-get update
sudo apt-get upgrade
```
Review the packages before applying updates in production and reboot the server when required.

🛡️ Further security recommendations

Review the security guidance that applies to your deployment:

Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

In this section: