---
title: Deploy OpenVPN Access Server on IBM Cloud — Quick Start Guide
canonical: https://openvpn.net/as-docs/v3/ibm/
product: Access Server Docs
description: Deploy OpenVPN Access Server on IBM Cloud using the Marketplace image — covers instance creation, initial configuration, Admin Web UI first-time setup, subscription activation, and connecting your first VPN client.
---

# Deploy OpenVPN Access Server on IBM Cloud — Quick Start Guide

Deploy OpenVPN Access Server on [IBM Cloud](https://cloud.ibm.com/catalog/content/openvpn-access-server-57d2386d-4363-41e9-805b-8765af6713f3-global) using the Terraform offering in IBM Cloud — covers configuring the workspace, deploying the virtual server instance, and completing first-time Access Server setup.

Access Server is available from the IBM Cloud catalog as a bring your own license (BYOL) deployment. The Terraform template provisions the IBM Cloud resources required to run Access Server and provide secure remote access to your network.

## ⚙️ Before you start

Before deploying Access Server, you need:

- An IBM Cloud account with permissions to create the required resources.
- An Access Server subscription.
- An SSH key created or imported on IBM Cloud VPC.

The Terraform deployment requires the **name of an existing IBM Cloud VPC SSH key**. To create or import one:

1. Sign in to IBM Cloud.
2. Navigate to **Infrastructure → Compute → SSH keys**.
3. Select **Create**.
4. Create a new key pair or import an existing public SSH key.
5. Note the **name** assigned to the SSH key.

   > **Important**
   >
   > Enter the IBM Cloud SSH key **name**, not the contents of the public key file. For example, enter `openvpn-key`, not the value beginning with `ssh-rsa` or `ssh-ed25519`.

## 🚀 Launch Access Server from IBM Cloud

1. Sign in to the [Access Server Hub](https://as-portal.openvpn.com/deployment) on our site or create a new account.
2. Under **Installation**, select **IBM Cloud**.
3. Select **Launch from IBM Cloud Marketplace**.
4. Review the Access Server offering and the **Terraform** delivery method.
5. Sign in to IBM Cloud or create an account if prompted.
6. Configure the workspace:

   | **Setting** | **Description** |
   | --- | --- |
   | Name | Enter a name for the Terraform workspace. |
   | Location | Select where IBM Cloud stores and runs the workspace. |
   | Resource group | Select the IBM Cloud resource group for the workspace. |
   | Tags | Optionally add tags to organize the workspace. |

   > **Note**
   >
   > The workspace **Location** determines where IBM Cloud Schematics runs and stores the Terraform workspace. It is separate from the IBM Cloud region where you deploy the Access Server resources.
7. Configure the required input variables:

   | **Parameter** | **Description** | **Value** |
   | --- | --- | --- |
   | ``` instance_profile ``` | VM size and family profile (e.g., cx2-2x4). | Refer to IBM [documentation for instance profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles&interface=ui) information. Default: `cx2-2x4`. |
   | ``` region ``` | IBM Cloud region name. | Select your region from the drop-down menu. |
   | ``` region_zone ``` | Availability zone name within the specified region. | The availability zone within the region you selected. |
   | ``` ssh_public_key ``` | Pre-created SSH public key name for instance access. | Enter your SSH public key's name. |
   | ``` prefix ``` | Prefix added to the name of all resources that will be created. | Use a unique prefix for each new resource (like VPC, subnet, security group, gateway, floating, IP, etc.). Default: `openvpn-as`. > **Tip** > > If you want to create one or more Access Server in the same region and zone with existing VPCs, use a unique `prefix` to avoid creating resources with the same names. |
8. Define any optional variables you want (For quick-start deployment, leave optional variables at their default values):

   | **Parameter** | **Description** | **Value** |
   | --- | --- | --- |
   | ``` dns_domain_name ``` | DNS domain name (e.g., example.com). | Define this if you will manage DNS on IBM. |
   | ``` dns_entry_name ``` | DNS entry name (e.g., www). | Define this if you will manage DNS on IBM. |
   | ``` dns_responsible_person ``` | Email address of the responsible person for the DNS entry | Define this if you will manage DNS on IBM. |
   | ``` vpc_existing_name ``` | The name of the existing VPC to use. | Define this to launch an image on an existing VPC. |
   | ``` enable_letsencrypt ``` | Automatically request and install a Let's Encrypt TLS certificate for the instance's public (floating) IP address. | The default is `true`. |
   | ``` image_name ``` | Image name for the Linux server. | Enter a name for the Linux server, or leave the generated value. |
9. Agree to the license agreement and select **Install**.
   - IBM Cloud creates the Schematics workspace and runs the Terraform commands. The Terraform deployment creates the required IBM Cloud resources and generates the credentials required for the initial Access Server Admin Web UI sign-in.

   > **Note**
   >
   > Cart creation and the Terraform commands typically take a few minutes to complete.

   > **Important**
   >
   > After the **Terraform Commands** job completes successfully, you don't need to select **Generate plan** or **Apply plan** for the initial deployment. The installation workflow has already applied the Terraform configuration and created the resources.

## 🔒 Sign in to the Admin Web UI for the first time

After the **Terraform Commands** job completes successfully, retrieve the Access Server sign-in information from the Terraform outputs.

1. Expand the **Terraform commands successful** message.
2. Scroll near the end of the job log to find `Outputs:`.
3. Locate these values:

   | **Output** | **Description** |
   | --- | --- |
   | `admin_password` | Generated password for the administrative account. |
   | `admin_url` | URL for the Access Server Admin Web UI. |
   | `admin_user` | Administrative username. The default is `openvpn`. |
   | `openvpn_instance_id` | IBM Cloud ID for the virtual server instance. |
   | `openvpn_public_ip` | Public IP address assigned to the Access Server instance. |
   | `site_url` | URL for the Access Server Admin and Client Web UIs. |
4. Open the `admin_url` value in your browser.
5. Sign in with the values shown for:
   - **Username:** `admin_user`
   - **Password:** `admin_password`
6. Review the Access Server End User License Agreement (EULA).
7. Select **Agree**.

## 🚀 Walk through the onboarding wizard

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

1. Select whether VPN clients should have:
   - Internet access through Access Server.
   - Access to private network resources.
   - Both, if appropriate for your deployment.
2. If access to private resources is enabled, review the network CIDRs that Access Server detected.
3. Verify that the detected networks match the IBM Cloud resources that VPN users should access.
4. Keep only the networks that VPN users should be allowed to access.
5. Select **Continue**.
6. Review the OpenVPN Connect download offered by the wizard.

   The wizard displays the download appropriate for the operating system of the device you're currently using.
7. Select **Download**.
8. Install OpenVPN Connect.
9. Return to the onboarding wizard.
10. Select **Continue**.
11. The wizard displays a prompt while it waits for a VPN connection.
12. Launch OpenVPN Connect on your device.
13. Connect using the profile included.
14. Confirm that the VPN connection succeeds.
15. Return to the Admin Web UI.
16. Select **Finish Wizard**.

    > **Tip**
    >
    > You can also close the onboarding wizard by selecting the **X** if you prefer to skip these steps.
17. After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
    - The Client Web UI
    - Users
    - Access Controls
    - Authentication
    - Activation

## 🔍 Review the deployed IBM Cloud resources

You can review the resources created by Terraform in IBM Cloud.

1. Expand the IBM Cloud navigation menu.
2. Select **Infrastructure → Compute → Virtual server instances**.
3. Open the Access Server instance to review details such as its status and IP addresses.

You can review the associated networking resources under **Infrastructure → Network**, including:

- VPC
- Subnet
- Security groups
- Public gateway
- Floating IP

## ⚙️ Next Steps

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.

### 🕒 Change default time zone

1. If the server uses a different time zone than you require, run:

   ```
   sudo dpkg-reconfigure tzdata
   ```
2. Follow the prompts to select the appropriate time zone.

### ⏰ Verify time synchronization

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.

### 🔄 Update operating-system software

1. Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:

   ```
   sudo apt-get update
   sudo apt-get upgrade
   ```
2. Review the packages before applying updates in production and reboot the server when required.

### 🛡️ Further security recommendations

Review the security guidance that applies to your deployment:

- [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — Keep Access Server current with supported security and feature updates.
- [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — Replace the temporary administrative password used during initial setup.
- [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
- [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

---

Prev: [Oracle Cloud](https://openvpn.net/as-docs/v3/oracle.md)
Next: [Vultr](https://openvpn.net/as-docs/v3/vultr.md)
Index: https://openvpn.net/as-docs/llms.txt