Deploy OpenVPN Access Server on IBM Cloud — Quick Start Guide⁠

Deploy OpenVPN Access Server on IBM Cloud using the Terraform offering in IBM Cloud — covers configuring the workspace, deploying the virtual server instance, and completing first-time Access Server setup.

Access Server is available from the IBM Cloud catalog as a bring your own license (BYOL) deployment. The Terraform template provisions the IBM Cloud resources required to run Access Server and provide secure remote access to your network.

⚙️ Before you start⁠

Before deploying Access Server, you need:

An IBM Cloud account with permissions to create the required resources.
An Access Server subscription.
An SSH key created or imported on IBM Cloud VPC.

The Terraform deployment requires the name of an existing IBM Cloud VPC SSH key. To create or import one:

Sign in to IBM Cloud.
Navigate to Infrastructure → Compute → SSH keys.
Select Create.
Create a new key pair or import an existing public SSH key.
Note the name assigned to the SSH key.
Important
Enter the IBM Cloud SSH key name, not the contents of the public key file. For example, enter openvpn-key, not the value beginning with ssh-rsa or ssh-ed25519.

Sign in to the Access Server Hub on our site or create a new account.
Under Installation, select IBM Cloud.
Select Launch from IBM Cloud Marketplace.
Review the Access Server offering and the Terraform delivery method.
Sign in to IBM Cloud or create an account if prompted.

Configure the workspace:

Setting	Description
Name	Enter a name for the Terraform workspace.
Location	Select where IBM Cloud stores and runs the workspace.
Resource group	Select the IBM Cloud resource group for the workspace.
Tags	Optionally add tags to organize the workspace.

Configure the required input variables:

Parameter	Description	Value
instance_profile	VM size and family profile (e.g., cx2-2x4).	Refer to IBM documentation for instance profiles information. Default: `cx2-2x4`.
region	IBM Cloud region name.	Select your region from the drop-down menu.
region_zone	Availability zone name within the specified region.	The availability zone within the region you selected.
ssh_public_key	Pre-created SSH public key name for instance access.	Enter your SSH public key's name.
prefix	Prefix added to the name of all resources that will be created.	Use a unique prefix for each new resource (like VPC, subnet, security group, gateway, floating, IP, etc.). Default: `openvpn-as`. Tip If you want to create one or more Access Server in the same region and zone with existing VPCs, use a unique `prefix` to avoid creating resources with the same names.

Define any optional variables you want (For quick-start deployment, leave optional variables at their default values):

Parameter	Description	Value
dns_domain_name	DNS domain name (e.g., example.com).	Define this if you will manage DNS on IBM.
dns_entry_name	DNS entry name (e.g., www).	Define this if you will manage DNS on IBM.
dns_responsible_person	Email address of the responsible person for the DNS entry	Define this if you will manage DNS on IBM.
vpc_existing_name	The name of the existing VPC to use.	Define this to launch an image on an existing VPC.
enable_letsencrypt	Automatically request and install a Let's Encrypt TLS certificate for the instance's public (floating) IP address.	The default is `true`.
image_name	Image name for the Linux server.	Enter a name for the Linux server, or leave the generated value.

Agree to the license agreement and select Install.
- IBM Cloud creates the Schematics workspace and runs the Terraform commands. The Terraform deployment creates the required IBM Cloud resources and generates the credentials required for the initial Access Server Admin Web UI sign-in.
Note
Cart creation and the Terraform commands typically take a few minutes to complete.
Important
After the Terraform Commands job completes successfully, you don't need to select Generate plan or Apply plan for the initial deployment. The installation workflow has already applied the Terraform configuration and created the resources.

After the Terraform Commands job completes successfully, retrieve the Access Server sign-in information from the Terraform outputs.

Expand the Terraform commands successful message.
Scroll near the end of the job log to find Outputs:.

Locate these values:

Output	Description
`admin_password`	Generated password for the administrative account.
`admin_url`	URL for the Access Server Admin Web UI.
`admin_user`	Administrative username. The default is `openvpn`.
`openvpn_instance_id`	IBM Cloud ID for the virtual server instance.
`openvpn_public_ip`	Public IP address assigned to the Access Server instance.
`site_url`	URL for the Access Server Admin and Client Web UIs.

Open the admin_url value in your browser.
Sign in with the values shown for:
- Username: admin_user
- Password: admin_password
Review the Access Server End User License Agreement (EULA).
Select Agree.

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

Select whether VPN clients should have:
- Internet access through Access Server.
- Access to private network resources.
- Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Verify that the detected networks match the IBM Cloud resources that VPN users should access.
Keep only the networks that VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
Tip
You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
- The Client Web UI
- Users
- Access Controls
- Authentication
- Activation

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.

🕒 Change default time zone⁠

If the server uses a different time zone than you require, run:
```
sudo dpkg-reconfigure tzdata
```
Follow the prompts to select the appropriate time zone.

⏰ Verify time synchronization⁠

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.

🔄 Update operating-system software⁠

Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
```
sudo apt-get update
sudo apt-get upgrade
```
Review the packages before applying updates in production and reboot the server when required.

🛡️ Further security recommendations⁠

Review the security guidance that applies to your deployment:

Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Deploy OpenVPN Access Server on IBM Cloud — Quick Start Guide⁠

⚙️ Before you start⁠

Was this information helpful?