Oracle VPN: Cloud VPN Quick Start Guide from OpenVPN

Abstract

Access Server VPN for Oracle instance lets you quickly launch a VPN server on your Oracle account.

Access Server provides an Oracle Cloud VPN that you can get up and running within minutes.

Working with Oracle Cloud, you use their instances, which are Linux-based virtual machines running on virtualized hardware. By using the Access Server instance from their Marketplace, you can launch a VPN hosted in the cloud, with the following benefits:

Read on for your guide to getting started with your VPN server on the web.

🚀 Launch the instance

To get started: sign into the Access Server portal, click Get Access Server and click the Oracle listing for Access Server on their marketplace. Then these steps:

Sign in to the Access Server portal on our site or create a new account.
Click Install Access Server, and select Oracle.
Click Launch From Orace Cloud Marketplace and sign in to your Oracle account if necessary.
On the Access Server listing, click Get App.
Select the latest version and the compartment.
Review and accept the Oracle terms and click Launch Instance.
Enter a name for your instance if you want to change it from the generated name.
Select your virtual cloud network and subnet.
Generate a new SSH key or input your public SSH key.
Click Create.
Add a Network Security Group to your instance with the rules outlined in the table below.

Direction	Source Type	Source	Protocol	Source Port	Destination Port
Ingress	CIDR	0.0.0.0/0	TCP	All	943
Ingress	CIDR	0.0.0.0/0	TCP	All	22
Ingress	CIDR	0.0.0.0/0	TCP	All	443
Ingress	CIDR	0.0.0.0/0	UDP	All	1194

Tip

Port TCP 22 doesn't need to be open to all IP addresses (0.0.0.0/0). This access is only required to manage the instance. For better security, restrict the source IP to only the administrator's IP address.

🖥️ Connect to your instance

Once your image deploys, you can connect with an SSH client.

We provide instructions on how to connect with a common use case for Windows OS users with the PuTTY SSH Client: Connect to Access Server via SSH Using PuTTY.

🖥️ Finish Access Server installation

The initial Access Server configuration tool runs automatically the first time you sign into the instance.

For this guide, we assume you choose the default values by pressing ENTER for each choice.

You can now connect to the Admin Web UI with ‘openvpn’ and the generated password with the URL https://[youripaddress]/admin.

Tip

Replace "[youripaddress]" with the static IP address of your server.

🛠️ Finish Access Server configuration

Now that you've installed Access Server, follow these next steps.

Find the URLs for your web server

When you complete the installation process on the command line, the output displays the URLs for your admin UI and client UI as well as the username and randomly generated password for the admin account.

+++++++++++++++++++++++++++++++++++++++++++++++ 
Access Server 3.2.2 has been successfully installed in /usr/local/openvpn_as
Configuration log file has been written to /usr/local/openvpn_as/init.log

Access Server Web UIs are available here:
Admin UI: https://198.51.100.130:943/admin
Client UI: https://198.51.100.130:943 
To login please use the "openvpn" account with "RR4ImyhwbFFq" password.
(password can be changed on Admin UI)
+++++++++++++++++++++++++++++++++++++++++++++++

Admin UI

The Admin UI is the web-based GUI for managing your Access Server. We refer to it as the Admin Web UI. Typically, it is the address of your server with /admin/ appended, for example https://192.0.2.222/admin/.

When you sign in to the Admin Web UI, you can manage the configuration, certificate, users, and so on as an administrative user. The web-based GUI provides simplified management of complex VPN features rather than having to run Linux-based commands and scripts.

Client UI

The Client Web UI is the web-based GUI where users sign in to download clients or configuration files. Typically, it is the address of your server, https://192.0.2.222 as an example.

Tip

The web services run on port TCP 943, by default, so you can visit them at https://192.168.70.222:943/ and https://192.168.70.222:943/admin/ as well. The OpenVPN TCP daemon that runs on TCP port 443 redirects incoming browser requests so that it is slightly easier for users to open the web interface by leaving the :943 part out.

First time signing into the Admin Web UI

Administrative User

For the first use of the Admin Web UI, sign in with the openvpn user created during setup. The user’s password is randomly generated and displays in the output at the completion of setup.

You can now open a browser and enter your Admin Web UI address.

Invalid Certificate

Access Server’s web interface comes with a self-signed certificate. This allows you to sign in to the Admin Web UI right away. Since it’s self-signed, it triggers an expected warning. We recommend adding your own SSL certificate in the Admin Web UI to resolve this.

By clicking through to the site, you can continue to the web interface. At the login screen, enter the username and password for your openvpn user.

Activating a subscription

To purchase and activate a subscription license for Access Server:

Sign in or create a new account on our website for the Access Server product.
Select Start 14-Day Free Trial or Try Free Version.
Tip
If you already have a subscription, click Activation Keys and purchase more.
If you select Start 14-Day Free Trial:
- Enter the number of VPN connections you want (10 is the default).
- Provide billing information.
- Complete the trial setup. Billing begins after the 14-day trial ends.
If you select Try Free Version:
- A free subscription with 2 VPN connections is created automatically.
- No billing information is required.
Click to copy your new activation key.
Sign in to your Access Server’s Admin Web UI.
Click Activation.
Click Activate License Key
Paste the activation key into the field.
Click Activate License Key.
- Access Server loads the subscription.

🌍 Setting up a hostname

We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: vpn.example.com. This provides an easier user experience than remembering the server's IP address.

Refer to Hostname and follow the steps.

🔑 Setting up authentication

Access Server supports using multiple authentication methods for VPN users.

Sign in to the Admin Web UI.
Navigate to Authentication.
Configure the authentication method appropriate for your organization.

Access Server supports:

Local authentication.
PAM.
RADIUS.
LDAP.
SAML.

Access Server can also use multiple authentication systems simultaneously.

Refer to Authentication System for more information.

📱 Connect users to Access Server

With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.

Connection method	Procedure
Download OpenVPN Connect from the Client Web UI	Navigate to the Client Web UI in a browser. Sign in with user credentials. Download the OpenVPN Connect installer offered for the user's operating system. After it downloads, install the software. Open the app and click on the connection profile. The user connects to Access Server.
Download a connection profile	Navigate to the Client Web UI in a browser. Sign in with their user credentials. Click on the link under Available Connection Profiles. After the connection profile downloads, upload the file to a VPN client.
Admin distributes connection profiles or installers	Alternatively, as an admin, you can use these ways to connect your users: Have your users install OpenVPN Connect from our website, then download a connection profile from the Admin Web UI and distribute it to users. Create an OpenVPN Connect installer from the Access Server command-line interface and distribute it to users.

Tip

Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure split-tunnel traffic, their IP address remains the same for internet traffic.

⚙️ Next Steps

After confirming that users can connect successfully, complete any operating-system maintenance and security hardening required for your production deployment.

🕒 Change default time zone

If the server uses a different time zone than you require, run:
```
sudo dpkg-reconfigure tzdata
```
Follow the prompts to select the appropriate time zone.

⏰ Verify time synchronization

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the Droplet and configure it according to your operating-system requirements.

🔄 Update operating-system software

Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
```
sudo apt-get update
sudo apt-get upgrade
```
Review the packages before applying updates in production and reboot the server when required.

🛡️ Further security recommendations

Review the security guidance that applies to your deployment:

Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

In this section: