Deploy OpenVPN Access Server on Oracle Cloud — Quick Start Guide

Abstract

Access Server VPN for Oracle instance lets you quickly launch a VPN server on your Oracle account.

Deploy OpenVPN Access Server on Oracle Cloud using the Oracle Marketplace. Access Server is available as a preconfigured image you can deploy.

Working with Oracle Cloud, you use their instances, which are Linux-based virtual machines running on virtualized hardware. By using the Access Server instance from their Marketplace, you can launch a VPN hosted in the cloud, with the following benefits:

🚀 Launch Access Server from Oracle Marketplace

Sign in to the Access Server Hub on our site or create a new account.
Under Installation, select Oracle.
Select Launch From Oracle Cloud Marketplace and sign in to your Oracle account if necessary.
On the Access Server listing, select Get App.
Select the latest version and the compartment.
Review and accept the Oracle terms and select Launch Instance.
Enter a name for your instance if you want to change it from the generated name.
Select your virtual cloud network and subnet.
Generate a new SSH key or input your public SSH key.
Select Create.
Add a Network Security Group to your instance with the rules outlined in the table below.

Direction	Source Type	Source	Protocol	Source Port	Destination Port
Ingress	CIDR	0.0.0.0/0	TCP	All	943
Ingress	CIDR	0.0.0.0/0	TCP	All	22
Ingress	CIDR	0.0.0.0/0	TCP	All	443
Ingress	CIDR	0.0.0.0/0	UDP	All	1194

Tip

Port TCP 22 doesn't need to be open to all IP addresses (0.0.0.0/0). This access is only required to manage the instance. For better security, restrict the source IP to only the administrator's IP address.

🖥️ Connect to your instance

Once your image deploys, you can connect with an SSH client.

We provide instructions on how to connect with a common use case for Windows OS users with the PuTTY SSH Client: Connect to Access Server via SSH Using PuTTY.

🛠️ Complete the initial Access Server configuration

Access Server's initial configuration tool guides you through the first-time Access Server configuration.

For this quick start guide, we assume you use the default configuration values where available.

Review and accept the Access Server End User License Agreement (EULA).
Follow the configuration prompts.
Press ENTER to accept the default values for each configuration option used in this quick start.

When the initial configuration finishes, locate the Access Server sign-in information in the output:

Admin Web UI URL
Client Web UI URL
Administrative username
Generated administrative password

Initial Configuration Complete!

You can now continue configuring OpenVPN Access Server by
directing your Web browser to this URL:
OpenVPN Access Server URL:

During normal operation, OpenVPN AS can be accessed via these URLs:
Admin UI: https://192.0.2.10:943/admin/
Client UI: https://192.0.2.10:943/
To login please use the "openvpn" account with "FKadk2254" password.

See the Release Notes for this release at:
   https://openvpn.net/vpn-server-resources/release-notes/

When prompted to enable Let's Encrypt for the public IP address, enter Y.
Note
If you don't enable Let's Encrypt, or certificate issuance isn't successful, Access Server uses its self-signed certificate. Your browser may display a certificate warning when you open the web interface.

🌐 Sign in to the Admin Web UI

After the initial configuration completes:

Open the Admin Web UI URL displayed in the output. For example: https://<public-ip-address>/admin.
Sign in with the username and generated password displayed.
Review the Access Server license agreement.
Select Agree.
- The onboarding wizard displays for a new Access Server installation.

🚀 Walk through the onboarding wizard

The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.

Select whether VPN clients should have:
- Internet access through Access Server.
- Access to private resources in your Oracle virtual network.
- Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Verify that the detected networks match the Oracle virtual networks that VPN users should access.
Keep only the networks that VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
Tip
You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
- The Client Web UI
- Users
- Access Controls
- Authentication
- Activation

⚙️ Next Steps

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.

🕒 Change default time zone

If the server uses a different time zone than you require, run:
```
sudo dpkg-reconfigure tzdata
```
Follow the prompts to select the appropriate time zone.

⏰ Verify time synchronization

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.

🔄 Update operating-system software

Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
```
sudo apt-get update
sudo apt-get upgrade
```
Review the packages before applying updates in production and reboot the server when required.

🛡️ Further security recommendations

Review the security guidance that applies to your deployment:

Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

In this section: