Deploy OpenVPN Access Server on Oracle Cloud — Quick Start Guide
Deploy OpenVPN Access Server on Oracle Cloud using the Oracle Marketplace. Access Server is available as a preconfigured image you can deploy.
Working with Oracle Cloud, you use their instances, which are Linux-based virtual machines running on virtualized hardware. By using the Access Server instance from their Marketplace, you can launch a VPN hosted in the cloud, with the following benefits:
Quickly extend your virtual private cloud networking to remote users and other sites.
Create hub-and-spoke network topology, site-to-site, user-to-cloud, and various other secure VPN connections.
Provide secure, remote access to applications deployed on your cloud platform.
Sign in to the Access Server Hub on our site or create a new account.
Under Installation, select Oracle.
Select Launch From Oracle Cloud Marketplace and sign in to your Oracle account if necessary.
On the Access Server listing, select Get App.
Select the latest version and the compartment.
Review and accept the Oracle terms and select Launch Instance.
Enter a name for your instance if you want to change it from the generated name.
Select your virtual cloud network and subnet.
Generate a new SSH key or input your public SSH key.
Select Create.
Add a Network Security Group to your instance with the rules outlined in the table below.
Direction | Source Type | Source | Protocol | Source Port | Destination Port |
|---|---|---|---|---|---|
Ingress | CIDR | 0.0.0.0/0 | TCP | All | 943 |
Ingress | CIDR | 0.0.0.0/0 | TCP | All | 22 |
Ingress | CIDR | 0.0.0.0/0 | TCP | All | 443 |
Ingress | CIDR | 0.0.0.0/0 | UDP | All | 1194 |
Once your image deploys, you can connect with an SSH client.
We provide instructions on how to connect with a common use case for Windows OS users with the PuTTY SSH Client: Connect to Access Server via SSH Using PuTTY.
Access Server's initial configuration tool guides you through the first-time Access Server configuration.
For this quick start guide, we assume you use the default configuration values where available.
Review and accept the Access Server End User License Agreement (EULA).
Follow the configuration prompts.
Press ENTER to accept the default values for each configuration option used in this quick start.
When the initial configuration finishes, locate the Access Server sign-in information in the output:
Admin Web UI URL
Client Web UI URL
Administrative username
Generated administrative password
Initial Configuration Complete! You can now continue configuring OpenVPN Access Server by directing your Web browser to this URL: OpenVPN Access Server URL: During normal operation, OpenVPN AS can be accessed via these URLs: Admin UI: https://192.0.2.10:943/admin/ Client UI: https://192.0.2.10:943/ To login please use the "openvpn" account with "FKadk2254" password. See the Release Notes for this release at: https://openvpn.net/vpn-server-resources/release-notes/When prompted to enable Let's Encrypt for the public IP address, enter
Y.
After the initial configuration completes:
Open the Admin Web UI URL displayed in the output. For example:
https://<public-ip-address>/admin.Sign in with the username and generated password displayed.
Review the Access Server license agreement.
Select Agree.
The onboarding wizard displays for a new Access Server installation.
The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection.
Select whether VPN clients should have:
Internet access through Access Server.
Access to private resources in your Oracle virtual network.
Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Verify that the detected networks match the Oracle virtual networks that VPN users should access.
Keep only the networks that VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
The Client Web UI
Users
Access Controls
Authentication
Activation
After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.
🕒 Change default time zone
If the server uses a different time zone than you require, run:
sudo dpkg-reconfigure tzdataFollow the prompts to select the appropriate time zone.
⏰ Verify time synchronization
Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.
Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.
🔄 Update operating-system software
Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
sudo apt-get update sudo apt-get upgradeReview the packages before applying updates in production and reboot the server when required.
🛡️ Further security recommendations
Review the security guidance that applies to your deployment:
Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.
Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.