---
title: 'Tutorial: Deploy Access Server in AWS GovCloud'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--access-server-in-aws-govcloud/
product: Access Server Docs
description: Deploy Access Server in AWS GlovCloud regions to provide encrypted, Zero Trust-aligned VPN access for government workloads that require strict security, compliance, and US data residency.
---

# Tutorial: Deploy Access Server in AWS GovCloud

## Overview

AWS GovCloud is a set of isolated AWS regions designed to host sensitive United States government workloads and regulated data, and meet strict security, compliance, and residency requirements.

For more information, refer to:

- [AWS GovCloud (US) Compared to Standard AWS Regions](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-differences.html)
- [AWS Marketplace in AWS GovCloud (US)](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-marketplace.html)

Once deployed, Access Server enables encrypted, Zero Trust-aligned access to sensitive GovCloud-hosted resources for authorized users — helping organizations enforce strong identity-based access controls, keep workloads private within GovCloud VPCs, and support remote administrators, operators, and partners, all while aligning with strict security, compliance, and US data-residency requirements.

By using the Access Server appliance from the AWS GovCloud Marketplace, you can launch a VPN hosted in the cloud with the following benefits:

- Quickly extend your virtual private cloud networking to remote users and other sites.
- Create hub-and-spoke network topology, site-to-site, user-to-cloud, and various other secure VPN connections.
- Provide secure, remote access to applications deployed on your cloud platform.

> **Tip**
>
> Refer to the [system requirements](https://openvpn.net/as-docs/v3/system-requirements.md) to ensure your system works with Access Server.

## Prerequisites

- A Commercial AWS account
- A GovCloud AWS account
- An EC2 key pair in your GovCloud account for SSH access to the instance.

> **Note**
>
> AWS GovCloud accounts are separate from commercial AWS accounts and require independent sign-in credentials. You will be redirected to the GovCloud login page during the launch process.

## Select your licensing model

Access Server supports two licensing models in AWS GovCloud:

| **Model** | **How it works** |
| --- | --- |
| **BYOL** (bring your own license) | Purchase a subscription from OpenVPN separately and activate it on your instance. Includes a free tier of two concurrent connections with no time limit. |
| **PAYG** (pay as you go) | Subscribe and manage connections directly through AWS billing. Scale connections up or down without spinning up a new instance. |

For a full comparison of license types, refer to [Access Server license options](https://openvpn.net/as-docs/v3/subscription.md).

## Deploy with BYOL

You can deploy a BYOL instance in AWS GovCloud using two methods: the [Access Server Portal](https://myaccount.openvpn.com/signin/as) (recommended, uses CloudFormation) or the AWS Marketplace directly (manual EC2 launch).

### Option 1: Launch from the Access Server Portal

#### 🔑 Purchase a subscription

1. [Sign in or create a new account](https://myaccount.openvpn.com/product-select) on our website for the Access Server product.
2. Select the 14-day trial or to deploy your first Access Server.

   > **Tip**
   >
   > If you already have a subscription, click **Activation Keys** and purchase more.
3. If you select the 14-day trial:
   - Enter the number of VPN connections you want (10 is the default).
   - Complete the trial setup. Billing begins after the 14-day trial ends.
4. If you select to deploy your first Access Server:
   - A free subscription with 2 VPN connections is created automatically.
   - No billing information is required.

#### 🚀 Launch the AMI

1. From the Access Server Portal, click **Install Access Server**.
2. Click the **AWS Launcher** tab.
3. Review the details for your instance:
   - **Select your OpenVPN Subscription:** This populates with your subscription from the previous step.
   - **Select an AWS region:** Select the AWS GovCloud region. You can choose US East GovCloud (**us-gov-east-1**) or US West GovCloud (**us-gov-west-1**).
4. Optionally, click the **CloudFormation template** link to launch the script manually from your AWS GovCloud account under **CloudFormation Stacks**.
5. Click **Launch Now**.
   - You're redirected to the AWS GovCloud login page.
6. From the AWS GovCloud **Quick create stack** page, provide your configuration details:
   - **Stack name:** Enter a name for the CloudFormation stack (default: `openvpn-accessserver`).
   - **ActivationKey:** This populates automatically from your subscription key.
   - **VpcId:** Select your existing virtual private cloud.
   - **SubnetId:** Select a subnet from the VPC.
   - **InstanceName:** Enter a name for the EC2 instance (default: `OpenVPNAccessServer`).
   - **InstanceType:** Select your instance type.

     > **Tip**
     >
     > We recommend a minimum of `t4g.small`, with `t4g.large` best for light-to-medium loads and `t4g.xlarge` for heavy loads. Refer to [System Requirements](https://openvpn.net/as-docs/v3/system-requirements.md) for details.
   - **KeyName:** Select an EC2 key pair for SSH access to the instance.
7. Acknowledge that AWS CloudFormation will create IAM resources.
8. Click **Create stack**.
   - The stack creates an EC2 instance and security group, and installs Access Server.

#### 🖱️ View the stack output

> **Important**
>
> The system requires up to five minutes for complete initialization. On AWS, this process occurs in two stages: Access Server is installed, and then reinstalled during initialization (`ovpn-init`). During this time, authentication attempts will **fail, and this is expected behavior**. Don't attempt to sign in until both stages are complete. Once initialization finishes, you can sign in successfully.

When the stack completes, you can find your connection details for the Admin Web UI in the stack output:

1. On the CloudFormation status page, click the **Outputs** tab.
2. Two outputs are displayed: **AdminPortal**, and **TempPassword**.
   - The **AdminPortal** is the URL for you to access the Admin Web UI.
   - The **TempPassword** is for authenticating with the `openvpn` admin user account on the Admin Web UI.
3. Open a web browser and navigate to the Admin Web UI using the **AdminPortal** URL.
4. Enter the **username** (`openvpn`) and the **TempPassword** from the stack output.
5. Once signed in, we recommend changing the `openvpn` password from the **Users** page.
6. Hop over to [First-Time Setup](https://openvpn.net/as-docs/v3/first-time-setup.md) for your first use and configuration of Access Server.

#### 🖱️ Connect to your new AMI

Once the AMI is launched, SSH into the console using an SSH client and the private key pair you used during setup.

- **Instance username:** `ubuntu`
- Connect with SSH:

  ```
  ssh -i /path/key-pair-name.pem ubuntu@instance-public-ipv4-address
  ```

You can refer to [Connect to Access Server via SSH using PuTTY](https://openvpn.net/as-docs/v3/tutorials/tutorial--connect-with-putty.md) for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow Amazon’s instructions on connecting to your instance.

### Option 2: Launch from the AWS Marketplace

> **Note**
>
> This method launches from EC2 directly rather than using CloudFormation. The initial Access Server configuration runs interactively the first time you SSH into the instance, and you activate your subscription separately after launch.

#### 🚀 Launch the AMI

1. Sign in to your Commercial AWS account.
2. Navigate to the **AWS Marketplace**.
3. Select the **OpenVPN Access Server / Self-Hosted VPN (BYOL)** listing.
4. Review the details and click **View purchase options**.
5. Click **Launch your software**.
6. Under **Launch method**, select **Launch from EC2 Console**.
7. Under **Version**, select the latest Access Server version listed.
8. Under **Region**, select a GovCloud region:
   - **US East GovCloud** (`us-gov-east-1`)
   - **US West GovCloud** (`us-gov-west-1`)
9. Click **Launch from EC2**.
   - You're redirected to the AWS GovCloud login page.
10. Sign in to your GovCloud account.
11. From the AWS GovCloud **Launch from EC2** page, provide your configuration details:
    - **Name:** Enter a name for the EC2 instance (default: `OpenVPNAccessServer`).
    - **Instance type:** Select your instance type. Refer to [System Requirements](https://openvpn.net/as-docs/v3/system-requirements.md) for guidance.
    - **Key pair (login):** Select an EC2 key pair for SSH access to the instance.
    - **Network settings:** Select your existing VPC, subnet, and security groups.
12. Add a security group with the following inbound rules:

    | **Type** | **Source** | **Port range** |
    | --- | --- | --- |
    | SSH | `0.0.0.0/0` | 22 |
    | Custom TCP | `0.0.0.0/0` | 943 |
    | Custom TCP | `0.0.0.0/0` | 443 |
    | Custom UDP | `0.0.0.0/0` | 1194 |

    > **Tip**
    >
    > Port **TCP 22** doesn't need to be open to all IP addresses (`0.0.0.0/0`). This access is only required to manage the instance. For better security, restrict the **source IP** to only the administrator's IP address.
13. Click **Launch instance**.

#### 🖱️ Connect to your new AMI

Once the AMI is launched, SSH into the console using an SSH client and the private key pair you used during setup.

- **Instance username:** `openvpnas`
- Connect with SSH:

  ```
  ssh -i /path/key-pair-name.pem openvpnas@instance-public-ipv4-address
  ```

You can refer to [Connect to Access Server via SSH using PuTTY](https://openvpn.net/as-docs/tutorials/tutorial--connect-with-putty.md) for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow Amazon’s instructions on connecting to your instance.

#### 🖥️ Finish Access Server installation

Once the AWS instance deployment is complete, you can access your Access Server's Admin Web UI.

1. The initial Access Server configuration tool runs automatically the first time you sign in to the instance via SSH.
2. Accept the default values by pressing **Enter** for each prompt, or enter your preferred settings.
3. In the last steps of the installation process, the randomly generated password for the `openvpn` administrative account is displayed in the console.

   ```
   Initial Configuration Complete!

   You can now continue configuring OpenVPN Access Server by
   directing your Web browser to this URL:
   OpenVPN Access Server URL:

   During normal operation, OpenVPN AS can be accessed via these URLs:
   Admin UI: https://192.0.2.10:943/admin/
   Client UI: https://192.0.2.10:943/
   To login please use the "openvpn" account with "FKadk2254" password.

   See the Release Notes for this release at:
      https://openvpn.net/vpn-server-resources/release-notes/
   ```
4. Access the Admin Web UI at:

   ```
   https://[your-ip-address]/admin
   ```

   Replace `[your-ip-address]` with the public IP address of your instance.

#### 🔑 Purchase and activate a subscription

If your Access Server deployment requires a subscription activation key, you can obtain one from the [Access Server Hub](https://as-portal.openvpn.com/billing/activation-keys/subscriptions).

For instructions, refer to [Purchase and Activate an Access Server Subscription License (Admin Web UI)](https://openvpn.net/as-docs/v3/tutorials/tutorial--activate-subscription-license.md).

> **Note**
>
> Some new BYOL deployments require activation during the first-run Admin Web UI experience. If **Activate your Access Server** displays after you accept the license agreement, enter a valid activation key before continuing with the Onboarding Wizard.

## Deploy with PAYG

You can deploy Access Server to AWS GovCloud directly from the Access Server PAYG marketplace listing on AWS.

### 📄 Configure your AWS contract

1. Sign in to the AWS Marketplace.
2. Select the **Access Server / Self-Hosted VPN (PAYG)** listing.
3. Review the details and click **View purchase options**.
4. Select your desired options for the contract:
   - **Duration:** One month or a year.
   - **Auto-renewal:** Whether or not the contract renews automatically.
   - **Available units:** The connection plan that best fits your user needs.

     > **Tip**
     >
     > A connection is an actively connected user device, such as a headless server, a mobile tablet, or a remote laptop.
5. The contract cost displays.
6. Review the terms and conditions.
7. Select whether you need to add a purchase order.
8. Click **Subscribe**.
   1. Your contract is currently pending and you can set up your account on our site.
9. Click **Set up your account** to be directed to our site for the next steps.

### 🔑 Set up your OpenVPN account

> **Note**
>
> If you already have an OpenVPN account, sign in to your existing account and skip these steps.

1. Click to create a new account on our website.
2. Follow the steps to add your contact information and confirm your email.
   - Once you've successfully signed in, the Access Server Portal displays, starting on the **Deploy Access Server** screen.
   - You can also click **AWS Contract** in the navigation, displaying your available connections and email notification options.

### ⚙️ Launch with the CloudFormation script

1. From the Access Server portal, click **Install Access Server**.
2. From the **AWS Launcher** option, review the instance details:
   - **Select your OpenVPN Subscription:** This populates with your subscription from the previous step.
   - **Select an AWS region:** Select the AWS GovCloud region. You can select between:
     - US East GovCloud (`us-gov-east-1`)
     - US West GovCloud (`us-gov-west-1`)

     > **Note**
     >
     > **Optional**
     >
     > You can click the **CloudFormation template** link to launch the script manually from your AWS Cloud account under **CloudFormation Stacks**.
3. Click **Launch Now**, and you will be redirected to the AWS GovCloud login page.
4. From the AWS GovCloud **Quick create stack** page, provide your configuration details:.
   - **Stack name:** You can enter a stack name; the default is **openvpn-accessserver**.
   - **ActivationKey:** This populates with the AWS PAYG license key.
   - **VpcId:** Select your VPC for the instance.
   - **SubnetId:** Select the public Subnet ID.
   - **InstanceName:** You can enter a name for the instance; the default is **OpenVPNAccessServer**.
   - **InstanceType:** Select the desired instance type. (We recommend minimum t4g.small, with t4g.large best for light-medium loads, and t4g.xlarge best for heavy loads. Refer to [System Requirements](https://openvpn.net/as-docs/system-requirements.md).)
   - **KeyName:** Select an existing EC2 KeyPair for SSH access to the instance.
5. Acknowledge that AWS CloudFormation will create IAM resources.
6. Click **Create stack**.
   - The stack creates an EC2 instance, security group, and installs Access Server.

### 🖥️ Gather Admin Web UI info from stack output

Once the stack completes, you can find your connection details for the [Admin Web UI](https://openvpn.net/as-docs/v3/admin-web-ui-3-0-user-manual.md) in the stack output.

> **Important**
>
> The system requires up to five minutes for complete initialization. On AWS, this process occurs in two stages: Access Server is installed, and then reinstalled during initialization (`ovpn-init`). During this time, authentication attempts will **fail, and this is expected behavior**. Don't attempt to sign in until both stages are complete. Once initialization finishes, you can sign in successfully.

Here's how to access the Admin Web UI after the stack is complete:

1. On the CloudFormation status page, click the **Outputs** tab. Two outputs are displayed:
   - **AdminPortal:** The URL to access the Admin Web UI.
   - **TempPassword:** The password for authenticating the `openvpn` admin user account on the Admin Web UI.
2. Open your web browser and navigate to the Admin Web UI using the **AdminPortal** URL.
3. Enter the **username** (`openvpn`) and the **temporary password** displayed in the stack output.
4. Once signed in, we recommend changing the password under **Users → openvpn** user account.
5. Hop over to [First-Time Setup](https://openvpn.net/as-docs/v3/first-time-setup.md) for your first use and configuration of Access Server.

### 🖱️ Connect to your new AMI

Once your AMI is launched, SSH into the console using an SSH client and the private key pair you used during setup.

- **Instance username:** `ubuntu`
- Connect with SSH:

  ```
  ssh -i /path/key-pair-name.pem ubuntu@instance-public-ipv4-address
  ```

You can refer to [Connect to Access Server via SSH using PuTTY](https://openvpn.net/as-docs/tutorials/tutorial--connect-with-putty.md) for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow Amazon’s instructions on connecting to your instance.

## Post-deployment steps

The following steps apply to all license types and launch methods.

### 🌍 Assign an Elastic IP address (recommended)

We recommend assigning an Elastic IP address to your Access Server instance to provide a persistent public IPv4 address. AWS recommends an Elastic IP when an EC2 instance requires a persistent public IP address.

> **Important**
>
> Before allocating the Elastic IP address, confirm that the AWS console is set to the same Region as your Access Server EC2 instance. For example, if the instance is in **US West (N. California)**, allocate and associate the Elastic IP address from that Region.
>
> An Elastic IP address allocated in a different Region can’t be associated with the instance.

1. In the AWS console, confirm that you're in the same region as your Access Server instance.
2. Navigate to **EC2**.
3. Under **Network & Security**, select **Elastic IPs**.
4. Click **Allocate Elastic IP address**.
5. Configure the address pool and optional tags.
6. Select **Allocate**.
7. Select the newly allocated Elastic IP address.
8. Select **Actions → Associate Elastic IP address**.
9. For **Resource type**, select **Instance**.
10. For **Instance**, select your Access Server instance.
11. For **Private IP address**, select the private IP address associated with the instance.
12. Select **Associate**.
    - AWS associates the persistent public IPv4 address with your Access Server EC2 instance.

#### Configure Access Server to use the Elastic IP

1. Sign in to your Admin Web UI.
2. Select **VPN Server**.
3. Enter the **Elastic IP** in the **Hostname (or IP address)** field.
4. Click **Save** and **Restart**.
5. Review the details about updating the server address and select **Update Server Address**,

> **Important**
>
> Configure the Elastic IP before distributing connection profiles to users. Changing the configured hostname or IP address later can prevent existing client profiles from connecting until users download updated profiles.

### 🚫 Disable source/dest checking (recommended)

If your VPN setup consists of a site-to-site connection between your cloud instances and your on-premises machines, ensure you disable source/destination check protection on Amazon; otherwise, routing won’t function properly.

#### Turn off source/destination checks:

1. From **Instances** in the EC2 console, right-click on the VPN instance ID.
2. Select **Networking → Change source/destination check**.
3. Check **Stop** under **Source / Destination checking** and select **Save**.

Source/destination checking can also block traffic if you want VPC data to go directly to the IP addresses of your VPN clients in the VPN client subnet. For that use case, turn off the check as well.

### 🌐 Set up static routes (optional)

Access Server’s default routing uses network address translation (NAT). Traffic originating from the VPN clients appears to come from the local IP address of Access Server with NAT, and this is simpler than setting up routing.

However, when using NAT, traffic from the VPC itself can’t directly access a VPN client because the NAT engine prevents direct contact. You must configure routing instead of NAT to allow direct access to a VPN client.

To access this configuration:

1. Sign in to the Admin Web UI.
2. Click **Access Controls**.
   - The **Group and User Access Rules** tab displays.
3. Click the **Global Access Rules** tab.
4. Set **Reachable via** to **Route**.
5. Configure your subnets for your network.
6. Click **Save** and **Restart**.

After setting up routing, the source IP address of packets coming from the VPN clients is kept intact, and direct access from the VPC network to the VPN client subnet is possible. However, because the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Amazon routing table for your VPC so that the return traffic flows properly. Refer to Amazon’s AWS VPC routing documentation: [Route tables for your VPC (Amazon)](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html).

### 🚀 Launch automation with user data (optional)

When you launch a BYOL EC2 instance from the AWS Marketplace, you can pass user data to perform automated configuration tasks during deployment. You can use this feature to preconfigure Access Server with specific settings, such as administrative credentials.

User data is supported when launching instances manually from the EC2 dashboard, or via the AWS API or CLI.

> **Tip**
>
> If you deploy from the Access Server Portal, user data isn't exposed directly. To use it, download the CloudFormation (CF) template, modify it to include your user data, and deploy it manually using AWS CloudFormation Stacks.

Here’s an example of user data sent during launch:

- Send a username and password for your administrative user. When you do this, you don’t need to SSH in to finish the setup wizard. You’ve already set your account credentials.

#### Entering user data:

1. During the instance launch, select **Advanced details** to expand that section.
2. Scroll down to the text field, **User data**.
3. Enter your data for one or more of the available settings below. Ensure you enter each row as **key1=value1**, and don’t use quote keys or spaces on either side of the equal character. Example:

```
public_hostname=vpn.example.com
admin_user=admin1
admin_pw=p@$w0rd
```

#### Available settings for pre-configuration with Access Server:

| Key | Description |
| --- | --- |
| public\_hostname | The hostname used by clients to contact the server. |
| admin\_pw | The administrative account initial password. > **Warning** > > This parameter is communicated to the instance via cleartext channel. |
| license | The Access Server license key. > **Tip** > > Without a license key, Access Server allows up to two concurrent connections. |
| reroute\_gw (boolean, default=0) | If 1, clients route internet traffic through the VPN. |
| reroute\_dns (boolean, default=0) | If 1, clients route DNS queries through the VPN. Note: If the VPC CIDR block is defined, it is made accessible to VPN clients via NAT. |

### 🛡️ Further Security Recommendations

#### Additional Security Steps You Can Take After Installation

We recommend you follow the tutorials below to improve your Access Server security after installation.

> **Note**
>
> Not every tutorial will apply to your installation. Follow the ones that do.

**Increase security with these tutorials:**

- [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — We recommend that everyone runs the latest Access Server version.
- [Tutorial: How to Replace the Legacy openvpn Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--replace-legacy-openvpn-account.md) — This tutorial is for sysadmins upgrading from an older Access Server version.
- [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — This tutorial is for new installations with a temporary password.
- [Tutorial: How to Install a Valid Web SSL Certificate in Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--install-ssl-certificate.md) — We recommend that everyone add a valid SSL certificate from a trusted CA.
- [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — This is a security step where you can update the cipher suite string if you want.
- [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — This tutorial covers a narrow use case where you don't want the web UIs accessible online.
- [Tutorial: How to Secure the Root User Account on a Virtual Appliance](https://openvpn.net/as-docs/v3/tutorials/tutorial--secure-root-user.md) — This tutorial applies to ESXi or Hyper-V appliances.

---

Prev: [Tutorial: How to Secure Access to OpenClaw (AI Agent) on DigitalOcean with Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--secure-openclaw-ai-access-digitalocean.md)
Next: [Security & Certificates](https://openvpn.net/as-docs/v3/tutorials/security---certificates.md)
Index: https://openvpn.net/as-docs/llms.txt