Tutorial: Deploy Access Server in AWS GovCloud
Overview
AWS GovCloud is a set of isolated AWS regions designed to host sensitive United States government workloads and regulated data, and meet strict security, compliance, and residency requirements.
For more information, refer to:
Once deployed, Access Server enables encrypted, Zero Trust-aligned access to sensitive GovCloud-hosted resources for authorized users — helping organizations enforce strong identity-based access controls, keep workloads private within GovCloud VPCs, and support remote administrators, operators, and partners, all while aligning with strict security, compliance, and US data-residency requirements.
By using the Access Server appliance from the AWS GovCloud Marketplace, you can launch a VPN hosted in the cloud with the following benefits:
Quickly extend your virtual private cloud networking to remote users and other sites.
Create hub-and-spoke network topology, site-to-site, user-to-cloud, and various other secure VPN connections.
Provide secure, remote access to applications deployed on your cloud platform.
Prerequisites
A Commercial AWS account
A GovCloud AWS account
An EC2 key pair in your GovCloud account for SSH access to the instance.
Select your licensing model
Access Server supports two licensing models in AWS GovCloud:
Model | How it works |
|---|---|
BYOL (bring your own license) | Purchase a subscription from OpenVPN separately and activate it on your instance. Includes a free tier of two concurrent connections with no time limit. |
PAYG (pay as you go) | Subscribe and manage connections directly through AWS billing. Scale connections up or down without spinning up a new instance. |
For a full comparison of license types, refer to Access Server license options.
Deploy with BYOL
You can deploy a BYOL instance in AWS GovCloud using two methods: the Access Server Portal (recommended, uses CloudFormation) or the AWS Marketplace directly (manual EC2 launch).
Option 1: Launch from the Access Server Portal
Sign in or create a new account on our website for the Access Server product.
Select the 14-day trial or to deploy your first Access Server.
If you select the 14-day trial:
Enter the number of VPN connections you want (10 is the default).
Complete the trial setup. Billing begins after the 14-day trial ends.
If you select to deploy your first Access Server:
A free subscription with 2 VPN connections is created automatically.
No billing information is required.
From the Access Server Portal, click Install Access Server.
Click the AWS Launcher tab.
Review the details for your instance:
Select your OpenVPN Subscription: This populates with your subscription from the previous step.
Select an AWS region: Select the AWS GovCloud region. You can choose US East GovCloud (us-gov-east-1) or US West GovCloud (us-gov-west-1).
Optionally, click the CloudFormation template link to launch the script manually from your AWS GovCloud account under CloudFormation Stacks.
Click Launch Now.
You're redirected to the AWS GovCloud login page.
From the AWS GovCloud Quick create stack page, provide your configuration details:
Stack name: Enter a name for the CloudFormation stack (default:
openvpn-accessserver).ActivationKey: This populates automatically from your subscription key.
VpcId: Select your existing virtual private cloud.
SubnetId: Select a subnet from the VPC.
InstanceName: Enter a name for the EC2 instance (default:
OpenVPNAccessServer).InstanceType: Select your instance type.
KeyName: Select an EC2 key pair for SSH access to the instance.
Acknowledge that AWS CloudFormation will create IAM resources.
Click Create stack.
The stack creates an EC2 instance and security group, and installs Access Server.
When the stack completes, you can find your connection details for the Admin Web UI in the stack output:
On the CloudFormation status page, click the Outputs tab.
Two outputs are displayed: AdminPortal, and TempPassword.
The AdminPortal is the URL for you to access the Admin Web UI.
The TempPassword is for authenticating with the
openvpnadmin user account on the Admin Web UI.
Open a web browser and navigate to the Admin Web UI using the AdminPortal URL.
Enter the username (
openvpn) and the TempPassword from the stack output.Once signed in, we recommend changing the
openvpnpassword from the Users page.Hop over to First-Time Setup for your first use and configuration of Access Server.
Once the AMI is launched, SSH into the console using an SSH client and the private key pair you used during setup.
Instance username:
ubuntuConnect with SSH:
ssh -i /path/key-pair-name.pem ubuntu@instance-public-ipv4-address
You can refer to Connect to Access Server via SSH using PuTTY for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow Amazon’s instructions on connecting to your instance.
Option 2: Launch from the AWS Marketplace
Sign in to your Commercial AWS account.
Navigate to the AWS Marketplace.
Select the OpenVPN Access Server / Self-Hosted VPN (BYOL) listing.
Review the details and click View purchase options.
Click Launch your software.
Under Launch method, select Launch from EC2 Console.
Under Version, select the latest Access Server version listed.
Under Region, select a GovCloud region:
US East GovCloud (
us-gov-east-1)US West GovCloud (
us-gov-west-1)
Click Launch from EC2.
You're redirected to the AWS GovCloud login page.
Sign in to your GovCloud account.
From the AWS GovCloud Launch from EC2 page, provide your configuration details:
Name: Enter a name for the EC2 instance (default:
OpenVPNAccessServer).Instance type: Select your instance type. Refer to System Requirements for guidance.
Key pair (login): Select an EC2 key pair for SSH access to the instance.
Network settings: Select your existing VPC, subnet, and security groups.
Add a security group with the following inbound rules:
Type
Source
Port range
SSH
0.0.0.0/022
Custom TCP
0.0.0.0/0943
Custom TCP
0.0.0.0/0443
Custom UDP
0.0.0.0/01194
Click Launch instance.
Once the AMI is launched, SSH into the console using an SSH client and the private key pair you used during setup.
Instance username:
openvpnasConnect with SSH:
ssh -i /path/key-pair-name.pem openvpnas@instance-public-ipv4-address
You can refer to Connect to Access Server via SSH using PuTTY for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow Amazon’s instructions on connecting to your instance.
Once the AWS instance deployment is complete, you can access your Access Server's Admin Web UI.
The initial Access Server configuration tool runs automatically the first time you sign in to the instance via SSH.
Accept the default values by pressing Enter for each prompt, or enter your preferred settings.
In the last steps of the installation process, the randomly generated password for the
openvpnadministrative account is displayed in the console.Initial Configuration Complete! You can now continue configuring OpenVPN Access Server by directing your Web browser to this URL: OpenVPN Access Server URL: During normal operation, OpenVPN AS can be accessed via these URLs: Admin UI: https://192.0.2.10:943/admin/ Client UI: https://192.0.2.10:943/ To login please use the "openvpn" account with "FKadk2254" password. See the Release Notes for this release at: https://openvpn.net/vpn-server-resources/release-notes/Access the Admin Web UI at:
https://[your-ip-address]/adminReplace
[your-ip-address]with the public IP address of your instance.
If your Access Server deployment requires a subscription activation key, you can obtain one from the Access Server Hub.
For instructions, refer to Purchase and Activate an Access Server Subscription License (Admin Web UI).
Deploy with PAYG
You can deploy Access Server to AWS GovCloud directly from the Access Server PAYG marketplace listing on AWS.
Sign in to the AWS Marketplace.
Select the Access Server / Self-Hosted VPN (PAYG) listing.
Review the details and click View purchase options.
Select your desired options for the contract:
Duration: One month or a year.
Auto-renewal: Whether or not the contract renews automatically.
Available units: The connection plan that best fits your user needs.
The contract cost displays.
Review the terms and conditions.
Select whether you need to add a purchase order.
Click Subscribe.
Your contract is currently pending and you can set up your account on our site.
Click Set up your account to be directed to our site for the next steps.
Click to create a new account on our website.
Follow the steps to add your contact information and confirm your email.
Once you've successfully signed in, the Access Server Portal displays, starting on the Deploy Access Server screen.
You can also click AWS Contract in the navigation, displaying your available connections and email notification options.
From the Access Server portal, click Install Access Server.
From the AWS Launcher option, review the instance details:
Select your OpenVPN Subscription: This populates with your subscription from the previous step.
Select an AWS region: Select the AWS GovCloud region. You can select between:
US East GovCloud (
us-gov-east-1)US West GovCloud (
us-gov-west-1)
Click Launch Now, and you will be redirected to the AWS GovCloud login page.
From the AWS GovCloud Quick create stack page, provide your configuration details:.
Stack name: You can enter a stack name; the default is openvpn-accessserver.
ActivationKey: This populates with the AWS PAYG license key.
VpcId: Select your VPC for the instance.
SubnetId: Select the public Subnet ID.
InstanceName: You can enter a name for the instance; the default is OpenVPNAccessServer.
InstanceType: Select the desired instance type. (We recommend minimum t4g.small, with t4g.large best for light-medium loads, and t4g.xlarge best for heavy loads. Refer to System Requirements.)
KeyName: Select an existing EC2 KeyPair for SSH access to the instance.
Acknowledge that AWS CloudFormation will create IAM resources.
Click Create stack.
The stack creates an EC2 instance, security group, and installs Access Server.
Once the stack completes, you can find your connection details for the Admin Web UI in the stack output.
Here's how to access the Admin Web UI after the stack is complete:
On the CloudFormation status page, click the Outputs tab. Two outputs are displayed:
AdminPortal: The URL to access the Admin Web UI.
TempPassword: The password for authenticating the
openvpnadmin user account on the Admin Web UI.
Open your web browser and navigate to the Admin Web UI using the AdminPortal URL.
Enter the username (
openvpn) and the temporary password displayed in the stack output.Once signed in, we recommend changing the password under Users → openvpn user account.
Hop over to First-Time Setup for your first use and configuration of Access Server.
Once your AMI is launched, SSH into the console using an SSH client and the private key pair you used during setup.
Instance username:
ubuntuConnect with SSH:
ssh -i /path/key-pair-name.pem ubuntu@instance-public-ipv4-address
You can refer to Connect to Access Server via SSH using PuTTY for steps to connect with the PuTTY SSH client from a Windows computer. If you have a different configuration, please follow Amazon’s instructions on connecting to your instance.
Post-deployment steps
The following steps apply to all license types and launch methods.
We recommend assigning an Elastic IP address to your Access Server instance to provide a persistent public IPv4 address. AWS recommends an Elastic IP when an EC2 instance requires a persistent public IP address.
In the AWS console, confirm that you're in the same region as your Access Server instance.
Navigate to EC2.
Under Network & Security, select Elastic IPs.
Click Allocate Elastic IP address.
Configure the address pool and optional tags.
Select Allocate.
Select the newly allocated Elastic IP address.
Select Actions → Associate Elastic IP address.
For Resource type, select Instance.
For Instance, select your Access Server instance.
For Private IP address, select the private IP address associated with the instance.
Select Associate.
AWS associates the persistent public IPv4 address with your Access Server EC2 instance.
Configure Access Server to use the Elastic IP
Sign in to your Admin Web UI.
Select VPN Server.
Enter the Elastic IP in the Hostname (or IP address) field.
Click Save and Restart.
Review the details about updating the server address and select Update Server Address,
If your VPN setup consists of a site-to-site connection between your cloud instances and your on-premises machines, ensure you disable source/destination check protection on Amazon; otherwise, routing won’t function properly.
Turn off source/destination checks:
From Instances in the EC2 console, right-click on the VPN instance ID.
Select Networking → Change source/destination check.
Check Stop under Source / Destination checking and select Save.
Source/destination checking can also block traffic if you want VPC data to go directly to the IP addresses of your VPN clients in the VPN client subnet. For that use case, turn off the check as well.
Access Server’s default routing uses network address translation (NAT). Traffic originating from the VPN clients appears to come from the local IP address of Access Server with NAT, and this is simpler than setting up routing.
However, when using NAT, traffic from the VPC itself can’t directly access a VPN client because the NAT engine prevents direct contact. You must configure routing instead of NAT to allow direct access to a VPN client.
To access this configuration:
Sign in to the Admin Web UI.
Click Access Controls.
The Group and User Access Rules tab displays.
Click the Global Access Rules tab.
Set Reachable via to Route.
Configure your subnets for your network.
Click Save and Restart.
After setting up routing, the source IP address of packets coming from the VPN clients is kept intact, and direct access from the VPC network to the VPN client subnet is possible. However, because the VPC doesn’t automatically recognize the VPN subnet within the VPN instance, it doesn’t know how to send the return traffic back to the instance. To correct this problem, add a static route in the Amazon routing table for your VPC so that the return traffic flows properly. Refer to Amazon’s AWS VPC routing documentation: Route tables for your VPC (Amazon).
When you launch a BYOL EC2 instance from the AWS Marketplace, you can pass user data to perform automated configuration tasks during deployment. You can use this feature to preconfigure Access Server with specific settings, such as administrative credentials.
User data is supported when launching instances manually from the EC2 dashboard, or via the AWS API or CLI.
Here’s an example of user data sent during launch:
Send a username and password for your administrative user. When you do this, you don’t need to SSH in to finish the setup wizard. You’ve already set your account credentials.
Entering user data:
During the instance launch, select Advanced details to expand that section.
Scroll down to the text field, User data.
Enter your data for one or more of the available settings below. Ensure you enter each row as key1=value1, and don’t use quote keys or spaces on either side of the equal character. Example:
public_hostname=vpn.example.com
admin_user=admin1
admin_pw=p@$w0rdAvailable settings for pre-configuration with Access Server:
Key | Description |
|---|---|
public_hostname | The hostname used by clients to contact the server. |
admin_pw | The administrative account initial password. |
license | The Access Server license key. |
reroute_gw (boolean, default=0) | If 1, clients route internet traffic through the VPN. |
reroute_dns (boolean, default=0) | If 1, clients route DNS queries through the VPN. Note: If the VPC CIDR block is defined, it is made accessible to VPN clients via NAT. |
Additional Security Steps You Can Take After Installation
We recommend you follow the tutorials below to improve your Access Server security after installation.
Increase security with these tutorials:
Tutorial: How to Secure the Root User Account on a Virtual Appliance — This tutorial applies to ESXi or Hyper-V appliances.
Tutorial: Keep Access Server Updated — We recommend that everyone runs the latest Access Server version.
Tutorial: How to Replace the Legacy openvpn Administrative Account — This tutorial is for sysadmins upgrading from an older Access Server version.
Tutorial: How to Change the Password for Your New Administrative Account — This tutorial is for new installations with a temporary password.
Tutorial: How to Install a Valid Web SSL Certificate in Access Server — We recommend that everyone add a valid SSL certificate from a trusted CA.
Tutorial: Harden the Web Server Cipher Suite String — This is a security step where you can update the cipher suite string if you want.
Tutorial: How to Isolate Access Server's Web Services — This tutorial covers a narrow use case where you don't want the web UIs accessible online.