Tutorial: Get Started with Access Server

Abstract

New to Access Server? This tutorial walks you through choosing a deployment method (Linux, cloud, VM, or container), completing initial setup, connecting your first VPN client, and securing your deployment.

Overview

This tutorial helps you get Access Server running from start to finish. It doesn't repeat installation instructions. Instead, it guides you to the right deployment guide for your environment, walks you through initial configuration after installation, and points you to the next steps that matter most for your setup.

Access Server is a self-hosted business VPN solution. You install it on your own infrastructure — Linux, cloud, virtual machine, or container — and manage it through the Admin Web UI.

Step 1: Choose your deployment method

Use the table below to go directly to the right guide for your environment:

Table 1. Choose your OpenVPN Access Server deployment method

I want to deploy on...	Use this guide
Ubuntu (recommended for most users)	Ubuntu Quick Start Guide
Debian	Debian Quick Start Guide
Red Hat Enterprise Linux, Rocky Linux, or AlmaLinux	Red Hat Quick Start Guide
AWS (bring your own license)	AWS BYOL
AWS (pay as you go)	AWS PAYG
Azure (bring your own license)	Azure BYOL
Azure (pay as you go)	Azure PAYG
Google Cloud	Google Cloud
IBM Cloud	IBM Cloud
Oracle Cloud	Oracle Cloud
DigitalOcean	DigitalOcean
Vultr	Vultr
VMware ESXi	ESXi deployment
Microsoft Hyper-V	Hyper-V deployment
Docker	Docker deployment
Raspberry Pi	Rapberry Pi deployment
Access Server Link	Access Server Link

Note

Not sure which to choose? For most new deployments, installing on Ubuntu is the fastest path to a working server. See System Requirements for the supported operating systems and hardware requirements.

Complete the installation for your chosen platform, then return here for Step 2.

Step 2: Complete the initial setup

After installation, use the Admin Web UI to complete the initial Access Server setup.

The exact first-run sequence depends on your deployment method. Some cloud deployments can preconfigure administrative credentials, licensing, or a browser-trusted certificate during deployment.

1. Sign in to the Admin Web UI

Your installation or deployment output provides the Admin Web UI URL and initial administrative credentials. For a command-line installation, the output may look similar to:

+++++++++++++++++++++++++++++++++++++++++++++++ 
Access Server 3.2.2 has been successfully installed in /usr/local/openvpn_as
Configuration log file has been written to /usr/local/openvpn_as/init.log

Access Server Web UIs are available here:
Admin UI: https://198.51.100.130:943/admin
Client UI: https://198.51.100.130:943 
To login please use the "openvpn" account with "RR4ImyhwbFFq" password.
(password can be changed on Admin UI)
+++++++++++++++++++++++++++++++++++++++++++++++

Open a browser.
Navigate to the Admin Web UI URL provided during installation. For example: https://198.51.100.130:943/admin.
If a certificate warning displays, continue to the site.
Tip
Depending on your deployment, Access Server may already have a browser-trusted certificate configured. Otherwise, it uses a self-signed certificate. The self-signed certificate still encrypts the connection, but browsers display a warning because they can't automatically verify the server's identity.
Enter the administrative username and password provided during installaion.
Review and accept the End User License Agreement to proceed to the Admin Web UI.

Activate Access Server, if required

Some new BYOL deployments require activation before you can access the rest of the Admin Web UI.

If Activate your Access Server displays:

Open the Access Server Hub in another browser tab or window.
Create a free subscription for your deployment.
Copy the new activation key.
Return to the Admin Web UI and enter the activation key.
Select Activate.

Your available VPN connections update based on the activated subscription, and you can continue with setup.

This mandatory activation step appears only on deployments that require activation.

3. Complete the Onboarding Wizard

On a fresh Access Server 3.2.2 or newer installation, the Onboarding Wizard can display during the first-run experience.

Select whether VPN clients should have:
- Internet access through Access Server.
- Access to private resources behind Access Server.
- Both, if appropriate for your deployment.
If access to private resources is enabled, review the network CIDRs that Access Server detected.
Verify that the detected networks match the resources VPN users should access.
Keep only the networks that VPN users should be allowed to access.
Select Continue.
Review the OpenVPN Connect download offered by the wizard.
The wizard displays the download appropriate for the operating system of the device you're currently using.
Select Download.
Install OpenVPN Connect.
Return to the onboarding wizard.
Select Continue.
The wizard displays a prompt while it waits for a VPN connection.
Launch OpenVPN Connect on your device.
Connect using the profile included.
Confirm that the VPN connection succeeds.
Return to the Admin Web UI.
Select Finish Wizard.
Tip
You can also close the onboarding wizard by selecting the X if you prefer to skip these steps.
After completing the wizard, the Admin Web UI opens and presents a short product tour covering:
- The Client Web UI
- Users
- Access Controls
- Authentication
- Activation

4. Change the default password

Change the default openvpn admin password immediately after signing in for the first time:

Tutorial: How to Change the Password for Your New Administrative Account

5. Configure the hostname

For VPN clients to connect from outside the network, Access Server needs to know its public hostname or IP address. We recommend setting up a public domain name:

Tutorial: Setting Up Your Access Server Hostname for the Admin/Client Web UIs

6. Verify Access Server is running

Confirm the service is running from the console:
```
systemctl status openvpnas --no-pager
```
- Look for Active: active (running) in the output.
Confirm the service is running via the sacli tool:
```
sacli status
```
- Confirm the output includes "api": "on" in the service_status block. That indicates Access Server is fully initialized and ready to accept connections.

Step 3: Connect your first VPN client

With Access Server configured, connect a device to verify everything is working before adding more users or configuring advanced settings.

1. Create a user

Create a user to test connection status:

Tutorial: Adding Users to Access Server

2. Install OpenVPN Connect

OpenVPN Connect is the official VPN client for Access Server. Install it on the developer or end-user device:

Installing OpenVPN Connect
Tip
We recommend you install OpenVPN Connect with a bundled connection profile. That way, you can open the app and already have the profile to connect.

3. (If needed) Download a connection profile

A connection profile (.ovpn file) contains everything the client needs to connect to your server. Users can download their profile directly from the Client Web UI at https://YOUR-IP:943.

For other distribution methods, see Connection Profiles.

4. Connect

Once the profile is imported into OpenVPN Connect, select it and authenticate to establish the VPN connection. See more:

Step 4: Configure your VPN

With a working connection confirmed, configure Access Server for your organization's requirements. Use the section links below to navigate to the relevant tutorials:

Table 2. Configuring your VPN server

What you want to configure	Where to go
Authentication (local, LDAP, SAML, PAM)	Authentication tutorials
DNS settings	Tutorial: Configure DNS Settings in Access Server
Routing (split tunnel, full tunnel, domain routing)	Networking & Topology tutorials
Users and user management	User and Group Setup
Access Controls	Tutorial: How to Configure Group Access Control
VPN certificates and PKI	VPN Certificates and PKI Management
Multi-factor authentication (MFA)	MFA tutorials

Step 5: Secure your deployment

Before going to production, complete these recommended security steps:

1. Install an SSL certificate

Replace the self-signed certificate with a trusted SSL certificate so clients and admins don't see browser warnings:

2. Configure MFA

Add multi-factor authentication to protect admin and user accounts:

MFA tutorials

3. Create dedicated administrator accounts

Avoid using the default openvpn account for day-to-day administration. Create named admin accounts and secure the root user:

4. Back up your configuration

Take a configuration backup before making further changes or before any upgrade:

Tutorial: How to Back Up Access Server Configuration

5. Activate your license

Access Server includes two free connections. To support more connections, activate a subscription license:

In this section: