Tutorial: Get Started with Access Server⁠

1. Sign in to the Admin Web UI⁠

Your installation or deployment output provides the Admin Web UI URL and initial administrative credentials. For a command-line installation, the output may look similar to:

Initial Configuration Complete!

You can now continue configuring OpenVPN Access Server by
directing your Web browser to this URL:
OpenVPN Access Server URL:

During normal operation, OpenVPN AS can be accessed via these URLs:
Admin UI: https://192.0.2.10:943/admin/
Client UI: https://192.0.2.10:943/
To login please use the "openvpn" account with "FKadk2254" password.

See the Release Notes for this release at:
   https://openvpn.net/vpn-server-resources/release-notes/

1. Open a browser.

2. Navigate to the Admin Web UI URL provided during installation. For example: https://198.51.100.130:943/admin.

3. If a certificate warning displays, continue to the site.

4. Enter the administrative username and password provided during installaion.

5. Review and accept the End User License Agreement to proceed to the Admin Web UI.

Activate Access Server, if required⁠

Some new BYOL deployments require activation before you can access the rest of the Admin Web UI.

If Activate your Access Server displays:

1. Open the Access Server Hub in another browser tab or window.

2. Create a free subscription for your deployment.

3. Copy the new activation key.

4. Return to the Admin Web UI and enter the activation key.

5. Select Activate.

Your available VPN connections update based on the activated subscription, and you can continue with setup.

This mandatory activation step appears only on deployments that require activation.

3. Complete the Onboarding Wizard⁠

On a fresh Access Server 3.2.2 or newer installation, the Onboarding Wizard can display during the first-run experience.

1. Select whether VPN clients should have:

   • Internet access through Access Server.

   • Access to private resources behind Access Server.

   • Both, if appropriate for your deployment.

2. If access to private resources is enabled, review the network CIDRs that Access Server detected.

3. Verify that the detected networks match the resources VPN users should access.

4. Keep only the networks that VPN users should be allowed to access.

5. Select Continue.

6. Review the OpenVPN Connect download offered by the wizard.

   The wizard displays the download appropriate for the operating system of the device you're currently using.

7. Select Download.

8. Install OpenVPN Connect.

9. Return to the onboarding wizard.

10. Select Continue.

11. The wizard displays a prompt while it waits for a VPN connection.

12. Launch OpenVPN Connect on your device.

13. Connect using the profile included.

14. Confirm that the VPN connection succeeds.

15. Return to the Admin Web UI.

16. Select Finish Wizard.

17. After completing the wizard, the Admin Web UI opens and presents a short product tour covering:

    • The Client Web UI

    • Users

    • Access Controls

    • Authentication

    • Activation

4. Change the default password⁠

Change the default openvpn admin password immediately after signing in for the first time:

• Tutorial: How to Change the Password for Your New Administrative Account

5. Configure the hostname⁠

For VPN clients to connect from outside the network, Access Server needs to know its public hostname or IP address. We recommend setting up a public domain name:

• Tutorial: Setting Up Your Access Server Hostname for the Admin/Client Web UIs

6. Verify Access Server is running⁠

1. Confirm the service is running from the console:

   systemctl status openvpnas --no-pager

   • Look for Active: active (running) in the output.

2. Confirm the service is running via the sacli tool:

   sacli status

   • Confirm the output includes "api": "on" in the service_status block. That indicates Access Server is fully initialized and ready to accept connections.

1. Create a user⁠

Create a user to test connection status:

• Tutorial: Adding Users to Access Server

2. Install OpenVPN Connect⁠

OpenVPN Connect is the official VPN client for Access Server. Install it on the developer or end-user device:

• Installing OpenVPN Connect

3. (If needed) Download a connection profile⁠

A connection profile (.ovpn file) contains everything the client needs to connect to your server. Users can download their profile directly from the Client Web UI at https://YOUR-IP:943.

For other distribution methods, see Connection Profiles.

4. Connect⁠

Once the profile is imported into OpenVPN Connect, select it and authenticate to establish the VPN connection. See more:

• Tutorial: Connect to Access Server on Windows with OpenVPN Connect

• Tutorial: Connect to Access Server on macOS with OpenVPN Connect

• Tutorial: Connect to Access Server with Linux

1. Install an SSL certificate⁠

Replace the self-signed certificate with a trusted SSL certificate so clients and admins don't see browser warnings:

• Tutorial: How to Install a Valid Web SSL Certificate in Access Server

• Tutorial: How to Use ACME Client to Issue Web SSL Certificates for the Access Server UI

2. Configure MFA⁠

Add multi-factor authentication to protect admin and user accounts:

• MFA tutorials

3. Create dedicated administrator accounts⁠

Avoid using the default openvpn account for day-to-day administration. Create named admin accounts and secure the root user:

• Tutorial: Adding Users to Access Server

• Tutorial: How to Secure the Root User Account on a Virtual Appliance

4. Back up your configuration⁠

Take a configuration backup before making further changes or before any upgrade:

• Tutorial: How to Back Up Access Server Configuration

5. Activate your license⁠

Access Server includes two free connections. To support more connections, activate a subscription license:

• Tutorial: Purchase and Activate an Access Server Subscription License (Admin Web UI)

• Tutorial: Activate a Subscription License Key Using the Command-line Interface