---
title: 'Tutorial: Restrict Public Access to the Admin Web UI'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--restrict-admin-web-ui-access/
product: Access Server Docs
description: How to configure restrictions to the Access Server Admin Web UI to limit public access.
---

# Tutorial: Restrict Public Access to the Admin Web UI

## Overview

Some organizations need to restrict access to the Admin Web UI so it’s only reachable from VPN clients or from the internal network where Access Server is hosted.

This tutorial shows how to configure these restrictions for two common deployment scenarios:

1. Access Server behind an external NAT device (for example, AWS).
2. Access Server with a public IP attached directly to the VM interface.

## Prerequisites

- Access Server 3.x installed.
- Admin Web UI access.
- Root access to the server (for CLI steps).
- Access to your firewall, security group, or router configuration.

## Option 1: Access Server behind an external NAT device (for example, AWS)

### Default behavior

- **Admin Web UI:** TCP 943 and TCP 443
- **Client Web UI:** TCP 943 and TCP 443

### Configure restricted access using the Admin Web UI

1. Sign in to the Admin Web UI.
2. Click **Web Services**.
   - The **Admin Web Server** tab displays.
3. Set **TCP Port** to `946` (or another unused port).
4. Set **Make the admin web server also reachable on OpenVPN TCP daemon port 443** to **Off**.
5. Click **Save** and **Restart**.
   - The Admin Web UI now listens **only** on TCP port 946.
   - No web service forwarding exists from TCP 443 → 946 for the Admin Web UI.
   - The Client Web UI continues to listen on TCP 443 and TCP 943.

### Configure restricted access using the CLI

1. Connect to the console and get root privileges.
2. Run:

   ```
   sudo sacli --key "admin_ui.https.port" --value '946' ConfigPut
   sudo sacli --key "vpn.server.port_share.service" --value 'client' ConfigPut
   sudo sacli start
   ```

   - The Admin Web UI now listens **only** on TCP port 946.
   - No web service forwarding exists from TCP 443 → 946 for the Admin Web UI.
   - The Client Web UI continues to listen on TCP 443 and TCP 943.

### Update your firewall or security groups

You still need to block public access to the Admin Web UI port.

1. **AWS:** Remove any inbound rule allowing traffic to port **946**.
2. **On-prem:** Block inbound traffic to TCP **946** on your firewall or router.

   > **Important**
   >
   > When updating your firewall or security group, the Admin Web UI may still be reachable from the internet.

## Option 2: Access Server with a public IP attached directly to the VM

**Example Deployment:** Access Server on DigitalOcean with a Public IP attached to one of the VM's network interfaces.

### Configure restricted access using the Admin Web UI

1. Sign in to the Admin Web UI.
2. Click **Web Services**.
   - The **Admin Web Server** tab displays.
3. For **Make the admin web server available on selected interfaces**, select an internal interface.
4. Set **TCP Port** to `946` (or another unused port).
5. Click **Save**.
6. Click the **Client Web Server** tab.
7. Set **Use the same address and port as the admin web server** to **Off**.
8. Click **Save** and **Restart**.
   - The Admin Web UI now listens on TCP port 946 only on the internal (private) interface.
   - No web service forwarding exists from TCP 443 → 946 for the Admin Web UI.
   - The Client Web UI continues to listen on TCP 443 and TCP 943 using the public interface.

### Configure restricted access using the CLI

1. Connect to the console and get root privileges.
2. Run:

   ```
   sudo sacli --key "admin_ui.https.ip_address" --value '<INTERNAL_INTERFACE>' ConfigPut
   sudo sacli --key "admin_ui.https.port" --value '946' ConfigPut
   sudo sacli --key "vpn.server.port_share.service" --value 'client' ConfigPut
   sudo sacli start
   ```

   Replace `<INTERNAL_INTERFACE>` with the internal interface name or IP address.

   - The Admin Web UI now listens on TCP port 946 only on the internal (private) interface.
   - No web service forwarding exists from TCP 443 → 946 for the Admin Web UI.
   - The Client Web UI continues to listen on TCP 443 and TCP 943 using the public interface.

### Update your firewall or network configuration

Even with interface binding, you should still restrict access at the network level.

- Block access to TCP 946.
- Allow access only from trusted internal networks or VPN clients.

---

Prev: [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md)
Next: [Tutorial: Enable FIPS Mode on Ubuntu and RHEL for Access Server](https://openvpn.net/as-docs/v3/tutorials/tutorial--enable-fips-mode-ubuntu-rhel.md)
Index: https://openvpn.net/as-docs/llms.txt