Using the Client Web UI for Access Server⁠

This section explains how to use the Client Web UI.

Where to find the Client Web UI⁠

During Access Server installation, the administrator receives an output in the command-line interface that displays information about the Admin and Client Web UIs. This first output typically displays the IP address where the administrator can sign in and start configuring Access Server for their network.

Initial Configuration Complete!

You can now continue configuring OpenVPN Access Server by
directing your Web browser to this URL:
OpenVPN Access Server URL:

During normal operation, OpenVPN AS can be accessed via these URLs:
Admin UI: https://192.0.2.10:943/admin/
Client UI: https://192.0.2.10:943/
To login please use the "openvpn" account with "FKadk2254" password.

See the Release Notes for this release at:
   https://openvpn.net/vpn-server-resources/release-notes/

You can find the Admin and Client Web UIs available at addresses formatted with the public IP address of the server in this way:

Admin Web UI: https://198.51.100.130/admin/
Client Web UI: https://198.51.100.130/

The IP address is the public-facing IP address of the server. 198.51.100.130 is our example IP address.

We recommend that the administrator set up a hostname to access the UIs. It's easier for users to sign in with a domain such as vpn.example.com than to use an IP address. Refer to our tutorial, Setting up your Access Server Hostname, and follow the steps.

Access Server hosts the UIs with a self-signed certificate. This allows the administrator to sign in immediately after launching and use the Admin Web UI to configure their server.

However, the self-signed certificate causes web browsers to display security warnings. You can click through these warnings to access both the Admin and Client Web UIs, and we recommend that the administrator install valid SSL certificates using the Access Server Admin Web UI.

To sign in to the Client Web UI, follow these steps:

Open a browser window.
Enter the hostname or IP address for the Client Web UI.
Enter the appropriate username.
Enter the password.
Click Sign In.

What if you don't know your username?⁠

If you don't know your username, you can contact your administrator. The username may depend on the authentication method used:

For local users, the administrator creates the users and manages them in the Admin Web UI. They provide users with their credentials.
For LDAP users, the administrator configures Access Server to authenticate against an LDAP server. You use the same credentials as you use for your LDAP identity provider.
For RADIUS users, the administrator configures Access Server to authenticate using a RADIUS server. You use the same credentials as the RADIUS identity provider.
For SAML users, refer to the next section.

What if you don't know your password?⁠

If you don't know your password, you can contact your administrator for help.

When an administrator configures Access Server with SAML as an authentication method, the Client Web UI includes a button: Sign In With SAML.

Open a browser window.
Enter the hostname or IP address for the Client Web UI.
Click Sign In With SAML, and the browser redirects to the identity provider.
Sign in with the identity provider credentials.

After successfully authenticating with the identity provider, the user signs in and the Downloads page displays.

When an administrator configures Access Server with the additional step using TOTP MFA, the Client Web UI displays the additional authentication steps.

TOTP MFA enrollment⁠

For the first time signing in, follow these steps to enroll with a TOTP device or app:

Open a browser window.
Enter the hostname or IP address for the Client Web UI.
Enter the username.
Enter the password.
Click Sign in, and the TOTP enrollment window displays.
Scan the QR code or enter the enrollment code into a device or app compatible with TOTP MFA.
Once enrolled with the device or app, enter the 6-digit code the device or app provides.
Click Confirm.
You're signed in.

TOTP MFA authentication⁠

After you've set up your TOTP device or app, you follow these steps to sign in:

Open a browser window.
Enter the hostname or IP address for the Client Web UI.
Enter the username.
Enter the password.
Click Sign in.
Enter your 6-digit code from your TOTP device or app.
Click Confirm.
You're signed in.

After the user signs in to the Client Web UI, they can download bundled OpenVPN Connect apps.

A bundled OpenVPN Connect app includes the OpenVPN Connect software and a connection profile specific to that user's permissions for their Access Server.

To download OpenVPN Connect apps:⁠

After signing in, the download for your device's operating system displays, and you can click Download.
If you already have a client installed (including OpenVPN Connect), you can click on Connection profile to download a .ovpn file you can import.
To download OpenVPN Connect on other platforms or find it on the app stores, click the drop-down, For other platforms.
Tip
When you click Linux and click Read Installation Guide you are directed to a web page with instructions on connecting to Access Server with the openvpn3 Linux client.

On the Client Web UI, you can also download a connection profile. Then, you can import that profile into your VPN client, whether it's OpenVPN Connect or another compatible app.

The following connection profile types may be available:

User-locked: can only be used with credentials for that specific user.
Auto-login: does not require credentials to establish the VPN tunnel.
Server-locked: requires credentials for any valid user on the server.

A connection profile may include TLS Crypt v2, which secures the control channel by using a unique key per connection profile to sign and verify packets.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Using the Client Web UI for Access Server⁠

Where to find the Client Web UI⁠

Was this information helpful?