Deploy OpenVPN Access Server on Vultr — Quick Start Guide
Deploy OpenVPN Access Server on Vultr using the Marketplace app — covers instance creation, SSH connection, initial configuration via App Instructions, Admin Web UI setup, subscription activation, and post-installation security hardening.
OpenVPN Access Server is available as a preconfigured application in the Vultr Marketplace. Deploy the Marketplace image to create a Linux virtual machine with Access Server installed and ready for initial setup.
With the Vultr Marketplace deployment, you can:
Deploy Access Server without manually installing the software.
Assign a public IP address for VPN and web access.
Configure a Let's Encrypt certificate during deployment.
Access the Admin Web UI and complete setup using the onboarding wizard.
Optionally configure SSH access for command-line administration.
Tip
Refer to our system requirements before deployment to ensure your selected instance meets your requirements.
🚀 Launch Access Server from the Vultr Marketplace
Sign in to the Access Server Hub on our site or create a new account.
Under Installation, select Vultr.
Select Launch from Vultr Marketplace.
Sign in to your Vultr account if prompted.
On the OpenVPN Access Server Marketplace listing, select Deploy.
Configure Location & Plan:
Parameter
Description
Plan
Select a plan that fits your expected performance needs based on vCPU, memory, storage, and price per hr options. Ensure the plan uses Local NVMe storage (not Block Storage), as this is required for Access Server to be available in the Vultr Marketplace.
Location
Select the Vultr location appropriate for your users and resources.
Configure Configure Software & Deploy Instance:
Parameter
Description
Boot Configuration
Select Local Storage, then select Marketplace App and search for, and select the OpenVPN Access Server (BYOL) app.
Application Configuration
Enter Y or n to enable Let's Encrypt. Access Server can request a browser-trusted certificate for the instance's public IP address during initial deployment, avoiding the browser warning associated with the default, self-signed certificate.
Server Settings
SSH Key: Select an SSH key for SSH access to the instance.
Tip
If you don't have a key configured, click the drop-down near your name at the top, click SSH keys → Add SSH Key and add your public SSH key to your instance.
Startup Script: Leave blank.
Firewall Group: Leave blank.
Server Hostname and Label
Server 1 Hostname: (Optional) Configure the hostname of your instance, such as openvpnas.
Server 1 Label: Leave blank.
Instance Connectivity
Select Instance(s) with Public IP. Then, select or add a VPC Network.
Select Deploy.
Wait for the instance to finish provisioning and show as running.
About the default deployment
The Vultr Marketplace image automatically installs and initializes Access Server. You don't need to connect over SSH or run ovpn-init before signing in to the Admin Web UI.
The Initial configuration uses the instance's public IP address as the Access Server hostname.
After deployment:
Open the Access Server instance in the Vultr portal.
Under Overview, locate App Instructions.
Locate the Access Server:
Admin Web UI URL (administration portal)
Administrative username
Generated password
Open the provided Admin Web UI URL in your browser.
Important
The default administrative username for the Marketplace image is
openvpn. Use the generated password displayed in App Instructions.
Web certificate
If you enabled Let's Encrypt during deployment and certificate issuance completed successfully, the Admin Web UI uses a browser-trusted certificate for the instance's public IP address.
If you didn't enable Let's Encrypt, or certificate issuance wasn't successful, Access Server uses its self-signed certificate. Your browser may show a certificate warning before letting you continue.
Sign in to the Admin Web UI with the credentials provided by Vultr.
Review and accept the Access Server End User License Agreement (EULA).
Complete the Onboarding Wizard.
Tip
The wizard guides you through the initial Access Server configuration and helps you test your first VPN connection.
After you complete the wizard, use the optional Admin Web UI tour to get familiar with the interface.
Access Server is now ready for additional configuration.
You don't need SSH access to complete the initial Access Server setup. Use SSH when you need command-line administration or troubleshooting.
If you configured an SSH key during deployment:
Open the instance in the Vultr portal and note its public IP address.
Connect using your configured SSH key.
For additional information, refer to Vultr's SSH documentation or Connect to Access Server via SSH using PuTTY.
Access Server provides two web interfaces.
Admin Web UI | The administrative interface for configuring Access Server. Administrators use it to manage users, authentication, network access, certificates, VPN settings, licensing, logging, and other settings. The URL typically ends in |
Client Web UI | The user-facing interface for downloading OpenVPN Connect and connection profiles. Users sign in with their VPN credentials. Its URL is typically the Access Server hostname without |
The URLs initially displayed during installation use the server's IP address and TCP port 943.
We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: vpn.example.com. This provides an easier user experience than remembering the server's IP address.
Refer to Hostname and follow the steps.
Access Server supports using multiple authentication methods for VPN users.
Sign in to the Admin Web UI.
Navigate to Authentication.
Configure the authentication method appropriate for your organization.
Access Server supports:
Local authentication.
PAM.
RADIUS.
LDAP.
SAML.
Access Server can also use multiple authentication systems simultaneously.
Refer to Authentication System for more information.
With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.
Connection method | Procedure |
|---|---|
Download OpenVPN Connect from the Client Web UI |
|
Download a connection profile |
|
Admin distributes connection profiles or installers | Alternatively, as an admin, you can use these ways to connect your users:
|
Tip
Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure split-tunnel traffic, their IP address remains the same for internet traffic.
After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.
🕒 Change default time zone
If the server uses a different time zone than you require, run:
sudo dpkg-reconfigure tzdata
Follow the prompts to select the appropriate time zone.
⏰ Verify time synchronization
Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.
Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.
🔄 Update operating-system software
Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:
sudo apt-get update sudo apt-get upgrade
Review the packages before applying updates in production and reboot the server when required.
🛡️ Further security recommendations
Review the security guidance that applies to your deployment:
Tutorial: Keep Access Server Updated — Keep Access Server current with supported security and feature updates.
Tutorial: How to Change the Password for Your New Administrative Account — Replace the temporary administrative password used during initial setup.
Tutorial: Harden the Web Server Cipher Suite String — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
Tutorial: How to Isolate Access Server's Web Services — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.
Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.