---
title: Deploy OpenVPN Access Server on Vultr — Quick Start Guide
canonical: https://openvpn.net/as-docs/v3/vultr/
product: Access Server Docs
description: Deploy OpenVPN Access Server on Vultr using the Marketplace app — covers instance creation, SSH connection, initial configuration via App Instructions, Admin Web UI setup, subscription activation, and post-installation security hardening.
---

# Deploy OpenVPN Access Server on Vultr — Quick Start Guide

OpenVPN Access Server is available as a preconfigured application in the [Vultr Marketplace](https://www.vultr.com/marketplace/apps/openvpn/). Deploy the Marketplace image to create a Linux virtual machine with Access Server installed and ready for initial setup.

With the Vultr Marketplace deployment, you can:

- Deploy Access Server without manually installing the software.
- Assign a public IP address for VPN and web access.
- Configure a Let's Encrypt certificate during deployment.
- Access the Admin Web UI and complete setup using the onboarding wizard.
- Optionally configure SSH access for command-line administration.

> **Tip**
>
> Refer to our [system requirements](https://openvpn.net/as-docs/v3/system-requirements.md) before deployment to ensure your selected instance meets your requirements.

## 🚀 Launch Access Server from the Vultr Marketplace

1. Sign in to the [Access Server Hub](https://as-portal.openvpn.com/deployment) on our site or create a new account.
2. Under **Installation**, select **Vultr**.
3. Select **Launch from Vultr Marketplace**.
4. Sign in to your Vultr account if prompted.
5. On the OpenVPN Access Server Marketplace listing, select **Deploy**.
6. Configure **Location & Plan**:

   | **Parameter** | **Description** |
   | --- | --- |
   | **Plan** | Select a plan that fits your expected performance needs based on vCPU, memory, storage, and price per hr options. Ensure the plan uses **Local NVMe storage** (not Block Storage), as this is required for Access Server to be available in the Vultr Marketplace. |
   | **Location** | Select the Vultr location appropriate for your users and resources. |
7. Configure **Configure Software & Deploy Instance**:

   | **Parameter** | **Description** |
   | --- | --- |
   | **Boot Configuration** | Select **Local Storage**, then select M**arketplace App** and search for, and select the **OpenVPN Access Server (BYOL)** app. |
   | **Application Configuration** | Enter **Y** or **n** to enable Let's Encrypt. Access Server can request a browser-trusted certificate for the instance's public IP address during initial deployment, avoiding the browser warning associated with the default, self-signed certificate. |
   | **Server Settings** | **SSH Key:** Select an SSH key for SSH access to the instance. > **Tip** > > If you don't have a key configured, click the drop-down near your name at the top, click **SSH keys → Add SSH Key** and add your public SSH key to your instance. **Startup Script:** Leave blank. **Firewall Group:** Leave blank. |
   | **Server Hostname and Label** | **Server 1 Hostname:** (Optional) Configure the hostname of your instance, such as **openvpnas**. **Server 1 Label:** Leave blank. |
   | **Instance Connectivity** | Select **Instance(s) with Public IP**. Then, select or add a **VPC Network**. |
8. Select **Deploy**.
9. Wait for the instance to finish provisioning and show as running.

> **Tip**
>
> **About the default deployment**
>
> The Vultr Marketplace image automatically installs and initializes Access Server. You don't need to connect over SSH or run `ovpn-init` before signing in to the Admin Web UI.
>
> The Initial configuration uses the instance's public IP address as the Access Server hostname.

## 🔑 Get your Access Server sign-in information

After deployment:

1. Open the Access Server instance in the Vultr portal.
2. Under **Overview**, locate **App Instructions**.
3. Locate the Access Server:
   - Admin Web UI URL (administration portal)
   - Administrative username
   - Generated password
4. Open the provided **Admin Web UI URL** in your browser.

   > **Important**
   >
   > The default administrative username for the Marketplace image is `openvpn`. Use the generated password displayed in **App Instructions**.

> **Tip**
>
> **Web certificate**
>
> If you enabled Let's Encrypt during deployment and certificate issuance completed successfully, the Admin Web UI uses a browser-trusted certificate for the instance's public IP address.
>
> If you didn't enable Let's Encrypt, or certificate issuance wasn't successful, Access Server uses its self-signed certificate. Your browser may show a certificate warning before letting you continue.

## 🛠️ Complete first-run setup

1. Sign in to the Admin Web UI with the credentials provided by Vultr.
2. Review and accept the Access Server End User License Agreement (EULA).
3. Complete the **Onboarding Wizard**.

   > **Tip**
   >
   > The wizard guides you through the initial Access Server configuration and helps you test your first VPN connection.
4. After you complete the wizard, use the optional Admin Web UI tour to get familiar with the interface.

Access Server is now ready for additional configuration.

## ▶️ Video tutorial: Deploy on Vultr

## 💻 Optional: Connect to the instance with SSH

You don't need SSH access to complete the initial Access Server setup. Use SSH when you need command-line administration or troubleshooting.

If you configured an SSH key during deployment:

1. Open the instance in the Vultr portal and note its public IP address.
2. Connect using your configured SSH key.

For additional information, refer to Vultr's SSH documentation or [Connect to Access Server via SSH using PuTTY](https://openvpn.net/as-docs/v3/tutorials/tutorial--connect-with-putty.md).

## 🌍 Understand the Access Server web interfaces

Access Server provides two web interfaces.

|  |  |
| --- | --- |
| **Admin Web UI** | The administrative interface for configuring Access Server. Administrators use it to manage users, authentication, network access, certificates, VPN settings, licensing, logging, and other settings. The URL typically ends in `/admin/`, such as `https://vpn.example.com/admin/`. See the [user manual](https://openvpn.net/as-docs/v3/admin-web-ui-3-0-user-manual.md). |
| **Client Web UI** | The user-facing interface for downloading OpenVPN Connect and connection profiles. Users sign in with their VPN credentials. Its URL is typically the Access Server hostname without `/admin/`, such as `https://vpn.example.com/`. See the [user manual](https://openvpn.net/as-docs/v3/client-web-ui-user-manual.md). |

The URLs initially displayed during installation use the server's IP address and TCP port `943`.

## 🌍 Setting up a hostname

We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: `vpn.example.com`. This provides an easier user experience than remembering the server's IP address.

Refer to [Hostname](https://openvpn.net/as-docs/v3/hostname.md) and follow the steps.

## 🔑 Setting up authentication

Access Server supports using multiple authentication methods for VPN users.

1. Sign in to the Admin Web UI.
2. Navigate to **Authentication**.
3. Configure the authentication method appropriate for your organization.

Access Server supports:

- Local authentication.
- PAM.
- RADIUS.
- LDAP.
- SAML.

Access Server can also use multiple authentication systems simultaneously.

Refer to [Authentication System](https://openvpn.net/as-docs/v3/user-authentication-system.md) for more information.

## 👥 Connect users to Access Server

With your VPN server configured, your [users can get connected](https://openvpn.net/as-docs/v3/connecting-260793.md). Choose one of the options below to connect to the server.

| Connection method | Procedure |
| --- | --- |
| Download OpenVPN Connect from the Client Web UI | Navigate to the Client Web UI in a browser. Sign in with user credentials. Download the OpenVPN Connect installer offered for the user's operating system. After it downloads, install the software. Open the app and select the connection profile. The user connects to Access Server. |
| Download a connection profile | Navigate to the Client Web UI in a browser. Sign in with their user credentials. Select the link under **Available Connection Profiles**. After the connection profile downloads, upload the file to a VPN client. |
| Admin distributes connection profiles or installers | Alternatively, as an admin, you can use these ways to connect your users: Have your users install [OpenVPN Connect](https://openvpn.net/vpn-client/) from our website, then [download a connection profile](https://openvpn.net/as-docs/v3/connection-profiles/#connection-profile-types) from the Admin Web UI and distribute it to users. [Create an OpenVPN Connect installer from the Access Server command-line](https://openvpn.net/as-docs/v3/tutorials/tutorial--create-connection-profiles/#option-1--create-connection-profiles-using-the-cli) interface and distribute it to users. |

> **Tip**
>
> Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure [split-tunnel traffic](https://blog.openvpn.net/split-tunneling-with-access-server), their IP address remains the same for internet traffic.

## ⚙️ Next Steps

After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment.

### 🕒 Change default time zone

1. If the server uses a different time zone than you require, run:

   ```
   sudo dpkg-reconfigure tzdata
   ```
2. Follow the prompts to select the appropriate time zone.

### ⏰ Verify time synchronization

Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication.

Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements.

### 🔄 Update operating-system software

1. Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run:

   ```
   sudo apt-get update
   sudo apt-get upgrade
   ```
2. Review the packages before applying updates in production and reboot the server when required.

### 🛡️ Further security recommendations

Review the security guidance that applies to your deployment:

- [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — Keep Access Server current with supported security and feature updates.
- [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — Replace the temporary administrative password used during initial setup.
- [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening.
- [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable.

Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements.

---

Prev: [IBM Cloud](https://openvpn.net/as-docs/v3/ibm.md)
Next: [Virtual Machines](https://openvpn.net/as-docs/v3/virtual-machines.md)
Index: https://openvpn.net/as-docs/llms.txt