How to configure Access Server

Upgrade to Latest Version

Introduction

This document provides an overview of the Access Server Client Web UI, Admin Web UI, and command line interface (CLI). Once you are familiar with these, these links provide more information on configuring your server:

If you’re having trouble accessing the web interface, refer to: Troubleshooting access to the web interface.

The Client Web UI

Access Server provides web services to run both the Admin Web UI and the Client Web UI. The Client Web UI provides your users with pre-configured VPN clients, which simplifies the process of connecting to your VPN server.

To access the Client Web UI, use either the IP address or hostname of your Access Server. For example:

https://123.456.78.90/
https://vpn.businessname.com/

The IP address is the external IP address of your server. A custom hostname can be set up using the Admin Web UI and a DNS ‘A’ record. You can follow the steps to set up a custom hostname here: Setting up your OpenVPN Access Server hostname.

This Client Web UI provides an interface for your users to sign in and retrieve pre-configured downloads of OpenVPN Connect. Each user can download and install OpenVPN Connect with a personalized and bundled user profile configuration, or they can download a configuration profile to import into any VPN client that supports .ovpn.

The Admin Web UI

The Admin Web UI is available at the same IP address or hostname that the Client Web UI uses, but at the /admin path. For example:

https://123.456.78.90/admin
https://vpn.businessname.com/admin

Once you finish the setup, the credentials and address for the web interface are printed on screen:

+++++++++++++++++++++++++++++++++++++++++++++++ 
Access Server 2.12.0 has been successfully installed in /usr/local/openvpn_as
Configuration log file has been written to /usr/local/openvpn_as/init.log

Access Server Web UIs are available here:
Admin UI: https://192.168.102.130:943/admin
Client UI: https://192.168.102.130:943 
Login as "openvpn" with "RR4ImyhwbFFq" to continue
(password can be changed on Admin UI)
+++++++++++++++++++++++++++++++++++++++++++++++

Note: Access Server versions older than 2.10 do not automatically generate a password. On older versions you set the password manually by typing passwd openvpn on the command line.

Note: The root user credentials can’t be used to sign in to the Admin Web UI.

For more information about the features in the Admin Web UI, refer to the Access Server Admin Manual.

Admin Web UI Features

These sections provide an introduction to the Admin Web UI and how you can retrieve the server status, a configuration overview, and the number of current connected users. There are details on an easy way to query the log database and what the log reports look like.

Server Status

The Status Overview section indicates whether the VPN server is currently on or off. If it’s on, you can click on Stop the Server to stop the OpenVPN daemons. If the server is off, you can click on Start the Server to start the OpenVPN daemons.

Stopping or starting the daemons won’t affect the Admin Web UI service — it continues to actively listen on its configured port, which is by default TCP port 943. However, if you stop the daemons, this also stops the automatic internal routing of browser traffic to the standard HTTPS port TCP 443. With internal routing turned off, you must specify port 943 to access your Admin Web UI. For example:

https://123.456.78.90:943/admin
https://vpn.businessname.com:943/admin

Active Configuration

The Active Configuration section displays some important configuration settings that are managed in the configuration and authentication sections of the Admin Web UI.

Current Users

The Current Users section displays actively connected users with information in the following columns:

Common Name	The username.
Real Address	The originating IP address of the connecting client.
VPN Address	The IP address assigned by your OpenVPN Access Server.
Bytes Sent Received	The data (in bytes) received and sent through the VPN tunnel.
Connected Since	When the currently active connection was last connected or reconnected.
Block	Block the user, denying access to the VPN.

If an administrator blocks a user from the Current Users page, that block can be removed by unchecking the Deny Access box on User Management > User Permissions.

Querying the log database

The Log Reports section displays the log in your browser and provides the option to download it as a comma separated values (CSV) file. You can query your logs or filter the output using the fields under Query by Start Time and Filter by Number of Log Entries. You can also filter your results based on any text you enter into the filter records field.

There is a log database available through the CLI interface called logdba, which you can use to extract and export information.

Query log results

The results of a log query display below search and filter fields with information in the following columns:

Node	The name of the OpenVPN Access Server. This is different for a multi-server setup, where the node name is different for each server.
Username	The username of the client connection, as authenticated by Access Server
Start Time	The date and time that a specific connection or attempted connection occurred.
Duration	The length in time of the connection. Note: When a user’s connection is momentarily interrupted, a new, separate session is logged.
Service	One of the following: VPN: Clients connecting through the OpenVPN daemon using a client. WEB_CLIENT: Users signing into, or attempting to sign into the client web server using a browser. WEB_ADMIN: Users signing into, or attempting to sign into the admin web server or Admin Web UI using a browser. XML_API: Any XML-RPC API requests are logged with this service when the XML debug flag is enabled.
Real IP	The real IP address of the client connected to the Access Server or the user attempting to connect to a web service.
VPN IP	The IP address assigned to the client by the Access Server.
Proto	The protocol used for the OpenVPN tunnel itself — UDP is generally the better choice here.
Port	The port the client connected on — the default ports are TCP 443 and UDP 1194.
Bytes In	The total number of bytes sent from the client to the Access Server.
Bytes Out	The total number of bytes sent from the Access Server to the client.
Error	Any error messages display here, usually in short and technical phrases.

Admin Web UI User Manual

For more information about each Admin Web UI section, refer to the OpenVPN Access Server Admin Manual, which provides details about the different configuration options through your Admin Web UI portal as well as details on typical network configurations.

The Command Line Interface (CLI)

You can use the CLI to manage all of the Access Server VPN settings. And, the CLI enables you to use more advanced functions that aren’t available through the Admin Web UI.

Access to the CLI is typically established through an SSH session to your server or directly on your server’s console. On the CLI you can create your own shell scripts to automate tasks such as creating new users with custom settings or implementing custom authentication options.

For more information on using the CLI, refer to Access Server command line interface tools.

© Copyright 2024 OpenVPN|OpenVPN is a registered trademark of OpenVPN, Inc.|CloudConnexa is a registered trademark of OpenVPN, Inc.