Installing OpenVPN Access Server on a Linux system
Operating systems supported
The OpenVPN Access Server is distributed via our software repository on a number of popular Linux distributions such as Ubuntu, Debian, CentOS, and Red Hat, and Amazon Linux 2. You can easily deploy Access Server on any x86-64 system that can run those operating systems using our software repository. To install the repository and install Access Server check the software repository download page on our website for instructions.
There are also options for installing Access Server using a prepared image containing the Ubuntu operating system and the OpenVPN Access Server program in it. These are available for Microsoft Hyper-V, VMWare ESXi, Amazon AWS, Microsoft Azure, Google Cloud Platform, and other virtualization solutions. We have a preference to use the latest Ubuntu 64 bits Long Term Support version for our prepared images.
Installation requirements and preparation
You will need to have access to a working supported Linux operating system installation that you have root level access to. It doesn’t matter if this is through the console directly or through an SSH session using for example a tool like PuTTY, and it doesn’t matter if you must log on as an unprivileged user first, and then can ‘sudo up’ to gain root privileges. As long as at the end you have root privileges, then you will be able to proceed.
It is important that the time and date on your server are accurate. This is necessary for both certificate generation and verification as well Google Authenticator multi-factor authentication which is time-based. If you are using a modern operating system like Ubuntu 18 or higher, it will usually already have time synchronization software built in. Usually you only need to worry about setting the timezone. You can use the ‘date’ command to see what the current time and date and timezone are.
apt update apt -y install tzdata dpkg-reconfigure tzdata
The OpenVPN Access Server can function entirely within an environment where no Internet access is possible, but this does make licensing the server much more complicated and will require that you contact our support department. And if the Access Server doesn’t have Internet access it obviously can’t accept connections from clients from the Internet either of course.
It’s best to have the Access Server connected to the Internet, and we recommend doing this behind a firewall system with only ports TCP 443, TCP 943, TCP 945, and UDP 1194 forwarded from the public Internet to the private address of the Access Server behind the firewall. It is also important to check that DNS resolution is working as expected, so that pinging for example www.google.com will result in the server being able to resolve this to an IP address. If DNS resolution doesn’t work right it can slow down the web interface, cause problems with VPN clients that want to redirect their Internet traffic through the VPN server, and prevents successful licensing of the Access Server.
Access Server since version 2.7.5 gets distributed via a software repository now. So if your system is isolated from the Internet, it will be more work to install it without Internet access. We do still offer the option to download software packages separately, but Access Server now comes in 2 packages. The OpenVPN Connect client software bundle, and the OpenVPN Access Server. Both must be installed for Access Server to successfully install. On top of that, various dependencies are required which must be installed separately as well. You can find these instructions also on our software repository page by selecting the manual installation option.
Install repository, then upgrade
The upgrade procedure via repository is fairly simple. You need to first know which operating system you have. If you don’t know what it is, you can use the information below to determine this. Then you install the software repository and install Access Server using the instructions from our software repository page. So in short these are the steps that you need to take:
- Determine your operating system.
- Run the instructions for your OS from our website to install the repository.
- Those instructions will also install the latest version of OpenVPN Access Server.
To determine your operating system:
cat /etc/issue lsb_release -a uname -a
This should output some useful information. If you encounter some failure with some of these commands, that is not a problem. We provide these 3 commands and at least one of them should succeed and provide the necessary information. Below is an example of output from an older Access Server on Amazon AWS:
OpenVPN Access Server Appliance 2.1.9 \n \l No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 16.04.2 LTS Release: 16.04 Codename: xenial Linux openvpnas2 4.4.0-96-generic #119-Ubuntu SMP Tue Sep 21 14:59:54 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
Now we know that we’re running Ubuntu 16.04.2 LTS on an x86_64 platform. With the information that we have now, we can determine the operating system name, version number, and whether it’s x86 (32 bits) or x86_64 (64 bits).
Based on those three things, look up the repository installation instructions on our software repository page on our website. Select the operating system that you use, which version of operating system from the choices, and a list of instructions will then be visible.
The instructions give you commands to run on your server’s command line. It will set up the software repository for you, download and install the latest Access Server version, and if there is an existing Access Server installation, it will upgrade it for you automatically while retaining your licensing information and your users and settings.
After adding the repository, when you run apt update and apt upgrade in the future to update packages on your operating system, it will also update Access Server at the same time.
For the final step, we recommend rebooting your server:
This completes the installation and upgrade process.
NOTE: If your operating system is so old that it isn’t even listed anymore, do not proceed. You may need to consider updating your whole system. For example, we no longer offer downloads for CentOS 5 as it could not handle functions we support today for IPv6. Trying to install the CentOS 7 version on it would not work. Installing OpenVPN Access Server on an older platform than it was designed for will result in failure.
Finishing configuration and using the product
Once the program is installed it will automatically configure itself with default settings unless it detected a previous installation - then it just keeps those settings from the existing installation. If you install fresh, the installation process will tell you where to find the client web service, which is the web based GUI that you can use to log on and connect to the Access Server, and where to find the admin web service, which is where you can log on as an administrative user and manage the configuration, certificate, users, etcetera, in the web based GUI.
Usually the client UI is at the address of your server, as an example it may be at https://192.168.70.222/.
The admin UI is usually at the /admin/ address, for example https://192.168.70.222/admin/.
Please note that the web services by default actually run on port TCP 943, so using our example IP address, you can add that to the end: https://192.168.70.222:943/. The OpenVPN TCP daemon that runs on TCP port 443 redirects incoming browser requests so that it is easier for users to open the web interface - they won’t have to specify that port number.
Initially a single administrative user is added to the system. But it has no password set and therefore cannot be used yet. To use it a password must be set first:
You can now point your web browser at the admin UI web interface. Because the Access Server comes with a self-signed SSL certificate to begin with, you will receive a warning in the browser like “Invalid certificate" or “Cannot verify identity of the server". You will have to confirm that you wish to continue to the web interface (these warnings may be a little scary but can be resolved later by installing a properly signed web SSL certificate in the Access Server). You will then see the login screen and you can then enter the username openvpn and the password you have just set with the “passwd openvpn" command.
Once you are logged in to the Admin UI you can select which authentication system to use. The available choices are LOCAL, PAM, RADIUS, and LDAP. The default is LOCAL which lets you manage the users directly from the web interface.
You can also use another external system like RADIUS or LDAP server, for example to connect to a Windows Server Active Directory using an LDAP or RADIUS connector. If you do connect to Windows AD, we recommend that you use LDAP for best results.
If you are managing only a limited amount of users and don’t want things to be too complicated you can just stay with LOCAL authentication mode. Almost everything can then be configured purely from the Admin UI, although some advanced options are only available in the command line tools. We recommend that if you choose to use PAM that you look at the command line authentication options documentation specifically to learn how to add/remove users and manage passwords.
Further documentation is available to configure specific functions and configuration options for the OpenVPN Access Server.
Limitations of an unlicensed OpenVPN Access Server
When the OpenVPN Access Server is installed without a license key it goes into a sort of demonstration mode. There is no time limit or functionality limit on this mode. The only difference between a licensed Access Server and an unlicensed one is the amount of simultaneous OpenVPN tunnel connections the Access Server allows. An unlicensed server will only ever allow 2 simultaneous connections and that’s it. To unlock more connections you can purchase a license key to unlock more connections. We suggest you read the licensing frequently asked questions page and the pricing overview page to learn more.