Installing OpenVPN Access Server<\/h2>\n\n\n\n
OpenVPN AS supports multiple configurations such as secure remote access to an internal network and private cloud network resources with fine-grained access control. The OpenVPN AS setup consists of three main components:<\/p>\n\n\n\n
- \n
- The Access Server is the underlying component that does all of the background work like routing, tunnelling and encryption.<\/li>\n\n\n\n
- Admin Web Interface makes server management simple through an easy-to-use control panel.<\/li>\n\n\n\n
- Connect client, which can be downloaded directly from the Access Server, allows login through the AS web portal.<\/li>\n<\/ul>\n\n\n\n
The server software is available for a variety of Linux distributions and versions. You can check out the OpenVPN Access Server Software Packages page<\/a> or click the links below to find the correct software for your system.<\/p>\n\n\n\n
\n\n![\"redhat\"](\"https:\/\/upcloud.com\/media\/redhat-2.png\")
<\/a><\/figure>\n<\/div>\n\n\n\n\n![\"centos\"](\"https:\/\/upcloud.com\/media\/centos-2.png\")
<\/a><\/figure>\n<\/div>\n\n\n\n\n![\"ubuntu\"](\"https:\/\/upcloud.com\/media\/ubuntu-2.png\")
<\/a><\/figure>\n<\/div>\n\n\n\n\n![\"fedora\"](\"https:\/\/upcloud.com\/media\/fedora-2.png\")
<\/a><\/figure>\n<\/div>\n\n\n\n\n![\"debian\"](\"https:\/\/upcloud.com\/media\/debian-2.png\")
<\/a><\/figure>\n<\/div>\n\n\n\n\n![\"opensuse\"](\"https:\/\/upcloud.com\/media\/opensuse-2.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\nGetting the Access Server installed is simple, download the appropriate package for your system and then use a package manager to install it. The installation process will set up\u00a0a default configuration, which allows a quick and easy way to get a server running.<\/p>\n\n\n\n
Once the installation is complete, you will see an output similar to the example below. You can then continue ahead with configuring your new VPN server.<\/p>\n\n\n\n
The Access Server has been successfully installed in \/usr\/local\/openvpn_as\nConfiguration log file has been written to \/usr\/local\/openvpn_as\/init.log\nPlease enter \"passwd openvpn\" to set the initial\nadministrative password, then login as \"openvpn\" to continue\nconfiguration here: https:\/\/public_ip:943\/admin\nTo reconfigure manually, use the \/usr\/local\/openvpn_as\/bin\/ovpn-init tool.<\/pre>\n\n\n\n
Configuring the Access Server<\/h2>\n\n\n\n
As mentioned towards the end of the installation output, you will need to set a password for the default user to log into the AS. Set a new password for the user openvpn<\/em> with the command underneath. Make sure the password is secure as the control panel is accessible from the public internet by default.<\/p>\n\n\n\n
sudo passwd openvpn<\/pre>\n\n\n\n
With the password set, open the OpenVPN Access Server admin panel at the address specified by the installation output.<\/p>\n\n\n\n
https:\/\/public_ip<\/span>:943\/admin<\/pre>\n\n\n\nWhen opening the page for the first time, you will see a warning that your connection is not secure. This notice is normal as your web browser does not trust the OpenVPN self-signed SSL certificate by default. You will need to bypass the warning or add an exception on your web browser to continue to the login screen.<\/p>\n\n\n\n
![\"ssl_sercurity_warning\"](\"https:\/\/upcloud.com\/media\/ssl_sercurity_warning.png\")
<\/figure>\n\n\n\nLog in with the username openvpn<\/em> and the password you assigned. Once in, you will see the OpenVPN status page similar to the image below.<\/p>\n\n\n\n
On the Status Overview, you can find a summary of the server settings and a start\/stop button to turn the VPN server on or off. At the right side panel, is an At-a-glance<\/i> server and connections status. The OpenVPN Access Server allows two concurrent users for free.<\/p>\n\n\n\n
![\"status_overview\"](\"https:\/\/upcloud.com\/media\/status_overview.png\")
<\/figure>\n\n\n\nUser Management<\/h3>\n\n\n\n
Once logged in, open the User Permissions<\/em> tab under User Management<\/em>. OpenVPN AS uses the same account credentials as the Linux server it is hosted on, this allows access control based on the user and group permissions defined in the control panel.<\/p>\n\n\n\n
![\"adding_user\"](\"https:\/\/upcloud.com\/media\/adding_user.png\")
<\/figure>\n\n\n\nTo make connecting and logging in easier, you should add your username to the User Permissions<\/em> table.<\/p>\n\n\n\n
- \n
- Type your username in the New Username<\/em> field, select the admin permissions and auto-login if you wish, then press the Save Settings<\/em> button.<\/li>\n\n\n\n
- After making changes to the OpenVPN AS, restart the server to apply the new configuration by pressing the Update Running Server<\/em> button.<\/li>\n\n\n\n
- You can then log out from the control panel with the link at the top right corner, and back in again with your username and password.<\/li>\n<\/ul>\n\n\n\n
For improved security, you might wish to lock the default user account; this can be done with the passwd<\/em> terminal command shown below using the -l<\/em> parameter. The same command with parameter -u<\/em> will unlock the account later if needed.<\/p>\n\n\n\n
passwd openvpn -l<\/pre>\n\n\n\n
You can also control user-specific IP address settings under User Permissions by clicking the Show -link to open the advanced options. These settings allow you to assign a static IP address to each user, choose between NAT and routing, define the networks the users should have access to, configure a VPN Gateway, or set up DMZ addresses that allow connections to the client through the public IP of the VPN server.<\/p>\n\n\n\n
![\"user_ip_settings\"](\"https:\/\/upcloud.com\/media\/user_ip_settings.png\")
<\/figure>\n\n\n\nIf you are possibly going to have more than a couple of users connecting to the VPN, you might wish to define the permissions on the group level. Create a user group on your cloud server and add the same group name to the Group Permissions<\/em> list, you can then give access to users directly from your server terminal, adding them to the authorised user group, without needing to add every user manually in the web admin panel.<\/p>\n\n\n\n
Server Network Settings<\/h3>\n\n\n\n
The IP settings can be configured in the Server Network Settings<\/em> under the Configurations<\/em> -menu. By default, the AS listens for incoming connections on the first network interface, but if you have multiple public IP addresses, it is possible to select between the interfaces or to listen to all of them.<\/p>\n\n\n\n
In the VPN Server settings, you will find the hostname, IP addresses and protocols, as well as the port numbers all easily configured straight from the control panel.<\/p>\n\n\n\n
![\"-\"](\"https:\/\/upcloud.com\/media\/server_network_settings-1.png\")
<\/figure>\n\n\n\nIf you have a valid domain name configured for your server, you can set the hostname to the Hostname or IP Address<\/em> -field to allow the AS to validate the configuration in the Web Server<\/em> -settings. The hostname also sets the server address in the AS-generated profiles. Keep it set to the IP address the server is listening to if you do not have a DNS record pointing to the server\u2019s IP.<\/p>\n\n\n\n
Next are the IP address settings for the Admin Web control panel and port selection. Be careful when making changes to the admin IPs not to lock yourself out from the admin panel by changing the IP to something unreachable. In such a case, it is possible to reconfigure the AS manually at your cloud server side using the \/usr\/local\/openvpn_as\/bin\/ovpn-init<\/em> tool as mentioned in the installation output.<\/p>\n\n\n\n
Advanced VPN<\/h3>\n\n\n\n
With the basic configuration settings, go to the Advanced VPN settings and scroll down to the bottom of the page. Here you will find the Additional OpenVPN Config Directives that allow you to specify any additional server and client options.<\/p>\n\n\n\n
![\"Additional](\"https:\/\/upcloud.com\/media\/additional_config_directives.png\")
<\/figure>\n\n\n\nTo improve the server-client encryption, include the following cypher and authentication options in both directives as shown above and then click the Save Settings button.<\/p>\n\n\n\n
cipher AES-256-CBC\nauth SHA256<\/pre>\n\n\n\n
Remember to reload the server with the prompt at the top of the page as well.<\/p>\n\n\n\n
Connecting to the Access Server<\/h2>\n\n\n\n
For Mac and Windows users, the easiest way to set up a VPN client is to use OpenVPN Connect. It can be installed directly from your Access Server and allows connecting to the VPN by logging in through the web portal. Linux users should use the OpenVPN client available through their system package manager.<\/p>\n\n\n\n
Open the web connection login page on your browser. By default, the connection page can be found at port 943 of your cloud server. You can use either the public IP address or domain name if you have one configured. Note that the connection needs to use HTTPS.<\/p>\n\n\n\n
https:\/\/server_ip_or_domain<\/span>:943<\/pre>\n\n\n\nOpening the address will show a warning that your connection is not trusted. Acknowledge the warning and proceed to sign in with your username and password.<\/p>\n\n\n\n
![\"logging_in\"](\"https:\/\/upcloud.com\/media\/logging_in.png\")
<\/figure>\n\n\n\nMac and Windows<\/h3>\n\n\n\n
After logging in, click the link to continue. It will start a download for the Connect -client.<\/p>\n\n\n\n
![\"connecting\"](\"https:\/\/upcloud.com\/media\/connecting.png\")
<\/figure>\n\n\n\nInstall the client software, while keeping the OpenVPN connection page open. Follow the instructions in the installation wizard, and allow the application to connect to an untrusted SSL certificate when asked.<\/p>\n\n\n\n
When the installation is complete, the client will automatically connect to the VPN and the login page will update to show the connection details. You can close the browser tab without interrupting the VPN, but it can be helpful for disconnecting from the Access Server.<\/p>\n\n\n\n
![\"vpn_connected\"](\"https:\/\/upcloud.com\/media\/vpn_connected.png\")
<\/figure>\n\n\n\nLinux<\/h3>\n\n\n\n
When logged in, you will be greeted by a list of connection options and a profile download shortcut, click the Yourself (user-locked profile)<\/em> link to download your OpenVPN profile.<\/p>\n\n\n\n
![\"download_config\"](\"https:\/\/upcloud.com\/media\/image2.jpg\")
<\/figure>\n\n\n\nSave the file anywhere you can find it later, e.g. in your ~\/<\/em> home directory.<\/p>\n\n\n\n
OpenVPN client for most distributions can be installed from the standard repositories.<\/p>\n\n\n\n
# Debian and Ubuntu\nsudo apt-get install openvpn\n# CentOS\nsudo yum install openvpn<\/pre>\n\n\n\n
That is all that is needed. You can then connect to the Access Server with the command below where the ~\/client.ovpn<\/em> is your profile saved in your home directory. Enter your username and password when prompted.<\/p>\n\n\n\n
sudo openvpn --config ~\/client.ovpn<\/pre>\n\n\n\n
When the VPN is up and running, you will see an output message like the one below, a timestamp and a confirmation that the connection was successful.<\/p>\n\n\n\n
Tue Apr 26 04:17:24 2016 Initialization Sequence Completed<\/pre>\n\n\n\n
Keep the terminal open while you wish to remain connected to the OpenVPN server. You can disconnect at any time by stopping the client with Ctrl+c<\/em> or by closing the terminal window.<\/p>\n\n\n\n
Testing your connection<\/h2>\n\n\n\n
With the VPN connection up and running, you should check that everything is working as expected. First, make sure you have access to the internet. If that works, you should test where you are connecting. Below are some easy ways to verify that your connection is being routed through the OpenVPN Access Server.<\/p>\n\n\n\n
Your IP to the internet<\/h3>\n\n\n\n
When connected to a VPN, your network traffic first goes through the VPN server before heading to its real destination. For anyone else on the internet, it seems that your requests originate from your AS. Many online services can show the source address of your connection. One such is a Google search for \u201cmy IP\u201d, you can use the link below for a shortcut.<\/p>\n\n\n\n
https:\/\/www.google.com\/search?q=my+ip<\/a><\/p>\n\n\n\n
If the IP address displayed above the search results matches that of your server\u2019s public IP address, the VPN is routing correctly.<\/p>\n\n\n\n
Using the private IP addresses<\/h3>\n\n\n\n
UpCloud servers have a private IP address only accessible to the cloud servers on your account. While connected through a VPN, your client is essentially linked to the server\u2019s private network, but only on that host. As such, you should be able to reach the VPN server\u2019s private IP address, which is listed in your UpCloud Control Panel<\/a> under the Network<\/em> menu and Private Network<\/em> tab.<\/p>\n\n\n\n
You can test the connections for example with the ping<\/em> command in your client computer\u2019s terminal or command prompt.<\/p>\n\n\n\n
ping private_ip<\/span><\/pre>\n\n\n\nIf you get a reply, your OpenVPN Access Server is working and you can use the private IP address on your VPN server for other connections.<\/p>\n\n\n\n
Note that CentOS and other Red Hat variants might block ICMP requests at their firewall by default, in such case, you can test the routing with SSH instead.<\/p>\n\n\n\n
Conclusions<\/h2>\n\n\n\n
Having your personal VPN server can provide many advantages from improved security and privacy to the convenience of a fixed IP or a local area network between computers on different continents. OpenVPN Access Server is capable of much more than could be explained in a simple start-up guide. If you wish to learn more about the various configuration options, check out their Sysadmin Guide to OpenVPN AS<\/a>.<\/p>\n\n\n\n
- After making changes to the OpenVPN AS, restart the server to apply the new configuration by pressing the Update Running Server<\/em> button.<\/li>\n\n\n\n
- Type your username in the New Username<\/em> field, select the admin permissions and auto-login if you wish, then press the Save Settings<\/em> button.<\/li>\n\n\n\n