How To: OpenVPN Access Server

When it comes to secure remote access, few solutions are as reliable as OpenVPN. At Crosstalk Solutions, we’ve used OpenVPN for years to help our clients maintain secure connections to their systems. In this article, we’re diving deep into OpenVPN’s Access Server, a robust solution that combines ease of use with powerful features. If you’re looking to set up your own VPN infrastructure, you’re in the right place!

Why OpenVPN Access Server?

OpenVPN Access Server offers a flexible and fully customizable VPN solution. You can deploy it on your hardware or choose a cloud-based virtual private server (VPS) from providers like Digital Ocean, which makes scaling a breeze as your needs grow. Whether you need secure access for remote employees or want to connect remote sites, OpenVPN gives you full control over who has access to what, with multi-factor authentication and split-tunneling options.

The cloud-hosted OpenVPN CloudConnexa is also worth considering. It offers similar functionality but takes away the burden of server management, letting OpenVPN host it for you. However, if you’re a fan of having control over your infrastructure, the self-hosted route, like what we’re covering here, is the way to go.

If you have found this article helpful, and you’re going to sign up for OpenVPN CloudConnexa or Access Server, please use our link below! Our link doesn’t change your price at all, but gets us a few bucks for the referral and helps us continue to create great content!

Click HERE for OpenVPN Products!

Basic Use Cases for OpenVPN Access Server

Here are two common scenarios where OpenVPN Access Server excels:

Remote User Access: Remote employees need secure access to internal company resources. OpenVPN Connect, the official OpenVPN client, allows them to access everything they need securely without opening up your firewall to potential risks.

Remote Site Connectivity: Let’s say you own a chain of restaurants. Each location can use OpenVPN clients to connect back to a central server, allowing secure communication between sites without sacrificing security or uptime.

Getting Started with OpenVPN Access Server

For this setup, we’ll be using Digital Ocean, which provides a one-click install of OpenVPN Access Server on an Ubuntu VPS. Don’t worry—if you prefer Docker or hosting it on your own hardware, OpenVPN has excellent documentation to guide you through those processes.

Step-by-step instructions:

Create a Droplet on Digital Ocean: Head over to Digital Ocean’s marketplace, select OpenVPN Access Server, and choose the smallest $6 per month option if you’re just testing. This is more than enough for a few users and allows you to scale up later if needed. I highly recommend setting up a public/private keypair for SSH authentication.

As soon as you have your OpenVPN Access Server Droplet created, you should copy the IP address and create a DNS A-Record for your FQDN – in my case, I’m using vpn.crosstalknetworking.com as the FQDN.

Once your Digital Ocean droplet is up and running, connect with SSH and go through the setup wizard. You can take all defaults. Once the wizard is complete, you should be able to log into your OpenVPN Access Server by navigating your browser to: https://[IP address of your server]:943/admin

You’ll be taken to the Activation Manager by default. Click to log into OpenVPN and obtain an activation key. For testing/demo purposes, the free 2 concurrent user license is fine. However, if you’re going to be purchasing your license, be sure to use our referral link! Flip back to the OpenVPN server and paste your activation key to activate.

Next update the server:

apt update && apt upgrade -y

During this process, just take the defaults for anything that pops up, and if you see a note telling you to reboot the server, go ahead and reboot by typing ‘reboot.’

Set the timezone – to list all available timezone options type:

timedatectl list-timezones

Once you have your timezone selected, apply it with:

timedatectl set-timezone America/Los_Angeles

Replace America/Los_Angeles with your timezone.

Update OpenVPN:

apt-mark unhold openvpn-as
bash <(curl -fsS https://as-repository.openvpn.net/as/install.sh)

During the upgrade, you may be asked to install the OpenVPN DCO (Data Channel Offload) – say yes. Once the update is complete, log back into the Admin GUI for your OpenVPN Access Server, and you should be on the latest version.

Set the hostname: Up until now, we’ve been connecting to the IP address of our server. Let’s change that to the FQDN. You can set the server’s hostname in Configuration –> Network Settings.

Also check the Web Service Forwarding settings – these determine if you want your server answering requests on port 943, or if you want the client/admin GUI’s redirected to HTTPS.

Save Settings and Update Running Server to save. You will now have to reconnect to the FQDN for your server.

Set Up Your SSL Certificate: If you want to secure your connection with SSL (highly recommended), you’ll need to create a fully qualified domain name (FQDN). You can generate SSL certificates manually, or use Let’s Encrypt, which is a free solution that integrates easily with OpenVPN Access Server.

Manual SSL certificate – if you want to set up the certificate manually, you’ll have to generate a CSR (certificate signing request). You can do this by logging into the server with SSH and running:

openssl req -new -newkey rsa:2048 -nodes -keyout mydomain.key -out mydomain.csr

Replace ‘mydomain’ with your FQDN. Follow the prompts – once complete, this will generate two files. Your private key (.key) and your certificate signing request (.csr). The private key will be uploaded to the OpenVPN Admin GUI, and the CSR will need to be given to your SSL Certificate provider in order to generate the actual certificate.

I used NameCheap for my SSL Certificate, and I bought the cheapest one which was $5.99/year.

Here is the general process:

Once you have all 3 files (the private key plus the CA Bundle and certificate from your SSL Certificate provider you can upload them in the OpenVPN Admin GUI by navigating to Configuration –> Web Server. Save and apply, and then close and re-open your browser – you should now be secure!

Alternatively, you can set up Let’s Encrypt which is a free SSL Certificate that refreshes monthly by using a service called certbot. You can find full instructions for configuring Let’s Encrypt with OpenVPN Access Server HERE.

Add a User: Log into the Admin GUI and set up your first user under Authentication > Settings. For added security, make sure to enable multi-factor authentication (TOTP) and configure a strong password policy.

Deploy Your VPN Clients: Whether your users are on Windows, macOS, or even mobile devices, the OpenVPN Connect client makes onboarding a breeze. Your users can download pre-configured profiles, reducing setup errors and ensuring a seamless experience. To download your client profiles, have users log into the OpenVPN Access Server client GUI (same FQDN as the Admin GUI, but without /admin).

Setting Up OpenVPN for Routers

Router / remote site setup: We need to create another user for the VPN Client connection from your router to the OpenVPN Access Server. First though, create a static VPN network for hardware devices by navigating to Configuration –> VPN Settings. Create a new network under ‘Static IP Address Network (Optional).’

Also set up your routing – you’ll want to add any private LAN subnets you want your VPN Clients to have access to.

If you disable ‘Should client Internet traffic be routed through the VPN?’ you will set up split tunneling which means ONLY traffic destined for the VPN network(s) will go through the VPN, and normal Internet traffic will go out to the Internet normally.

Next create a new user for your router. In this example, I gave the router a static IP address, added my VPN and LAN networks and set up this user as a VPN Gateway for the LAN network 192.168.22.0/24. We’re telling Access Server that any traffic destined for 192.168.22.0/24 should be routed to this VPN Client, and the router on the receiving end will deal with it.

Log into the OpenVPN Access Server Client GUI as the router user to download the configuration file and then upload that to your router. Most routers should have a way to use OpenVPN as a client device connection. You’ll also have to tell your router to allow traffic coming from the VPN network that it’s OK to access devices in the back-end LAN.

Once this is all dialed in, your remote VPN users will have access to services behind the router!

Final Thoughts

In under an hour, you can deploy a fully functional OpenVPN Access Server, allowing secure access for remote users and remote sites alike. While the setup is straightforward, managing a VPN at scale—especially with complex routing needs—can become tricky. That’s where our team at Crosstalk Solutions can help. We specialize in designing and implementing secure VPN infrastructures tailored to your specific needs.