The Power of OpenVPN Access Server
Configuring a traditional, open-source OpenVPN daemon via the command line involves manually generating complex Public Key Infrastructure (PKI) certificates, writing routing rules in iptables, and building custom .ovpn client files by hand. It is notoriously difficult. OpenVPN Access Server (OpenVPN AS) is the enterprise edition. It provides a beautiful, user-friendly web interface that automates the entire certificate authority process, allows you to manage users graphically, and even provides a self-service portal where employees can download pre-configured VPN clients for Windows, Mac, or iOS with a single click. It is free for up to 2 concurrent connections.
Step 1: Download the Access Server Package
OpenVPN AS is not in the default Ubuntu repository; you must download the specific .deb package from the official OpenVPN website for your OS version (e.g., Ubuntu 22.04 LTS).
Open your terminal and use wget to download the package:
wget https://as-repository.openvpn.net/as/server/debian/pool/main/o/openvpn-as/openvpn-as_2.12.1-17f1a301-Ubuntu22_amd64.deb
Step 2: Install the Package
Install the downloaded package using the dpkg package manager. The installation process is fully automated and will take a few minutes to generate the initial web server certificates and database structure.
sudo dpkg -i openvpn-as_*.deb
When the installation finishes, the terminal will explicitly output two URLs: the Admin UI (for you) and the Client UI (for your users), along with a randomly generated password for the default openvpn administrative user. Copy this password immediately!
Step 3: Access the Admin Web Interface
Open your web browser and navigate to the Admin UI URL provided in the terminal (typically https://Your_Server_IP:943/admin). You will likely receive a security warning because the server is using a self-signed SSL certificate; bypass the warning.
Log in using the username openvpn and the randomly generated password.
Step 4: Configure Network Routing
Once logged in, click on Configuration > VPN Settings in the left-hand menu.
Scroll down to the Routing section. By default, OpenVPN AS might be set to route all client internet traffic through the VPN (a “full tunnel”). If you only want users to access internal company servers while browsing the internet on their own ISP (a “split tunnel”), configure the following:
- Should VPN clients have access to private subnets (non-public networks on the server side)? Yes, using routing.
- Specify the private subnets to which all clients should be given access: Type your internal LAN subnet (e.g.,
192.168.1.0/24). - Should client Internet traffic be routed through the VPN? No.
Click Save Settings at the bottom, and then click the green Update Running Server button at the top to apply the changes.
Step 5: Create a VPN User
Navigate to User Management > User Permissions.
Type a new username (e.g., jsmith) in the blank box under the “New” column. Click the More Settings pencil icon next to the new user.
In the Local Password field, type a strong password for this user. Click Save Settings and Update Running Server.
Your VPN is complete. John Smith simply opens his web browser at home, navigates to the Client UI (https://Your_Server_IP:943), logs in with his new credentials, and downloads the OpenVPN Connect app. The app comes pre-loaded with his unique certificates, allowing him to securely connect to the office LAN with one click.