When is OpenVPN Access Server the easiest choice?
OpenVPN Access Server suits a VPS owner who wants user accounts, downloadable connection profiles and a browser-based control panel. The server runs on Linux; your everyday computer or phone does not need Linux. This guide uses Access Server 3.x, whose menu labels differ from older tutorials.
Access Server is a separate product from OpenVPN Community Edition. Installing the Ubuntu package named openvpn does not install this control panel. At the review date, OpenVPN documents two simultaneous connections under its free Access Server license. More concurrent connections require licensing; VPS hosting charges are separate. Review the current terms before choosing a deployment or trial.
1. Prepare a supported Ubuntu or Debian VPS
Use a fresh VPS with a stable public IPv4 address, root or sudo access, a working system clock and outbound internet connectivity. Choose a nearby location for latency and check the plan’s transfer allowance. A VPN consumes server bandwidth; it does not remove a connection’s speed limits.
The current supported list includes Ubuntu 22.04, 24.04 and 26.04 LTS, and Debian 12 and 13. Confirm the architecture on OpenVPN’s requirements page. Keep this VPS dedicated to the VPN so existing websites do not compete for TCP port 443.
cat /etc/os-release
uname -m
timedatectl2. Install from the official Access Server portal
- Open the official Linux installation guide below. Create or sign in to your OpenVPN account and open the Access Server portal.
- Choose Install Access Server and select the OS and architecture matching your VPS. Copy the generated installation script.
- Review the script and run it on your VPS using the privileges specified by the portal. Use the official script rather than an unrelated one-click installer.
- Keep the installation output: it contains the admin URL and initial credentials. Complete activation if prompted, choosing the intended license rather than accidentally starting a paid trial.
Use the displayed HTTPS admin address, usually https://YOUR_PUBLIC_IP:943/admin/. A new deployment may have a self-signed certificate. Verify that the address belongs to your own VPS before proceeding; configure a trusted certificate before sharing the web portal with other users.
3. Allow VPN traffic and restrict the admin panel
Check both the provider firewall and the VPS firewall. Preserve your SSH rule and keep a second session open while changing access rules. Never enable a firewall before allowing the SSH port you actually use.
| Port | Use | Access |
|---|---|---|
| UDP 1194 | Default VPN tunnel | Allow intended VPN clients |
| TCP 443 | VPN TCP fallback and client web portal | Allow intended VPN clients |
| TCP 943 | Default web interfaces | Restrict during setup; public only if needed for the client portal after separating admin access |
| TCP 946 | Example separate admin port | Allow only your trusted administration IP |
| Your SSH port | Server management | Allow only trusted administration sources |
In Web Services, separate the Admin Web Server onto an unused port such as 946. Turn off its forwarding through the OpenVPN TCP port. Keep Client Web Server on its own public address and port, with client forwarding on 443 if needed. Restrict the admin port in both firewalls and test from an untrusted connection. Follow the official instructions for your network layout.
4. Set the public address, full tunnel and DNS
Under VPN Server → Network Settings, set the server address to your VPS’s public IPv4 address or a hostname such as vpn.example.com. For a hostname, create a DNS A record pointing to the VPS first. Never advertise 127.0.0.1: that means the connecting device itself. Save and restart, then download fresh profiles after changing the address.
For browsing through your VPS, open Access Controls → Internet Access and DNS and choose Full-Tunnel. Split-Tunnel is appropriate when only selected private resources should use the VPN. Confirm DNS servers are reachable and pushed to clients. Access Server 3.2.2 separates Client DNS from Upstream DNS; review both if those fields appear.
IPv4 success does not prove IPv6 protection. Access Server needs IPv4 for incoming connections, while IPv6 inside the tunnel needs additional configuration. Either configure and test IPv6 routing using the official guide or verify that your client blocks untunneled IPv6. Do not call the setup leak-free without checking.
5. Connect Windows, Mac, Android or iPhone
Create a regular account under Users → Add New User. With local authentication, set its password using Reset Password. Use this account for daily connections instead of the administrator. Enable supported multifactor authentication for accounts that need it.
- Install the official OpenVPN Connect app for Windows, macOS, Android or iOS.
- Sign in to your Client Web UI, typically https://vpn.example.com/ with client forwarding enabled, or its configured HTTPS port.
- Download your connection profile and import the .ovpn file into OpenVPN Connect. Keep profiles private; do not paste them into support chats or public repositories.
- Connect and authenticate. On phones, approve the operating system’s VPN permission request.
Check that Access Server shows the session. In full-tunnel mode, compare your public IPv4 before and after connecting: the connected address should be the VPS’s outbound address. Test DNS, IPv6 and ordinary websites, then disconnect and reconnect. This confirms more than a green connection icon.
Common OpenVPN VPS setup problems
| Symptom | Check first |
|---|---|
| Connection times out | Public server address, firewall protocol and port, and whether the VPN service is running. |
| Connected but websites fail | Full-tunnel routing, reachable client DNS servers, forwarding and outbound firewall rules. |
| Websites still see the home address | Split-tunnel settings, stale profiles, and IPv6 taking a different path. |
| Authentication or certificate error | User credentials, MFA, system clock and whether the profile belongs to this server. |
| An additional device cannot connect | Current simultaneous connection usage and the active license limit. |
Keep Linux and Access Server updated, back up configuration securely, and revoke profiles for lost devices. A self-hosted VPN changes your internet exit point; it does not make browser logins anonymous or make the VPS provider disappear from the trust chain.
Common questions
Can I use OpenVPN on a Windows VPS?
This Access Server tutorial requires a supported Linux server. A Windows computer can connect with OpenVPN Connect. Running OpenVPN Community Edition on Windows Server is a different deployment and does not provide the Access Server interface described here.
Is OpenVPN Access Server free for a personal VPN?
At this guide’s review date, OpenVPN documents two simultaneous connections under its free license. The VPS still has hosting costs. Check current licensing and avoid selecting a trial unless you intend its terms.
Should I choose OpenVPN or WireGuard for my VPS?
Choose Access Server when its user accounts and administration interface suit your needs. Consider WireGuard for a smaller configuration with individual device keys. Firewall compatibility, client support and management needs matter more than a universal speed claim.
Official documentation
Documentation reviewed October 18, 2026. Check the linked project documentation before installing or upgrading; commands below have not been run on your VPS.