OpenVPN offers a variety of different software installation packages and virtual appliance to suit your needs. \u00a0I opted for the VMware virtual appliance to deploy in my home network. \u00a0In this tutorial, I will show you just how to deploy an OpenVPN Access Server on ESXi 6.5. \u00a0For the purposes of this demonstration, I will be deploying said appliance on a virtual ESXi host running in my lab so without any further hesitation, let’s get started!<\/p>\r\n
- \r\n\t
- Head on over to the OpenVPN website and download the virtual appliance<\/a> for VMware. \u00a0\r\n\r\n
- \r\n\t
- At the time of this writing, the current version is 2.1.3 released back on 9\/16\/2016. \u00a0Installation instructions<\/a> are also provided on this site. \u00a0Once you have obtained the virtual appliance, connect to your ESXi host via the ESXi Host UI or the vCenter Web Client. \u00a0<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- As I am just working on a single host without a vCenter, I will leverage the ESXi Host UI. \u00a0Follow along to deploy the appliance…<\/li>\r\n<\/ul>\r\n
![\"\"](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-42-50-150x150.png?resize=150%2C150\")
<\/a> ![\"\"](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-43-06-150x150.png?resize=150%2C150\")
<\/a> ![\"\"](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-43-56-150x150.png?resize=150%2C150\")
<\/a> ![\"\"](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-44-27-150x150.png?resize=150%2C150\")
<\/a> ![\"\"](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-44-50-150x150.png?resize=150%2C150\")
<\/a> ![\"\"](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-45-22-150x150.png?resize=150%2C150\")
<\/a> ![\"\"](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-45-45-150x150.png?resize=150%2C150\")
<\/a> ![\"\"](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-49-49-150x150.png?resize=150%2C150\")
<\/a><\/p>\r\n- \r\n\t
- Now that the appliance has been deployed, go ahead and power it on then open a Remote Console session to the appliance. \u00a0I will be leveraging the VMware VMRC version 9.0. \u00a0Once the appliance has booted, you will be presented with the following screen.<\/li>\r\n<\/ul>\r\n
![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-50-11-300x151.png?resize=300%2C151\")
<\/a> ![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-51-58-300x150.png?resize=300%2C150\")
<\/a>\u00a0![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_15-59-03-300x169.png?resize=300%2C169\")
<\/a><\/p>\r\n- \r\n\t
- Now, login to the appliance using the following default credentials.\r\n\r\n
- \r\n\t
- Username – root<\/li>\r\n\t
- Password – openvpnas<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n
- \r\n\t
- We are now\u00a0entering the configuration wizard. \u00a0Type “yes” to accept the license agreement and begin the wizard<\/li>\r\n<\/ul>\r\n
![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_16-00-31-300x169.png?resize=300%2C169\")
<\/a><\/p>\r\n- \r\n\t
- From this point, a series of questions will be presented. \u00a0For the most part, we will be accepting the defaults so follow along to configure the appliance.\r\n\r\n
- \r\n\t
- Will this be the primary Access Server node?\r\n\r\n
- \r\n\t
- Explanation:<\/strong> If this is your initial Access Server node, press\u00a0Enter<\/strong> to accept the default setting. Otherwise, if you are setting up your failover node, change this to say\u00a0no<\/strong>.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Please specify the network interface and IP address to be used by the Admin Web UI:\r\n\r\n
- \r\n\t
- Explanation:<\/strong> This will be the interface where OpenVPN Access Server will listen to Admin Web UI requests. Make sure you have access to the interface listed otherwise you will be unable to login to your server. If you are uncertain on what interface to use, select option\u00a01<\/strong> for all interfaces. Do note that if your network did not assign your appliance a DHCP lease or if you are planning to use a static IP for your server, you will need to specify all interfaces here and follow the instructions for assigning a Static IP in the later section of this article. This option may be changed any time after the completion of the wizard in the Web Admin UI.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Please specify the port number for the Admin Web UI.\r\n\r\n
- \r\n\t
- Explanation:<\/strong> This is the port you will use to access the web-based administration area. It is usually safe to leave this at the default port unless customization is desired.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Please specify the TCP port number for the OpenVPN Daemon\r\n\r\n
- \r\n\t
- Explanation:<\/strong> This is the port clients will use to connect to your VPN server. This port will have to be forwarded to the Internet if your server is behind a NAT-based router. By default, the web-based administration area also runs on this port for your convenience, although this setting can be disabled in the Admin Web UI interface.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Should client traffic be routed by default through the VPN?\r\n\r\n
- \r\n\t
- Explanation:<\/strong> If you only have a small network you would like your remote users to connect over the VPN, select\u00a0no<\/strong>. Otherwise, if you would like everything to go through the VPN while the user is connected (especially useful if you want to secure data communications over an insecure link), select\u00a0yes<\/strong> for this option.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Should client DNS traffic be routed by default through the VPN?\r\n\r\n
- \r\n\t
- Explanation:<\/strong> If you would like your VPN clients to able to resolve local domain names using an on-site DNS server, select\u00a0yes\u00a0<\/strong>for this option. Otherwise, select\u00a0no<\/strong>. Do note that if you selected\u00a0yes<\/strong> for the previous option, all traffic will be routed over the VPN regardless what you set for this setting here.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Use local authentication via internal DB?\r\n\r\n
- \r\n\t
- Explanation:<\/strong> If you would like OpenVPN Access Server to keep an internal authentication database for authenticating your users, select\u00a0yes<\/strong> for this option. When this option is turned on, you will be able to define and\/or change username and passwords within the Admin Web UI. If you select\u00a0no<\/strong> for this option, Linux PAM authentication will be used and you will need to add\/change\/delete users within the Linux operating system itself. If you would like to use LDAP or RADIUS as your authentication method, you will need to change this after you login to the Web Admin UI.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Should private subnets be accessible to clients by default?\r\n\r\n
- \r\n\t
- Explanation:<\/strong> This option defines the default security setting of your OpenVPN Access Server. When\u00a0Should client traffic be routed by default through the VPN?<\/strong> is set to\u00a0no<\/strong>, it defines the list of subnets that your VPN clients is able to access. You are able to add more entries to this list once you log in to the Admin Web UI area. This option will have no effect if\u00a0Should client traffic be routed by default through the VPN?<\/strong> is set to\u00a0yes<\/strong>.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Do you wish to login to the Admin UI as “openvpn”?\r\n\r\n
- \r\n\t
- Explanation:<\/strong> This defines the initial username in which you would use to login to the Access Server Admin UI area. This username will also serve as your\u00a0“lock out”<\/strong> administrator username shall you ever lock yourself out of your own server. If you would like to specify your own username, select\u00a0no<\/strong>. Otherwise, accept\u00a0yes <\/strong>for the default.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Specify the username for an existing user or for the new user account:\r\n\r\n
- \r\n\t
- Explanation:<\/strong> Enter the initial username you would like to use instead of the default ‘openvpn<\/strong>‘.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Type the password for the ‘user’ account: > Confirm the password for the ‘user’ account:\r\n\r\n
- \r\n\t
- Explanation:<\/strong> Specify the password you would like to use for the account.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Please specify your OpenVPN-AS license key (or leave blank to specify later):\r\n\r\n
- \r\n\t
- Explanation:<\/strong> If you have purchased a license key for your OpenVPN Access Server software, enter it here. Otherwise, leave it blank. OpenVPN Access Server includes two free licenses for testing purposes. After you complete the setup wizard, you can access the Admin Web UI area to configure other aspects of your VPN. The URL for the Admin Web UI area is displayed upon the completion of the setup wizard. As mentioned previously, you will be able to access the Admin Web UI on both the VPN port and the Admin port unless you disable this behavior in the Admin Web UI. Note: If you selected\u00a0yes<\/strong> to the\u00a0Do you wish to login to the Admin UI as “openvpn”? <\/strong>option in the setup wizard, you will need to define the password for this account by running: passwd openvpn<\/strong> and press\u00a0Enter<\/strong>.<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- The only options I changed from the defaults are as follows…\r\n\r\n
- \r\n\t
- Port used by the OpenVPN Daemon\r\n\r\n
- \r\n\t
- I used “9443”<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Use local authentication via internal DB\r\n\r\n
- \r\n\t
- I said “yes”<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Do you wish to login to the Admin UI as “openvpn”?\r\n\r\n
- \r\n\t
- I said “no” and then specified a username and password.<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n
![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_17-01-46-300x169.png?resize=300%2C169\")
<\/a><\/p>\r\n- \r\n\t
- There are also a few optional settings you can configure which are detailed on the instructions web page but I will not cover them here.<\/li>\r\n\t
- If an at point you mess up during the initial configuration, first complete it and then from the command prompt type<\/li>\r\n<\/ul>\r\n
ovpn-init<\/pre>\r\n
- \r\n\t
- This will prompt you to type “DELETE<\/strong>” to wipe the current config so you can start over.<\/li>\r\n<\/ul>\r\n
![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_17-00-08-300x169.png?resize=300%2C169\")
<\/a><\/p>\r\n- \r\n\t
- Now that the appliance is deployed and configured, a port-forwarding rule is required to pass traffic to the appliance so it can be connected to from outside your network. \u00a0Head over to your router and configure the TCP port you defined during the initial configuration for the OpenVPN Daemon to forward to the IP of the appliance. \u00a0An additional UDP port-forward is needed for port 1194 to the appliance’s IP address.<\/li>\r\n<\/ul>\r\n
TCP Port 9443 #this is the port that I defined in the configuration\r\n\r\nUDP Port 1194<\/pre>\r\n
![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_20-20-18-300x241.png?resize=300%2C241\")
<\/a><\/p>\r\n- \r\n\t
- Once the port forwarding rules are in place, you can connect to the appliance via a web browser on your network as well as from an external network. \u00a0Let’s start by testing connectivity from within our network. \u00a0Open a web browser and navigate to the appliance admin login page<\/li>\r\n<\/ul>\r\n
https:\/\/<appliance-IP>:<port>\/admin<\/pre>\r\n
- \r\n\t
- If successful, you should see the login page and can log in with the credentials set during configuration. \u00a0From here you can configure the appliance to your liking then download the OpenVPN Client for use on Windows, Mac, etc. \u00a0I will not cover the settings in this tutorial but feel free to poke around here and configure your appliance before logging out.<\/li>\r\n<\/ul>\r\n
![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_17-02-45-300x161.png?resize=300%2C161\")
<\/a> ![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_17-03-09-300x151.png?resize=300%2C151\")
<\/a> ![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_17-03-31-300x151.png?resize=300%2C151\")
<\/a><\/p>\r\n- \r\n\t
- You can also connect to the appliance without the “\/admin” in the URL so that you can download your client. \u00a0You can use either\u00a0option from the drop-down menu.\u00a0<\/li>\r\n<\/ul>\r\n
https:\/\/<appliance-IP>:<port><\/pre>\r\n
![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_20-26-49-300x161.png?resize=300%2C161\")
<\/a><\/p>\r\n- \r\n\t
- If you choose the “Connect” option, you will see this screen which will prompt you to download the OpenVPN Client for your computer.<\/li>\r\n<\/ul>\r\n
![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_20-27-35-300x151.png?resize=300%2C151\")
<\/a><\/p>\r\n- \r\n\t
- If you choose “Login” option, you will see this screen which provides various download links for other devices, as well as the option to download your custom profile to be used in the client so that you connect to your personal VPN environment.<\/li>\r\n<\/ul>\r\n
- If you choose the “Connect” option, you will see this screen which will prompt you to download the OpenVPN Client for your computer.<\/li>\r\n<\/ul>\r\n
- You can also connect to the appliance without the “\/admin” in the URL so that you can download your client. \u00a0You can use either\u00a0option from the drop-down menu.\u00a0<\/li>\r\n<\/ul>\r\n
- If successful, you should see the login page and can log in with the credentials set during configuration. \u00a0From here you can configure the appliance to your liking then download the OpenVPN Client for use on Windows, Mac, etc. \u00a0I will not cover the settings in this tutorial but feel free to poke around here and configure your appliance before logging out.<\/li>\r\n<\/ul>\r\n
- Once the port forwarding rules are in place, you can connect to the appliance via a web browser on your network as well as from an external network. \u00a0Let’s start by testing connectivity from within our network. \u00a0Open a web browser and navigate to the appliance admin login page<\/li>\r\n<\/ul>\r\n
- Now that the appliance is deployed and configured, a port-forwarding rule is required to pass traffic to the appliance so it can be connected to from outside your network. \u00a0Head over to your router and configure the TCP port you defined during the initial configuration for the OpenVPN Daemon to forward to the IP of the appliance. \u00a0An additional UDP port-forward is needed for port 1194 to the appliance’s IP address.<\/li>\r\n<\/ul>\r\n
- This will prompt you to type “DELETE<\/strong>” to wipe the current config so you can start over.<\/li>\r\n<\/ul>\r\n
- I said “no” and then specified a username and password.<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n
- The only options I changed from the defaults are as follows…\r\n\r\n
- Please specify your OpenVPN-AS license key (or leave blank to specify later):\r\n\r\n
- Type the password for the ‘user’ account: > Confirm the password for the ‘user’ account:\r\n\r\n
- Specify the username for an existing user or for the new user account:\r\n\r\n
- Do you wish to login to the Admin UI as “openvpn”?\r\n\r\n
- Should private subnets be accessible to clients by default?\r\n\r\n
- Use local authentication via internal DB?\r\n\r\n
- Should client DNS traffic be routed by default through the VPN?\r\n\r\n
- Should client traffic be routed by default through the VPN?\r\n\r\n
- Please specify the TCP port number for the OpenVPN Daemon\r\n\r\n
- Please specify the port number for the Admin Web UI.\r\n\r\n
- Please specify the network interface and IP address to be used by the Admin Web UI:\r\n\r\n
- Explanation:<\/strong> If this is your initial Access Server node, press\u00a0Enter<\/strong> to accept the default setting. Otherwise, if you are setting up your failover node, change this to say\u00a0no<\/strong>.<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
- Will this be the primary Access Server node?\r\n\r\n
- From this point, a series of questions will be presented. \u00a0For the most part, we will be accepting the defaults so follow along to configure the appliance.\r\n\r\n
- We are now\u00a0entering the configuration wizard. \u00a0Type “yes” to accept the license agreement and begin the wizard<\/li>\r\n<\/ul>\r\n
- Now, login to the appliance using the following default credentials.\r\n\r\n
- As I am just working on a single host without a vCenter, I will leverage the ESXi Host UI. \u00a0Follow along to deploy the appliance…<\/li>\r\n<\/ul>\r\n
- At the time of this writing, the current version is 2.1.3 released back on 9\/16\/2016. \u00a0Installation instructions<\/a> are also provided on this site. \u00a0Once you have obtained the virtual appliance, connect to your ESXi host via the ESXi Host UI or the vCenter Web Client. \u00a0<\/li>\r\n<\/ul>\r\n<\/li>\r\n\t
![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_20-33-21-300x151.png?resize=300%2C151\")
<\/a><\/p>\r\n![](\"https:\/\/i0.wp.com\/ithinkvirtual.com\/wp-content\/uploads\/2017\/02\/2017-02-12_21-00-37-144x300.png?resize=144%2C300\")
<\/a><\/p>\r\n