To set up a self-hosted OpenVPN Access Server, install it with root privileges on a supported, dedicated Linux host, give it a stable public hostname, complete the Admin Web UI wizard, choose full- or split-tunnel routing, configure authentication and users, and connect a test device with OpenVPN Connect. The unlicensed installation allows two simultaneous VPN connections; larger deployments require an activation key.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This guide covers the installation decisions that determine whether the VPN is reachable and secure: operating-system support, DNS and firewall rules, VPN subnet selection, identity providers, first-client testing, licensing, and production hardening.
As an Amazon Associate I earn from qualifying purchases.
What you need before installing
Access Server is a self-hosted business VPN server that creates encrypted tunnels between client devices and your private networks or the public internet. Install it on a compatible 64-bit Linux system with a non-static-compiled kernel. OpenVPN recommends a dedicated server rather than a machine already running unrelated applications, because firewall, routing, CPU, and memory contention can make failures difficult to diagnose.
Supported operating systems
Official support is limited to the following 64-bit releases. Ubuntu support applies to LTS releases only.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
| Operating system | Supported releases |
|---|---|
| Ubuntu LTS | 22.04, 24.04, and 26.04 |
| Debian | 12 and 13 |
| Red Hat Enterprise Linux | 8, 9, and 10 |
The documentation also describes Linux installations on cloud providers, virtual machines, Docker, and Raspberry Pi. Ubuntu is presented as the quickest route for a new deployment, but the best platform is the one for which you can control updates, networking, backups, and recovery.
Host and network prerequisites
- Root access or an equivalent administrative method for installing packages and changing network settings.
- A stable public address, or a NAT arrangement that forwards traffic to the server.
- A DNS name such as
vpn.example.comthat resolves to the public address clients will use. - Control of the cloud security group, upstream router, and host firewall so VPN and web traffic can reach the service.
- Accurate system time and the correct time zone. Certificate validity and time-based one-time-password MFA both depend on a reliable clock.
- Enough CPU, memory, storage, and bandwidth for your encryption, routing, authentication, and concurrent-connection workload. There is no universal OpenVPN capacity number that applies to every host.
Do not choose the internal VPN network until you have checked every LAN and routed network that clients must reach. The default internal subnet is 172.27.224.0/20; replace it if it overlaps an existing network.
Install Access Server
1. Provision and prepare the host
- Deploy a supported 64-bit release on a dedicated host. A cloud instance, virtual machine, physical Linux server, Docker deployment, or Raspberry Pi can be used when its networking and resources are appropriate for the workload.
- Log in with root privileges, update the operating system using its normal maintenance process, and verify the system clock, time zone, hostname, and network interface.
- Assign or reserve the public address that clients will reach. If the server is behind NAT, record the private address and create the required port forwards on the upstream device.
- Create a DNS record for the VPN hostname and confirm that it resolves from a network outside the server’s local LAN.
2. Run the official installer
Use OpenVPN’s installation method for the selected operating system. The installer completes the package setup and prints the Admin Web UI address, the Client Web UI address, and an initial openvpn account with a generated password. Save that output in a protected place; do not paste the generated password into a ticket, chat room, or shell history that other administrators can read.
The installer does not replace the need to configure your perimeter. A successful package installation only proves that software is present. Clients still need a route through your cloud security group, router, NAT device, and host firewall.
3. Sign in to the Admin Web UI
- Open
https://server-address:943/admin/, or the exact administrator endpoint printed by the installer. - Expect a self-signed-certificate warning on this first connection. This is normal for the initial setup; replace the certificate before inviting real users.
- Sign in with the generated
openvpnaccount and password. - Accept the Access Server EULA.
- Record the web-service port. TCP 943 is the default administrative and client web-service port; TCP 443 can redirect browser requests to the web interface when configured that way.
After the first login, create named administrator accounts and stop relying on the default account for routine administration. Keep the initial credentials available only for controlled recovery.
Complete the first-run network wizard
The onboarding wizard asks how connected clients should use the VPN. Select the smallest scope that meets the requirement, then review the detected network CIDRs before saving. A mistaken CIDR can expose a network users should not reach or prevent traffic from returning to the client.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Choose internet access, private-resource access, or both
- Internet access: client internet traffic exits through the Access Server. This is the usual full-tunnel arrangement.
- Private-resource access: only selected internal networks are published through the tunnel.
- Both: users can reach internal resources and send ordinary internet traffic through the server.
For private-resource routing, list only the internal CIDRs users need. Each destination must have a return path: the internal router must know how to reach the VPN client subnet, or the Access Server must perform the required NAT. Without a return route or NAT, the client may connect successfully while applications time out.
Full tunnel versus split tunnel
| Routing mode | Traffic sent through the VPN | Typical result | Operational consideration |
|---|---|---|---|
| Full tunnel | Private networks and ordinary internet traffic | The client’s public IP normally changes to the server’s public address while connected | The server carries the user’s internet bandwidth and must have suitable egress capacity |
| Split tunnel | Only selected private networks or routes | Ordinary internet traffic continues through the client’s local connection | Unlisted private networks remain unreachable through the VPN |
Full tunneling is useful when traffic must leave from a controlled public address or when policy requires inspection at the VPN gateway. Split tunneling usually reduces server bandwidth and preserves local access to internet services, but it requires deliberate route lists and does not protect ordinary internet traffic from the local network.
Check the VPN subnet
Access Server uses a virtual client network. Keep the documented default 172.27.224.0/20 only if it is absent from every client LAN, server LAN, cloud VPC, and routed site. Overlap causes the client to prefer its local network for a destination that should be inside the tunnel, producing intermittent or apparently random failures. Change the pool before users are enrolled; changing it later requires retesting routes, firewall rules, and any return paths.
Make DNS, certificates, and firewalls usable
Use a public hostname
Configure a stable DNS hostname and use that name in client profiles. A hostname is easier to migrate than a hard-coded address and is required for a normal trusted certificate. Verify the record from an external network, not only from the server itself; internal split-horizon DNS can hide a public-resolution error.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Replace the initial certificate
The first login uses a self-signed certificate so the service can be configured immediately. For production, install a valid certificate signed by a trusted certificate authority and ensure the name on the certificate matches the hostname users enter. Renew it before expiry and test renewal while an administrator is available.
Permit the required traffic at every boundary
Access Server manages its own firewall rules and networking behavior, but packets can still be blocked elsewhere. Check each layer in order:
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
- The client is resolving the intended public hostname.
- The cloud security group or provider firewall allows the required web and VPN traffic.
- The upstream router forwards traffic to the server when NAT is in use.
- The host firewall permits the service.
- Access Server is listening on the expected interfaces and ports.
TCP 943 is the default web-service port. TCP 443 may redirect browser requests to the web interface. VPN tunnel transports and any protocol-specific ports must match the settings shown in the Admin Web UI and the rules you publish; do not assume that opening a web port alone is sufficient for a client tunnel.
RHEL-family security controls
On Red Hat Enterprise Linux systems, SELinux and firewalld can interfere with Access Server. If the installer reports a conflict, investigate the policy or firewall state and resolve it using your organization’s security process rather than disabling controls blindly. Re-test both the Admin Web UI and a real client tunnel after every change.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesConfigure authentication and user accounts
Select an identity source
Access Server supports local authentication, PAM, RADIUS, LDAP, and SAML. It can use multiple authentication systems at the same time, so the choice should follow your existing identity lifecycle and MFA requirements.
| Method | Best fit | Important setup question |
|---|---|---|
| Local authentication | Small teams, labs, or isolated environments | Who owns password resets, offboarding, and account reviews? |
| PAM | Organizations already authenticating Linux services through the host | Does the host’s PAM policy provide the required controls and availability? |
| RADIUS | Centralized network-access authentication | Are the RADIUS endpoints reachable and redundant from the VPN server? |
| LDAP | Directory-backed user and group management | Which directory groups should receive VPN permissions? |
| SAML | Identity-provider-based browser authentication | Are the provider metadata, redirect addresses, and certificate rotations maintained? |
Enable MFA for administrator and user accounts. Time-based one-time passwords require the server clock to remain accurate, which is why time synchronization belongs in the installation checklist rather than as a later enhancement.
Create a named test user
- Open User Management in the Admin Web UI.
- Choose User Permissions and add a named test account, or assign the account to the configured directory identity.
- Set the password or directory attributes required by the selected authentication method.
- Grant only the groups, private networks, and routing options needed for the test.
- Select Save Settings, then Update Running Servers so the active processes receive the configuration.
Use a real test account rather than the administrator account. This separates user-policy errors from administrative-policy errors and gives you a safe credential to revoke after validation.
Connect the first device
Download a client profile
- Open the Client Web UI at the server address without the
/adminpath. - Sign in as the test user.
- Download OpenVPN Connect, the official Access Server client, or download the connection profile offered by the portal.
- Install OpenVPN Connect on the test device and import the profile.
- Authenticate with the test user’s credentials and complete MFA if enabled.
Use a device on a network different from the server’s LAN for the first test. A phone hotspot or another external connection exposes public DNS, NAT, and firewall mistakes that an internal test can conceal.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Verify the tunnel rather than stopping at “connected”
- Confirm that the client receives an address from the configured VPN pool.
- Open an internal application or host that the user’s permissions should allow.
- Test a private destination that should be blocked and verify that it remains unreachable.
- For full tunnel, check an external public-IP service and confirm that the visible address changes to the VPN gateway’s egress address.
- For split tunnel, confirm that ordinary internet traffic still uses the local connection while selected private routes use the VPN.
- Disconnect and reconnect to verify that authentication, route assignment, and MFA work repeatedly.
If the tunnel establishes but an internal application fails, inspect the destination’s return route, overlapping subnets, internal firewall rules, and the CIDRs published by Access Server. If the Client Web UI is unreachable, troubleshoot DNS, TCP 943 or 443 access, NAT forwarding, and cloud security-group rules before changing user permissions.
Understand licensing and connection capacity
Two simultaneous connections without activation
An unlicensed Access Server installation permits two simultaneous VPN connections. This is enough for a lab, a migration test, or a two-device proof of concept, but it is not a general-purpose production allowance. The limit is concurrent connections, not a promise of two permanently assigned users.
Activate additional connections
- Obtain an activation key through the Access Server portal for the required connection count.
- Open the Admin Web UI and locate the licensing or activation section.
- Enter the key and apply the change.
- Connect representative users and verify that the licensed limit is reflected in the running service.
Plan licensing together with identity and device policy. A single employee may use multiple simultaneous devices, and service accounts or always-on gateways consume connections just like interactive users.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not plan from a universal benchmark
No authoritative figure establishes a universal concurrent-user count, throughput rate, or CPU and memory requirement for every Access Server deployment. Encryption workload, bandwidth, full- versus split-tunnel routing, authentication backend latency, packet size, host hardware, and cloud egress all change the result. Start with the smallest supported host that meets your measured workload, monitor it under realistic concurrency, and leave headroom for peak use and maintenance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Production hardening checklist
Secure administration
- Replace the self-signed certificate with a trusted certificate for the public hostname.
- Enable MFA for administrators and users.
- Create named administrator accounts and avoid using the default
openvpnaccount for daily work. - Restrict root access, use strong SSH or console controls, and keep the operating system patched.
- Limit administrative web access through network policy where practical.
Validate routing and exposure
- Reconfirm DNS, NAT, cloud security-group rules, host firewall behavior, and the selected VPN subnet.
- Review every private CIDR published to clients and remove routes that are not required.
- Test one user in each intended routing mode and each authentication path.
- Check that internal systems have a return route or the required NAT for the VPN client network.
Operate and recover deliberately
- Monitor connection and authentication logs for rejected logins, unexpected source addresses, and repeated reconnects.
- Back up the Access Server configuration and document how to restore it on a replacement host.
- Keep a rollback plan for routing, certificate, authentication, and firewall changes.
- Schedule certificate renewal and operating-system maintenance before they become outages.
- Re-test a client after every major upgrade or network change.
Choose a deployment platform
The supported target is less important than your ability to control its network path and recover it. Compare each option on official support status, public-IP and NAT control, CPU and memory headroom, bandwidth, firewall interactions, identity integration, backup and recovery, and total cost including cloud egress and licensing.
| Deployment option | When it fits | Questions to answer before production |
|---|---|---|
| Ubuntu LTS server | Fastest documented path for many new installations | Can you reserve a public address, patch the host, and back up its configuration? |
| Debian 12 or 13 | Teams standardized on Debian | Do your operational tools and firewall policies support the selected release? |
| RHEL 8, 9, or 10 | Organizations requiring the RHEL platform | How will you handle SELinux and firewalld interactions? |
| Cloud host | Rapid provisioning and geographically flexible public access | What are the security-group, NAT, bandwidth, egress, backup, and recovery costs? |
| Virtual machine | Existing virtualization and snapshot infrastructure | Does the virtual network expose the required address and preserve adequate CPU and bandwidth? |
| Docker | Container-oriented operations | Can you provide persistent configuration, required network privileges, and a reliable upgrade path? |
| Raspberry Pi | Small lab or limited physical deployment | Will storage reliability, upstream bandwidth, power, and workload size remain acceptable? |
A small physical device can be useful for a lab, but support as a deployment target does not imply suitability for every production workload. Test throughput, concurrent sessions, and recovery time against your own requirements.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Troubleshoot the most common setup failures
The Admin Web UI does not open
Confirm that the hostname resolves to the expected public address, TCP 943 or the configured web port is allowed by the cloud firewall and host firewall, and NAT forwards to the correct private address. If the installer printed a different endpoint, use that exact address. A browser certificate warning during the first login is expected; a timeout is a network-path problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The client portal opens but the VPN cannot connect
Check that the VPN transport selected in Access Server is allowed through every firewall and security group, not only the web port. Verify that the profile contains the current hostname and that the server clock is correct. Review connection logs for authentication, certificate, and transport errors.
The client connects but cannot reach a private server
Look for overlapping client and server subnets, confirm that the destination CIDR is published, and verify a return route or NAT from the private network back to the VPN pool. Also check the destination host firewall and the test user’s permissions.
Full tunnel works but internet access is slow or unavailable
Full tunnel sends ordinary internet traffic through the Access Server, so inspect server egress bandwidth, cloud or upstream NAT, DNS behavior, and firewall policy. Compare with split-tunnel behavior to isolate whether the problem affects only internet egress or also private-resource routing.
Users receive one-time-password errors
Check the server’s clock and time zone first. Time drift can invalidate time-based one-time passwords even when usernames and passwords are correct. After correcting time synchronization, retry authentication and confirm that the user’s MFA enrollment matches the selected identity system.
Recommended Free Tools
When the deployment is ready
Consider the installation complete only after an external test device can authenticate, receive the intended routes, reach an allowed private resource, fail to reach a disallowed resource, and show the expected public-IP behavior for the selected tunnel mode. Then replace temporary credentials and certificates, activate the required connection capacity, document the network and identity dependencies, and schedule ongoing patching, log review, backups, and recovery tests.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
