OpenVPN Access Server System Administrator Guide

1 Introduction
The OpenVPN Access Server consists of a set of installation and configuration tools which allow
for simple and rapid deployment of VPN remote access solutions using the OpenVPN open source
project. The Access Server software builds upon the usability and popularity of OpenVPN, while
easing VPN configuration and deployment by providing the following features:
1. Simplified server configuration
Access Server presents the administrator with only the most useful of the many
configuration options supported by the sophisticated OpenVPN server and clients. An
easy-to-use, Web-based configuration interface makes setting up and maintaining the
Access Server deployment straight-forward and efficient.
2. Support for external user authentication database
Rather than requiring you to create and manage credentials for each valid VPN user,
OpenVPN Access Server offers the ability to integrate with existing user authentication
systems using one of the following:
1. PAM 1 : the system for authenticating user accounts on the Unix server
2. an external LDAP or Active Directory server
3. one or more external RADIUS servers
3. Easy intuitive Web-Based client access
Once a user fires up a Web browser they can then enter their credentials and connect to the
VPN. In addition a user can download a pre-configured Windows installer for their
Windows Operating System. Since the installer file was dynamically generated specifically
for the user in question, that user can instantly connect to the VPN without need for
additional client-side configuration.
4. Compatibility with a large base of OpenVPN clients
An authenticated user can also download an OpenVPN client configuration file (also
generated specifically for the user) from the Connect Client and use it with an OpenVPN
v2.1+ client other than the Windows GUI client. In this way, OpenVPN Access Server is
immediately compatible with OpenVPN clients running on non-Windows platforms, such
as the Tunnelblick client on MacOSX and the Community Projects OpenVPN client on
Unix/Linux.
Of course, none of these benefits would matter without the robust security of client-server
communication provided by OpenVPN‟s use of SSL/TLS.
1.1 Access Server Deployment Topology
An OpenVPN Access Server deployment consists of one server, many clients and many users, as
depicted in Figure 1. Each client machine in this topology uses the public IP network (the Internet)
to communicate with the OpenVPN Access Server and thereby gains VPN-protected access to the
private IP Network connected (if present).
1 PAM stands for “Pluggable Authentication Modules,” the common system for authenticating
users on a Unix system.
OpenVPN Access Server System Administrator Guide
2