Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →To set up a self-hosted OpenVPN Access Server, install it as root on a supported, dedicated Linux host, give it a stable public hostname, complete the Admin Web UI wizard, choose full- or split-tunnel routing, configure authentication and users, and verify a connection with OpenVPN Connect. The unlicensed installation allows two simultaneous VPN connections; larger deployments require an activation key.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
This guide covers the decisions that determine whether the server is reachable and secure: operating-system support, DNS and certificates, firewall and NAT paths, VPN subnet selection, identity integration, first-client testing, licensing, and production hardening.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What a self-hosted Access Server does
OpenVPN describes Access Server as a full-featured, secure network-tunneling VPN server and a self-hosted business VPN solution. You operate the Linux host, its network path, its updates, and its backups instead of placing the VPN service entirely in a third-party managed environment.
A successful deployment gives authorized devices an encrypted tunnel to the server. Depending on the routing policy, the tunnel can carry only traffic to private networks or can carry the client’s general internet traffic as well. The server can use local accounts, operating-system authentication, RADIUS, LDAP, SAML, or more than one of these systems at the same time.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Choose the host before installing
Use a supported 64-bit operating system
Current officially supported 64-bit Linux releases are Ubuntu 22.04, 24.04, and 26.04 LTS; Debian 12 and 13; and Red Hat Enterprise Linux 8, 9, and 10. Ubuntu support is limited to LTS releases. Access Server also requires a compatible operating system with a non-static-compiled kernel.
The host should be dedicated to Access Server and should not run unrelated applications. A dedicated machine makes firewall behavior, upgrades, troubleshooting, and incident response substantially easier to reason about than a host carrying several unrelated services.
Select a deployment location
The installation documentation identifies Linux hosts, virtual machines, Docker, Raspberry Pi, and cloud environments as deployment targets. Named cloud environments include AWS, Azure, Google Cloud, DigitalOcean, Oracle Cloud, IBM Cloud, and Vultr.
Choose the location that gives you control of the public address, inbound security rules, routing, backups, and recovery process. A cloud instance is convenient when you need a reachable public address quickly. A VM can fit an existing data-center or lab. A Raspberry Pi can suit a small or test deployment, but its suitability depends on the number of users, encryption workload, bandwidth, and the rest of the network design; it should not be treated as a universal production sizing recommendation.
Prepare administrative access and time
You need root privileges (or an account that can obtain them) to install and configure Access Server. Update the host through the package-management process for its distribution before installation. Set the correct time zone and keep the system clock synchronized. Accurate time is needed for certificate management and for time-based one-time passwords used by multi-factor authentication.
Rank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
- Reserve a stable public address, or a stable NAT mapping to the host.
- Know which cloud security group, upstream firewall, NAT device, and host firewall govern inbound traffic.
- Plan a DNS name such as
vpn.example.combefore requesting a trusted certificate. - Record the private networks that remote users must reach and check them for overlap with the VPN subnet.
Install Access Server and open the Admin Web UI
Run the platform-specific installer
- Provision the supported 64-bit Linux host and obtain a root shell.
- Update the operating system, confirm the clock and time zone, and verify that the host has the network access needed to download the installation packages.
- Run the official Access Server installation method for the selected operating system. The installer is platform-specific; use the command and package path documented for that release rather than substituting a package intended for another distribution.
- Save the installer’s final output. It prints the Admin Web UI address, the Client Web UI address, and an initial
openvpnaccount with a generated password.
On Red Hat Enterprise Linux-family systems, SELinux and firewalld can interfere with Access Server. If the installer reports a conflict, investigate that policy or firewall interaction before proceeding; do not assume the VPN is functional merely because package installation completed.
Sign in for the first time
- Browse to
https://server-address:943/admin/, or to the exact Admin Web UI endpoint printed by the installer. - TCP 943 is the default web-service port. TCP 443 can redirect browser requests to the web interface when that behavior is enabled by the service.
- The first connection normally presents a self-signed-certificate warning. Accept it only for this initial administrative login and only after confirming that you reached the intended server address.
- Sign in with the generated
openvpnaccount and password from the installer output. - Accept the End User License Agreement and complete the onboarding wizard.
Replace the temporary web certificate and move daily administration to named administrator accounts before exposing the service to real users. The initial account is useful for bootstrapping; it should not remain your normal administrative identity.
Configure public addressing, DNS, certificates, and firewalls
Give clients a name that remains valid
Create a stable DNS hostname, for example vpn.example.com, that resolves to the public address reaching Access Server. The Ubuntu guidance recommends a valid DNS hostname and a valid signed SSL certificate. A hostname that changes when an instance is rebuilt will force clients to reconfigure and complicate certificate validation.
After DNS is in place, install a trusted certificate for the hostname in Access Server. The self-signed certificate is appropriate for the first login warning, not for a finished service used by a team.
Trace every firewall and NAT layer
Permit the web and VPN traffic required by your configuration through all of these layers:
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
- the cloud security group or provider firewall;
- the upstream router or NAT device, including a port-forward to the server’s private address;
- the host firewall; and
- any network ACL between the server and the private resources it must publish.
Access Server manages its own firewall rules and networking behavior, so changes made outside its interface can interact with its configuration. Test from a network outside the server’s local LAN, not only from a host on the same switch. The web interface’s TCP 943 default and optional TCP 443 redirect are documented; the VPN transport ports and protocols depend on the Access Server configuration you select, so verify the active settings before writing restrictive upstream rules.
Check for an overlapping VPN subnet
The documented default internal VPN subnet is 172.27.224.0/20. Change it before deployment if it overlaps an existing LAN, cloud VPC, site-to-site route, or a common client network. An overlap can make a client send traffic to its local network instead of through the tunnel, producing failures that look like authentication or firewall problems.
Complete the first-run network wizard
The onboarding wizard asks what traffic users should be able to reach. Choose deliberately rather than accepting a broad policy without checking the detected networks.
Internet access through the VPN
Enable this when clients should send ordinary internet traffic through Access Server. In a full-tunnel design, the client’s public IP normally changes while connected because internet traffic exits from the VPN server’s network.
Private-resource access
Enable this when users need selected internal applications, file shares, administration interfaces, or other private CIDRs. Confirm that the server can reach those networks and that return routes exist. If the private network has no route back to the VPN client subnet, configure an appropriate return route or NAT design.
Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
Both types of access
Select both only when policy and capacity justify carrying private traffic and general internet traffic through the same server. Review the CIDRs detected by the wizard before saving. Remove networks that should not be published and add the specific internal ranges users actually require.
Full tunnel versus split tunnel
| Design | Traffic carried in the VPN | Client internet address while connected | Typical reason to choose it |
|---|---|---|---|
| Full tunnel | Private traffic and ordinary internet traffic | Normally changes to the server’s public IP | Centralized egress, consistent filtering, or access policies that require all traffic to traverse the organization’s network |
| Split tunnel | Only selected private networks | Ordinary internet traffic remains on the local connection | Lower VPN bandwidth use and direct local internet access while still reaching internal resources |
Test the actual routes from a client. A policy label alone does not prove that the intended CIDRs, DNS paths, and return routes are working.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose authentication and create the first user
Match the identity source to the organization
Access Server supports local authentication, PAM, RADIUS, LDAP, and SAML. It can use multiple authentication systems at the same time. Local accounts are straightforward for a small installation. Directory-backed methods centralize lifecycle management when an organization already operates an identity service. RADIUS or SAML may fit an existing access-control or single-sign-on design.
Whichever source you choose, enable multi-factor authentication for administrator and user accounts where your identity system and Access Server configuration support it. Verify the time configuration first because time-based one-time passwords depend on accurate clocks.
Create a named test account
- Open User Management, then User Permissions.
- Add a named test user rather than sharing the initial administrator account.
- Set a local password or assign the directory identity required by the selected authentication system.
- Save the configuration.
- Use Save Settings, then Update Running Servers when the Admin Web UI presents those actions.
The support checklist also uses Configuration > Network Settings to verify the server’s public address. Check that value before testing a client, especially when the server sits behind NAT.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
Connect the first device
Download the client or profile
- Open the Client Web UI at the server address without the
/adminpath. - Sign in as the test user.
- Download OpenVPN Connect, the official client for Access Server, or download the connection profile offered by the portal.
- Install the client on the test device and import the profile if the portal provided one.
- Authenticate with the test account and establish the tunnel.
Verify the tunnel rather than only the connection icon
- For private-resource access, connect to a permitted internal address and confirm that the application responds.
- For a full tunnel, check that the public IP changes to the expected server-side address while the VPN is connected.
- For a split tunnel, confirm that the intended private networks use the tunnel while ordinary internet traffic continues to use the local connection.
- Disconnect and reconnect once to verify that the profile, credentials, and policy survive a normal session cycle.
If authentication succeeds but private applications fail, inspect the published CIDRs and return routes. If the tunnel never establishes, start with DNS resolution, the external firewall path, NAT forwarding, and the active VPN protocol settings before changing user permissions.
License the server and plan capacity
An unlicensed Access Server installation permits two simultaneous VPN connections. That is a concurrent-connection limit, not a promise of a particular number of named users or a performance level. To support more concurrent connections, obtain an activation key through the Access Server portal and activate it in the Admin Web UI.
No universal concurrent-user, throughput, CPU, or memory figure applies to every deployment. Capacity varies with encryption workload, bandwidth, routing mode, authentication method, private-network routing, and host hardware. Size the host from your expected concurrent sessions and traffic pattern, then monitor real usage rather than relying on a generic benchmark.
Production hardening checklist
- Replace the initial self-signed web certificate with a trusted certificate for the stable DNS hostname.
- Enable multi-factor authentication for administrator and user accounts.
- Create named administrator accounts and stop using the default
openvpnaccount for daily administration. - Secure root access, limit who can reach the Admin Web UI, and keep the operating system and Access Server patched.
- Confirm DNS, NAT, cloud security-group rules, host-firewall behavior, and the selected VPN subnet from an external test location.
- Test one user through every intended routing path: full tunnel, split tunnel, and each private-resource group you publish.
- Test each authentication path you intend to support, including MFA recovery procedures.
- Monitor connection and authentication logs so failed logins, unexpected source addresses, and tunnel errors are visible.
- Keep a tested backup or rollback plan for Access Server configuration and host recovery.
Deployment choices and trade-offs
| Deployment choice | What the documentation establishes | Questions to answer before production |
|---|---|---|
| Ubuntu LTS | Ubuntu 22.04, 24.04, and 26.04 LTS are officially supported; Ubuntu is described as the fastest path for most new deployments. | Can you keep the host dedicated, patched, publicly reachable, and backed up? |
| Debian | Debian 12 and 13 are officially supported. | Do your administrators have the required package, firewall, and recovery procedures for Debian? |
| Red Hat Enterprise Linux | RHEL 8, 9, and 10 are officially supported. | Have you resolved any SELinux or firewalld interaction reported during installation? |
| Virtual machine | Listed as a deployment target. | Do the hypervisor, upstream firewall, public-address path, snapshots, and restore process meet your recovery requirements? |
| Docker | Listed as a deployment target. | Can you provide persistent configuration, correct networking, controlled upgrades, and a reliable backup path? |
| Raspberry Pi | Listed as a deployment target. | Is the expected concurrency and bandwidth appropriate for the device and its network connection? |
| Cloud host | AWS, Azure, Google Cloud, DigitalOcean, Oracle Cloud, IBM Cloud, and Vultr are named deployment environments. | What are the provider’s public-IP, security-group, bandwidth, egress-cost, backup, and recovery characteristics? |
The supported-environment list does not provide a single performance benchmark. Compare options by official support status, public-IP and NAT control, CPU and memory headroom, storage and bandwidth, firewall interaction, identity integration, backup and recovery, and total operating cost including cloud egress and Access Server licensing.
Troubleshoot the first deployment
The Admin Web UI does not load
- Confirm that the address resolves to the expected public IP.
- Check the cloud security group, upstream NAT, and host firewall for the web-service ports.
- Try the installer-provided endpoint and verify that you included
/admin/. - If the host uses RHEL-family controls, review SELinux and firewalld messages for interference.
The browser warns about the certificate
The warning is expected for the initial self-signed certificate. Confirm the hostname and server identity, complete the bootstrap login, and replace the certificate with a trusted one before inviting users.
Recommended Free Tools
The user can authenticate but cannot reach a private service
- Verify that the service’s CIDR is included in the published private-resource routes.
- Check for overlap with the client’s local network or the default
172.27.224.0/20VPN subnet. - Confirm a return route or NAT path from the private network back to VPN clients.
- Check the private service’s own firewall and listening address.
The public IP does not change
That behavior is expected for split tunneling. If the design is intended to be full tunnel, review the onboarding routing choice, the active client profile, and whether the server can forward internet traffic through its upstream network.
MFA codes fail intermittently
Check the server clock, time zone, and synchronization. Time-based one-time passwords are sensitive to clock drift, and incorrect time also complicates certificate management.
When the server is ready
Move from a single test account to named users or your selected directory integration only after the external connection, route scope, certificate, and authentication path have passed testing. Document the public hostname, published CIDRs, VPN subnet, firewall and NAT rules, administrator accounts, activation status, backup location, and rollback procedure. That record turns a working first connection into an operable self-hosted VPN service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
