OpenVPN Access Server (10 Connected Devices) / Self-Hosted VPN & ZTNA

I have been in the media field for fourteen years, helping different global customers by streaming videos and utilizing secure environments. We have been using OpenVPN Access Server for around nine years now.

Initially, we were using more traditional VPN solutions where we had to control the passwords carefully and be very cautious about whom to share those credentials with. Then we came across OpenVPN Access Server, which provides a self-hosted version for organizations, allowing us to avoid directly exposing internal applications to the Internet and instead offers a more secure channel between them. Our engineers work on laptops and used VPNs to connect to the Internet and the company network, which exposed internal applications. Instead, OpenVPN Access Server provides a controlled environment where engineers and vendors globally can access applications securely. With MFA implementation, it is very secure, using SSOs and encrypted secure tunnels, ensuring that if someone attempts to reach internal applications, everything is handled properly without compromising security, as access is granted only after extensive validation, verification, and authentication.

It saves our environment and makes work easier by allowing LDAP integration for authentication where group members easily gain access to platforms necessary for their work. In our organization, we work on various infrastructures such as production Kubernetes clusters, AWS VPCs, internal Grafanas, and Kibanas, alongside ServiceNow integrations and multiple customer environments with thousands of SSH servers and various monitoring platforms and APIs. Having everything exposed to the Internet would pose a significant threat. Therefore, OpenVPN Access Server acts as a middle layer between our environments and the Internet, allowing access to applications only based on defined roles and granular rules tailored to the users' needs. For instance, our SREs can make changes on YAML and JSON files, while SROs can only read without making changes, ensuring secure access levels based on expertise. Vendors are granted access for their specific needs as well, making our work environment well-managed and organized.

Recently, while working on the Olympics, there was a requirement involving two sets of customers; one was using OpenVPN Access Server, and the other was utilizing Cisco Secure. We were working with different tools for monitoring and needed to provide access through secure means to prevent data exposure. If security is compromised in any server, it can lead to threats and data breaches, so all data passing through environments must be monitored effectively by a specific set of individuals. When something goes wrong, those tasked with handling it must ensure that they investigate, troubleshoot, and fix any issues. Our team had three SREs working during this period, equipped to resolve high-severity events. The customer was simultaneously granted access to monitor data flows on their platform while management required detailed oversight on the services, encryption tests, and necessary adjustments. The environments were suitably hosted on Kubernetes in the cloud, and every team coordinated seamlessly without compromising security, resulting in smooth operations.

OpenVPN Access Server offers features such as local authentications, compatibility with LDAP, Redis, SAML, TOTP MFAs, and multi-factor authentication, which are great for security. It also supports SSO, which allows for easier management of user access without maintaining separate directories. Administrative tasks are straightforward, featuring a simple GUI that permits management of users, groups, authentication, VPN settings, and access policies effectively. This ease of management makes it a user-friendly tool for our needs.

A standout feature is its compatibility with multiple operating systems used by our media-focused company. OpenVPN Access Server works incredibly well with platforms such as Windows, macOS, Linux, Android, and iOS, ensuring comprehensive client support across our diverse operations.

OpenVPN Access Server saves us time compared to earlier VPNs where managing credentials had its challenges. We used to distribute VPN credentials, which required maintaining records and introduced security risks if anyone learned those passwords. Post-adoption of OpenVPN Access Server, it has positively structured roles based on tasks, troubleshooting, and support. Previously, one team handled user account management and password renewal, which was often tedious and prone to errors, complicating access for those in need. OpenVPN Access Server allows easy additions into LDAPS for secure access without complications, making work easier for everyone.

There are definitely areas for improvement. A broader network level access faces challenges, and the clustering configuration seems insufficient, posing a single point of failure. Moreover, patch management and monitoring are our ongoing responsibilities, which OpenVPN Access Server should consider addressing.

I would rate OpenVPN Access Server around a seven. While it is effective, there are instances where infected devices or incorrect configurations can create problems. The VPN struggles under these circumstances, and latency issues need attention, leading to slower performance.

The rating of seven reflects significant areas needing improvement such as latency, management issues, and vulnerabilities such as single points of failure. Managing certificates falls on us; any issues within the certificate or related layers can lead to complications that require extensive debugging, consuming valuable resources. Furthermore, the licensing cost is not user-oriented but based on the number of established connections, leading to elevated expenses.

Security is satisfactory; however, the challenge lies with infected devices. The channels are well-secured, and periodic upgrades enhance its defenses further. The primary focus should be on configuring our VPNs properly for optimal security.

The accuracy and reliability of OpenVPN Access Server's outputs are decent, albeit requiring improvements. I would appreciate a reduction in resource consumption, especially given the high costs associated with the infrastructure's current resource demands, particularly with OpenVPN Access Server's AI capabilities still in their developmental phase.

The connection speed utilizing OpenVPN Access Server is notably slow, with high latency affecting performance.

We have been using OpenVPN Access Server for around nine years now.

OpenVPN Access Server remains stable and scalable. I deem it quite flexible, bolstered by quality customer support.

Scalability is efficient, allowing multiple concurrent connections easily. The customer support provided is commendable and always responsive when needed, ensuring we receive timely assistance.

I would rate customer support as a solid nine out of ten due to the support and onboarding interactions we have experienced.

Previously, we utilized a different solution which failed to deliver adequate control over applications and posed firewall limitations; it was not well-aligned with our primary needs. Transitioning to OpenVPN Access Server was initiated due to better performance outcomes and enhanced management capabilities.

The installation and setup of OpenVPN Access Server is quite easy and efficient. The process involves a straightforward setup folder; clicking through within a minute can establish a working environment, facilitating quick onboarding for users.

Certain applications are effectively managed within OpenVPN Access Server. We have obtained device management capabilities seamlessly, simplifying user access across various devices. The centralized administrative mode enhances user group management and client provisioning, making it straightforward to operate.

Regarding return on investment, we are saving time by managing users and groups more efficiently since adopting OpenVPN Access Server. We have transitioned to using licenses effectively within departments and trimmed down the number of licenses required. This change allows us to keep security tight without overwhelming workloads for administrative teams, thereby saving time. Financially, we observe that while costs were initially high, optimizing user connections has rendered better financial management in the long run, improving user access without extensive management needs.

The pricing and setup costs for OpenVPN Access Server are on the high side since licenses are not user-dependent but based on the number of connections established. With two free simultaneous connections, the paid license hinges on concurrent active users, causing overhead for large enterprises due to the extensive number of simultaneous connections typically needed.

Before choosing OpenVPN Access Server, we evaluated others such as Wireguard and IPSec, but OpenVPN Access Server prevailed at that moment due to its superior control and simple self-hosting solutions.

There is a need for improvements, especially considering alternative solutions such as ZITNA, which offer dedicated application-level approaches. Moreover, considering Wireguard could provide simpler side-to-side tunneling, which has been discussed internally as a potential alternative.

For those looking into OpenVPN Access Server, I recommend it for its strong security, user-friendly access management, and operational scale. If you operate remotely or require easy scalability across multiple platforms, OpenVPN Access Server is a robust solution despite its latency concerns and slightly higher costs, making it a great asset for your organizational needs.

OpenVPN Access Server is deployed on AWS, providing a public cloud environment for our organizational needs. We utilize AWS, which stands for Amazon Web Services. We purchased OpenVPN Access Server through the AWS Marketplace.

Despite rising user levels causing potential complications, OpenVPN Access Server's effectiveness stands out. Our team, consisting of eighty people, finds that managing usernames and passwords becomes manageable with the help of LDAP, ensuring access aligns with specific roles and skill sets.

The user interface of OpenVPN Access Server is simple and intuitive. It provides diverse options, displaying the server version, name, license status, and active users. The current active user count and options for authentication are readily visible, along with configuration details, making it user-friendly and efficient for quick management.

I would rate this product overall a seven out of ten.