OpenVPN Access Server (BYOL) / Self-Hosted VPN & ZTNA

OpenVPN Access Server was primarily used to secure a fixed IP address, as some of my customers needed to access resources remotely. A concrete example is that a client of my client had restricted access so that they would only accept connections from specific IP addresses. When my client delivered work to that end client, they had to go through OpenVPN Access Server; in other words, we used it as a proxy.

In addition to the cloud, the client's company was using a NAS for internal sharing, so to access the NAS, they needed to go through OpenVPN Access Server.

One of the best features of OpenVPN Access Server is that its encryption is still more complex than L2TP, though it is weaker than WireGuard.

Regarding the strength of the encryption, one aspect is certificates; you absolutely need certificates, and on top of that, you also need a username and password, so the encryption strength is higher. However, the standard itself is a bit old now, and it is true that it has quite a few vulnerabilities.

The impact of OpenVPN Access Server for my company is really for my customers, but they have been able to provide their own customers with a safe remote environment and fixed IP addresses, which was the outcome.

OpenVPN Access Server could be improved in several areas. The encryption strength is inevitably lower compared with the latest technologies, and when I try to add features like two-factor authentication, the needed plugins and so on often are not really available or do not fit well. For my current customers and for myself, I try to have them use WireGuard instead.

I think the way forward is to move to WireGuard and to two-factor authentication. With OpenVPN, you use TCP, so attackers tend to target the port, which makes it pretty easy to figure out which port is being used. With WireGuard, which is locked down over UDP, it is harder for attackers to probe ports. For my current customers and my other customers, I am planning to migrate them to WireGuard.

I have been using OpenVPN Access Server at a customer site, and we operated it for about six years.

I would rate the stability of OpenVPN Access Server as unstable at first, but as we changed how we operated it, it rarely went down.

Scalability was available depending on configuration, and I did test it. However, for this customer, there were not enough users to really make use of that scalability, so we did not actually leverage it.

Customer support was basically via email only, but the person I dealt with was very technically knowledgeable. When I asked about SoftEther VPN, they gave very detailed answers.

In the past, I had both on-premises deployments and public cloud deployments for OpenVPN Access Server.

When I deployed SoftEther, it was very easy as I wrote my own script, and running that script was enough to get it up and running.

I used the open-source version of SoftEther VPN, so there were essentially no license costs regarding my experience with pricing, implementation costs, and licensing.

I did consider other options; for example, I looked at Tailscale, but it would have been very costly, so we decided not to adopt it.

I give OpenVPN Access Server an overall rating of seven out of ten because it supports certificate-based authentication. I give it that score because it lets you use certificates; if you do not have the certificate, you cannot access it, and that is the reason.

We are gradually shutting down our OpenVPN servers and switching to WireGuard for deploying OpenVPN Access Server in our organization.

I used RADIUS for authentication integration, but I stopped using it partway through. I would evaluate the effectiveness of RADIUS authentication as somewhat weak because the connection tends to drop fairly easily. Regarding some elements like usernames, it is not fully encrypted end-to-end, so that is a weakness and a concern, which is why I stopped using RADIUS.

Configuring ports took a bit of time when I was using both L2TP and OpenVPN. I used the access control features of OpenVPN Access Server, but because the customer's scale was small, we did not set very granular permissions.

As for SoftEther, I used SoftEther VPN, and it was relatively easy to understand, but I felt it could have had a few more configuration options. The connection speed was a bit slower compared with other VPN solutions because the headers become larger, so the speed inevitably drops somewhat. You also need to configure the MTU, so depending on the location, sometimes connections were easy, and sometimes they would not connect at all. When you tweak those settings, the speed can drop even further.

I did not purchase OpenVPN Access Server through AWS Marketplace; at that time, I installed the SoftEther application myself.

They should switch from OpenVPN to WireGuard. There are many areas where this interview could improve.

My main use case for OpenVPN Access Server is setting up security in a company where some private resources are not accessible, and some remote employees can use it as well.

A specific example of how I use OpenVPN Access Server for this purpose is that we gave OpenVPN Access Server access to every employee and put a firewall behind our database, which is only accessible by the VPN.

The best features OpenVPN Access Server offers are ease of setup, and it is just easy. The ease of setup helps my team day-to-day because you set it up once and then you forget about it.

OpenVPN Access Server has a significant positive impact on my organization for security, as it helps a lot.

I think OpenVPN Access Server's setup can be just one click; currently, it takes multiple steps, and when you forget the admin password, you are locked in.

I have been using OpenVPN Access Server for the last five years.

OpenVPN Access Server is stable, definitely.

I don't know how OpenVPN Access Server's scalability is; we only have one instance.

We haven't used customer support for OpenVPN Access Server.

We had another solution, but I cannot share which solution we used before switching to OpenVPN Access Server.

It is easy to install and set up OpenVPN Access Server within my organization, but it could be easier. You just need to set up the application itself, then configure it for your needs. After that, you configure the firewall and distribute it to all the team members, and you're done.

I am not the one who procured this product, as another team is handling it, so I cannot comment on pricing, setup cost, and licensing.

I have seen a return on investment, definitely for security, but I cannot share any metrics.

I am not the one who procured this product, as another team is handling it, so I cannot comment on pricing, setup cost, and licensing.

I did not evaluate other options before choosing OpenVPN Access Server.

My advice to others looking into using OpenVPN Access Server is to just try it. If you don't like it, you don't like it.

I don't know if I am using local, LDAP, RADIUS, PAM, or SAML authentication integration with OpenVPN Access Server.

I don't know if we have utilized the Access Controls feature of OpenVPN Access Server; another team is handling that.

I would describe the user interface of OpenVPN Access Server as not modern, but it works. The user experience could be better with all the statistics and everything.

My impression of the connection speed when using OpenVPN Access Server compared to other VPN solutions is that it is solid compared to others.

My main use case for OpenVPN Access Server is that we have our VPN solution centered around this, and we use it for connecting to different VPNs, whether they be internal private subnets that we configured for specific environments. For accessing those, we specifically use OpenVPN Access Server for connecting to VPN, then accessing those boxes and other resources, so it basically provides remote access to private networks over the Internet.

A quick specific example of how my team uses OpenVPN Access Server in a day-to-day scenario is that we have a public IP, which is basically our OpenVPN Access Server, over the Internet. Via that, we connect to the VPN tunnel service through the UI agent they provide, and from there, users connect and have access to different private sub-networks, whether they be databases, servers, or Kubernetes clusters, all of which are behind the VPN. To access those, we connect via OpenVPN Access Server.

I extensively use OpenVPN Access Server for authentication of our backend services, where how it works is when the token generates, we always validate via the correct VPN route. The encryption engine is also very helpful, and as an SRE, I have set this up, so based on that information, I can say that we have used certain protocols to ensure smooth communication between the client and server. It was easier to set up; it is not that difficult, as we just have to provide proper IPs and addresses and proper permissions to use it.

I have utilized the access controls feature of OpenVPN Access Server, which effectively allows us to know who is currently connected, a valuable asset for database-related inquiries in our production environments. The user controls significantly aid in maintaining this oversight.

I have used role-defining features within OpenVPN Access Server, which creates a secure approach to enforcing least privilege effortlessly. Currently, we maintain around four roles: help desk, read-only auditors, administrators, and a VP of Engineering who serves as the super administrator. This setup minimizes the risk of unauthorized access or malpractices, allowing for easy group management whereby adding a new person to a group grants them access to all environments.

The best features OpenVPN Access Server offers include using a protocol called UDP over TCP, which gives comparatively lower latency and overall faster throughput. Once you are in a network, you will not see many bandwidth issues because it uses UDP for broadcasting or routing our request, making it better for streaming. The SSH access is also easier, requiring fewer configurations. The authentication methods are really good, allowing for local level authentication or LDAP, and we have also configured it with Okta for SSO login, providing a better edge as it allows users to log in without entering usernames and credentials each time.

OpenVPN Access Server has positively impacted our organization by moving from TLS 1.1 to TLS 1.3, which has significantly improved our security constraints. The performance metrics demonstrate that previously used solutions were not optimal; with OpenVPN Access Server, we experience much less latency, making it easier to deploy, and it works well with firewalls. OpenVPN Access Server supports various authentication methods, reducing the need for manual username and password entry each time users connect, thereby creating less friction for those managing the VPN, resulting in a good impact overall.

OpenVPN Access Server can be improved by addressing the issue we faced with a single VPN server since it does not allow the creation of replicas without a load balancer, which we found to be an availability issue that could be easily fixed. Additionally, the certificate management—renewal and issuance for new certificates—is currently manual, which creates some friction. While it is not overly complex, it requires a subject matter expert to manage effectively.

Regarding needed improvements, I think they are doing a good job overall. My main concern relates to user experience; there are common complaints about not being able to manually download a profile to access the VPN. Connections and setups can be a bit confusing on the UI, which some of my team members have reported. Currently, the portal is not self-service; it could benefit from a one-click configuration setup to make deployment and management easier since we are paying for these services.

I have been using OpenVPN Access Server for almost two years now in Cloud Bold.

OpenVPN Access Server is stable.

OpenVPN Access Server's scalability is good; I have not faced significant issues in that regard.

We previously used Palo Alto GlobalProtect, primarily for the frustration it caused due to its inability to close properly. I suggested a switch because OpenVPN Access Server provides better visibility and a cleaner interface that does not annoy users the way GlobalProtect did, which constantly notified users when disconnected and lacks a straightforward closure method.

The installation and setup of OpenVPN Access Server within my organization is straightforward as we need to open specific ports, namely 443 for TCP and 1194 for UDP. After opening these ports, we install the OpenVPN Access Server package in AWS, set the initial admin password, and usernames. The UI becomes accessible shortly thereafter, enabling us to manage other aspects.

We have seen a return on investment with OpenVPN Access Server, as the overall cost of management has decreased; one engineer can now handle what previously required more personnel, equating to a 66% reduction in engineering hours. Additionally, infrastructure costs have significantly dropped, thanks to the efficient SSO login process which minimizes user input. The integration with our existing services, such as Okta for MFA, has further enriched user experience while centralizing administration.

Regarding the accuracy and reliability of OpenVPN Access Server's output, I have not encountered any major issues aside from a singular incident where availability was compromised due to a deployment issue. The accuracy has consistently been good; we have no trouble connecting to the VPN or accessing servers.

My impression of the connection speed using OpenVPN Access Server is good; we switched due to previous performance issues with another vendor. OpenVPN Access Server has effectively managed enterprise-level workloads, with minimal resource consumption.

The advice I would give to others looking into using OpenVPN Access Server is that it is suitable for companies with fewer than 10,000 employees. It works as claimed and the setup is easier, though for very large organizations with extensive user numbers, the scalability might need validation. I would rate this solution a 7 out of 10.