Skip to content
OpenVPN Community Server product logo
  • AWSAvailable on Amazon Web Services
  • AzureAvailable on Microsoft Azure
  • GCP· nextGoogle Cloud is next on the roadmap
Available

OpenVPN Community Server

OpenVPN 2.7.8 community server with a web admin for creating, downloading and revoking client profiles, Easy-RSA 3.2.7 for the certificates and Webmin for the host. Full-tunnel routing, NAT and DNS are already configured, there is no per-user licence or connection cap, and every server generates its own certificate authority on first boot.

Version
v2.7.8
Operating system
Ubuntu 24.04 LTS
Architecture
x86_64
Support
Community

What's installed

Every package and version on the image, identical on every cloud it ships on. Nothing else is installed.

  • OpenVPN 2.7.8 (community edition)
  • Easy-RSA 3.2.7
  • ProvenCloud VPN Admin 1.0
  • nginx 1.24.0
  • Webmin 2.670
  • Certbot (for an optional Let's Encrypt certificate)

LicensingOpen source (OpenVPN and Easy-RSA GPL-2.0), no licence key or per-user fee

Deploy anywhere

OpenVPN Community Server on AWS and Azure.

Google Cloud is next on the roadmap. One clean-room build, one first-boot credential model, one patch cadence — identical on every cloud you run. Every identifier below is the real one; copy it and launch.

  1. AWS
    Available

    Amazon Web Services

    AMI · v2.7.8

    AWS AMI ID

    Shown for your region on the AWS Marketplace launch page once you subscribe.

    Released
    Root volume
    gp3 · 20 GiB
    Instance types
    • t3a.small
    • t3a.medium
    • t3.medium
    • c6a.large
    Regions
    • us-east-1
    Launch on AWS MarketplaceAWS launch steps

    5-day free trial, then from $0.03/hr software charge (larger instance sizes cost more) plus your own EC2 costs, billed by AWS.

    Subscriptions are open to AWS India (AISPL) accounts. Outside India? Ask us for a private build.

  2. Azure
    Available

    Microsoft Azure

    Compute Gallery image · v2.7.7

    Azure Compute Gallery image ID

    Selected for you when you create the VM from the Azure Marketplace listing.

    Released
    OS disk
    Premium_LRS · 30 GiB
    VM sizes
    • Standard_D2as_v7
    • Standard_D2as_v5
    • Standard_B2ms
    • Standard_D4as_v7
    Regions50 regions· show all
    • eastus
    • australiacentral
    • australiaeast
    • australiasoutheast
    • austriaeast
    • belgiumcentral
    • brazilsouth
    • canadacentral
    • canadaeast
    • centralindia
    • centralus
    • chilecentral
    • denmarkeast
    • eastasia
    • eastus2
    • francecentral
    • germanywestcentral
    • indiasouthcentral
    • indonesiacentral
    • israelcentral
    • italynorth
    • japaneast
    • japanwest
    • jioindiawest
    • koreacentral
    • koreasouth
    • malaysiawest
    • mexicocentral
    • newzealandnorth
    • northcentralus
    • northeurope
    • norwayeast
    • polandcentral
    • qatarcentral
    • southafricanorth
    • southcentralus
    • southeastasia
    • southindia
    • spaincentral
    • swedencentral
    • switzerlandnorth
    • uaenorth
    • uksouth
    • ukwest
    • westcentralus
    • westeurope
    • westindia
    • westus
    • westus2
    • westus3
    Launch on Azure MarketplaceAzure launch steps
AWS

Getting started on Amazon Web Services

From launch to signed in, step by step.

  1. Subscribe on AWS Marketplace and launch in your region with UDP 1194 and TCP 22, 80, 443 and 8000 open; wait two to three minutes. Port 1194 must be UDP, or the admin page works while every VPN connection times out.

  2. Open https://<instance-public-ip>/ and accept the browser warning for the server's own certificate. Sign in with username admin and your EC2 Instance ID as the password (for example i-0123456789abcdef0).

  3. Click Create client, name the device, then Download .ovpn and import it into any OpenVPN-compatible app. Use one client per device; Revoke cuts that device off immediately.

  4. Profiles connect to the instance's public IP, so attach an Elastic IP or set a DNS name under Settings. For a trusted certificate run sudo bash /home/ubuntu/iscripts/vpn-https.sh <domain> <email>.

  5. Webmin: port 8000, username admin, same password. SSH as ubuntu; manage clients there with sudo bash /home/ubuntu/iscripts/vpn-client.sh.

Security posture

What this AWS image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image: every component comes from its own official repository or release, and nothing is copied from any third-party image.

  • Every server generates its own certificate authority, server certificate, tls-crypt key and admin HTTPS certificate on first boot; none of them ships in the image, and the build's copies were deleted and searched for before capture.

  • Certificates are EC P-384, the control channel needs TLS 1.2 or newer (1.3 negotiated in testing) and is wrapped in tls-crypt, and the data channel uses AES-256-GCM or ChaCha20-Poly1305.

  • Revoking a client updates the revocation list and pushes a halt to its live session; a reconnect with the revoked profile is refused.

  • The revocation list is valid for ten years and renewed at boot, so the server never locks every client out when a short default list expires.

  • The admin page is HTTPS only, with a CSRF token on every form, Secure and SameSite cookies, a 15-minute lockout after five failed sign-ins, rate-limited sign-in attempts and a strict Content-Security-Policy.

  • The web process runs unprivileged and reaches the certificate authority only through a fixed list of commands.

  • Passwords are set from EC2 instance metadata (IMDSv2) at first boot, SSH is key-only, and build keys, history and logs were removed before imaging.

  • Verified on a fresh instance with a real client: full-tunnel traffic, revocation, reboot and a stop/start that changed the IP.

Azure

Getting started on Microsoft Azure

From launch to signed in, step by step.

  1. Create the VM from the Azure Marketplace listing with UDP 1194 and TCP 22, 80, 443 and 8000 open in your network security group. Choose ubuntu as the administrator username so SSH and the script paths match. Wait about two minutes.

  2. Open https://<vm-public-ip>/, accept the browser warning for the VM's own certificate, and sign in with username admin.

  3. Click Create client, name the device, then Download .ovpn and import it into any OpenVPN-compatible app. Revoke cuts a device off immediately.

  4. Webmin: port 8000, username admin. SSH as ubuntu; manage clients with sudo bash ~/iscripts/vpn-client.sh.

  5. The password is your VM ID: in the Azure portal open the virtual machine, choose Properties and copy VM ID - a 36-character value such as 02aab8a4-74ef-476e-8182-f6d2ba4166a6, typed exactly as shown in lower case.

Security posture

What this Azure image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image from the Azure Marketplace.

  • Every server generates its own certificate authority, server certificate, tls-crypt key and admin HTTPS certificate on first boot; none of them ships in the image, and the build's copies were deleted and searched for before capture.

  • Certificates are EC P-384, the control channel needs TLS 1.2 or newer (1.3 negotiated in testing) and is wrapped in tls-crypt, and the data channel uses AES-256-GCM or ChaCha20-Poly1305.

  • Revoking a client updates the revocation list and pushes a halt to its live session; a reconnect with the revoked profile is refused.

  • The revocation list is valid for ten years and renewed at boot, so the server never locks every client out when a short default list expires.

  • The admin page is HTTPS only, with a CSRF token on every form, Secure and SameSite cookies, a 15-minute lockout after five failed sign-ins, rate-limited sign-in attempts and a strict Content-Security-Policy.

  • The web process runs unprivileged and reaches the certificate authority only through a fixed list of commands.

  • Passwords are set from the VM's own vmId read from Azure IMDS; the ubuntu account ships password-locked with an empty authorized_keys.

  • Microsoft's documented Linux certification checks: 13 passed, 0 failures, with VM extension provisioning confirmed and a real client tested end to end.