Skip to content
OpenVPN Community Server with Web Admin product logo
  • AWS· soonComing soon on Amazon Web Services
  • Azure· soonComing soon on Microsoft Azure
  • GCP· nextGoogle Cloud is next on the roadmap
Coming soon

OpenVPN Community Server with Web Admin

OpenVPN 2.7.7 community server with a web admin for creating, downloading and revoking client profiles, Easy-RSA 3.2.7 for the certificates and Webmin for the host. Full-tunnel routing, NAT and DNS are already configured, there is no per-user licence or connection cap, and every server generates its own certificate authority on first boot.

Version
v2.7.7
Operating system
Ubuntu 24.04 LTS
Architecture
x86_64
Support
Community

What's installed

Every package and version on the image, identical on every cloud it ships on. Nothing else is installed.

  • OpenVPN 2.7.7 (community edition)
  • Easy-RSA 3.2.7
  • ProvenCloud VPN Admin 1.0
  • nginx 1.24.0
  • Webmin 2.670
  • Certbot (for an optional Let's Encrypt certificate)

LicensingOpen source (OpenVPN and Easy-RSA GPL-2.0), no licence key or per-user fee

Deploy anywhere

OpenVPN Community Server with Web Admin on AWS and Azure.

Google Cloud is next on the roadmap. One clean-room build, one first-boot credential model, one patch cadence — identical on every cloud you run. Every identifier below is the real one; copy it and launch.

  1. AWS
    Coming soon

    Amazon Web Services

    AMI · v2.7.7

    AWS AMI ID
    ami-0448214981788179c
    Released
    Root volume
    gp3 · 20 GiB
    Instance types
    • t3a.medium
    • t3.medium
    • t3a.small
    • c6a.large
    Regions
    • us-east-1
    AWS launch steps
  2. Azure
    Coming soon

    Microsoft Azure

    Compute Gallery image · v2.7.7

    Azure Compute Gallery image ID
    …/galleries/provencloud/images/openvpn/versions/2026.10.1
    Released
    OS disk
    Premium_LRS · 30 GiB
    Gallery
    provencloud
    Definition
    openvpn
    Resource group
    provencloud-images-rg
    VM sizes
    • Standard_D2as_v7
    • Standard_D2as_v5
    • Standard_B2ms
    • Standard_D4as_v7
    Regions
    • eastus
    Azure launch steps
AWS

Getting started on Amazon Web Services

From launch to signed in, step by step.

  1. Launch in us-east-1 with UDP 1194 and TCP 22, 80, 443 and 8000 open; wait two to three minutes. Port 1194 must be UDP, or the admin page works while every VPN connection times out.

  2. Open https://<instance-public-ip>/ and accept the browser warning for the server's own certificate. Sign in with username admin and your EC2 Instance ID as the password (for example i-0123456789abcdef0).

  3. Click Create client, name the device, then Download .ovpn and import it into any OpenVPN-compatible app. Use one client per device; Revoke cuts that device off immediately.

  4. Profiles connect to the instance's public IP, so attach an Elastic IP or set a DNS name under Settings. For a trusted certificate run sudo bash /home/ubuntu/iscripts/vpn-https.sh <domain> <email>.

  5. Webmin: port 8000, username admin, same password. SSH as ubuntu; manage clients there with sudo bash /home/ubuntu/iscripts/vpn-client.sh.

Security posture

What this AWS image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image: every component comes from its own official repository or release, and nothing is copied from any third-party image.

  • Every server generates its own certificate authority, server certificate, tls-crypt key and admin HTTPS certificate on first boot; none of them ships in the image, and the build's copies were deleted and searched for before capture.

  • Certificates are EC P-384, the control channel needs TLS 1.2 or newer (1.3 negotiated in testing) and is wrapped in tls-crypt, and the data channel uses AES-256-GCM or ChaCha20-Poly1305.

  • Revoking a client updates the revocation list and pushes a halt to its live session; a reconnect with the revoked profile is refused.

  • The revocation list is valid for ten years and renewed at boot, so the server never locks every client out when a short default list expires.

  • The admin page is HTTPS only, with a CSRF token on every form, Secure and SameSite cookies, a 15-minute lockout after five failed sign-ins, rate-limited sign-in attempts and a strict Content-Security-Policy.

  • The web process runs unprivileged and reaches the certificate authority only through a fixed list of commands.

  • Passwords are set from EC2 instance metadata (IMDSv2) at first boot, SSH is key-only, and build keys, history and logs were removed before imaging.

  • Verified on a fresh instance with a real client: full-tunnel traffic, revocation, reboot and a stop/start that changed the IP.

Azure

Getting started on Microsoft Azure

From launch to signed in, step by step.

  1. Deploy the gallery image in eastus with UDP 1194 and TCP 22, 80, 443 and 8000 open in your network security group. Choose ubuntu as the administrator username so SSH and the script paths match. Wait about two minutes.

  2. Open https://<vm-public-ip>/, accept the browser warning for the VM's own certificate, and sign in with username admin.

  3. Click Create client, name the device, then Download .ovpn and import it into any OpenVPN-compatible app. Revoke cuts a device off immediately.

  4. Webmin: port 8000, username admin. SSH as ubuntu; manage clients with sudo bash ~/iscripts/vpn-client.sh.

  5. The password is your VM ID: in the Azure portal open the virtual machine, choose Properties and copy VM ID - a 36-character value such as 02aab8a4-74ef-476e-8182-f6d2ba4166a6, typed exactly as shown in lower case.

Security posture

What this Azure image does and does not ship with, one fact per line.

  • Clean-room build on Canonical's official Ubuntu 24.04 LTS image from the Azure Marketplace.

  • Every server generates its own certificate authority, server certificate, tls-crypt key and admin HTTPS certificate on first boot; none of them ships in the image, and the build's copies were deleted and searched for before capture.

  • Certificates are EC P-384, the control channel needs TLS 1.2 or newer (1.3 negotiated in testing) and is wrapped in tls-crypt, and the data channel uses AES-256-GCM or ChaCha20-Poly1305.

  • Revoking a client updates the revocation list and pushes a halt to its live session; a reconnect with the revoked profile is refused.

  • The revocation list is valid for ten years and renewed at boot, so the server never locks every client out when a short default list expires.

  • The admin page is HTTPS only, with a CSRF token on every form, Secure and SameSite cookies, a 15-minute lockout after five failed sign-ins, rate-limited sign-in attempts and a strict Content-Security-Policy.

  • The web process runs unprivileged and reaches the certificate authority only through a fixed list of commands.

  • Passwords are set from the VM's own vmId read from Azure IMDS; the ubuntu account ships password-locked with an empty authorized_keys.

  • Microsoft's documented Linux certification checks: 13 passed, 0 failures, with VM extension provisioning confirmed and a real client tested end to end.