For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

Access Server is a self-hosted business VPN and ZTNA software solution developed by the creators of the OpenVPN protocol. Deploy as a 1-Click Droplet and get secure access to your DigitalOcean VPCs and other connected networks. Route traffic by domain name for application-aware access control, and leverage Data Channel Offload (DCO) for kernel-accelerated throughput that keeps pace with demanding workloads. With MFA, granular access controls, SAML single sign-on with your existing identity provider, and Zero Trust–ready policies, Access Server is trusted by businesses to protect cloud infrastructure and beyond.

Once you’ve launched the 1-Click App, sign up from https://openvpn.net to retrieve your activation key for two free connections, or start a trial for higher capacity. The first time you open the Admin Web UI, a guided setup wizard walks you through initial configuration to get your VPN running quickly. Schedule a demo at https://go.openvpn.net/book-a-demo .

On DigitalOcean, Access Server runs in your own environment on a Droplet, giving your remote, hybrid, and in-office workforce protected access to VPCs, private networks, Managed Databases, Kubernetes clusters, and on-premises resources without surrendering control of your infrastructure to a third-party service.

Deployment Model:

• Self-hosted on a DigitalOcean Droplet within your own team and VPC, so data and configuration stay under your control.
• Deployed from a preconfigured DigitalOcean Marketplace 1-Click App in minutes.
• Managed through an intuitive web-based Admin Web UI, with REST API, and command-line configuration options available for advanced administration.
• Supports remote-access and site-to-site VPN topologies.

Typical Use Cases on DigitalOcean:

• Provide secure remote access to applications and data hosted in your DigitalOcean VPC
• Connect DigitalOcean environments with other clouds and on-premise networks.
• Reach Managed Databases, DigitalOcean Kubernetes clusters, and internal services privately, without exposing public endpoints.
• Protect SaaS and internal applications by making them reachable only through the VPN, reducing exposure to the public internet.
• Route internet-bound traffic through a trusted gateway with a fixed egress IP using a DigitalOcean Reserved IP, so approved SaaS applications can allow-list a single, stable address.
• Enforce zero-trust access policies based on identity, device, and location.
• Secure connectivity for devices, IoT, and machine-to-machine use cases.

Key Features:

Zero-Trust Access Controls

• Zero Trust Application Broker: Access Server verifies user identity, location, and device ID during connection and assigns, during domain lookup, a synthetic intermediate IP scoped to a single authorized app — the device never gets a route to the entire private network, so lateral movement isn’t merely limited; it’s structurally impossible.
• Define identity-based, role-driven access to specific applications by domain name or hostname, subnets, and private resources.
• Enforce device verification and location-aware post-authentication checks to reject connections from unauthorized endpoints.
• Use Access Control Lists to segment network access within your environment.

Flexible Authentication

• Supports local authentication and external authentication with PAM, RADIUS, LDAP, and SAML — including single sign-on with providers such as Okta, Microsoft Entra ID, and Google Workspace
• Supports a custom Python3 authentication module for environments with non-standard identity requirements.
• Includes built-in multi-factor authentication using TOTP.
• Allows you to specify different authentication methods per user or group.
• Includes built-in X.509 PKI and support for external PKI.

High-Performance Connectivity

• Supports OpenVPN Data Channel Offload (DCO) to move encryption and decryption into the OS kernel for improved VPN data-plane performance and reduced processing overhead.
• Supports multi-threaded operation for demanding, high-throughput workloads.
• Supports NAT mode for remote-access deployments and routing mode for site-to-site deployments.
• Supports routing by IP CIDR ranges and domain names for defining access policies for cloud-hosted, SaaS, and internal applications.
• Supports split-tunnel and full-tunnel configurations.

Availability and Scale

• Supports clustering across multiple Access Server nodes to increase capacity and improve availability.
• Supports DNS-based traffic distribution for directing users to available cluster nodes.
• Resize the Droplet or add cluster nodes as your connection count grows.

Broad Client Support

• OpenVPN Connect client is available for Windows, macOS, ChromeOS, iOS, and Android.
• Supports all OpenVPN protocol-compatible clients.
• Includes a Client Web UI for downloading connection profiles and client software.
• Supports connection profile distribution by URL to streamline user onboarding.

Software Included

Creating an App using the Control Panel

Click the Deploy to DigitalOcean button to create a Droplet based on this 1-Click App. If you aren’t logged in, this link will prompt you to log in with your DigitalOcean account.

Creating an App using the API

In addition to creating a Droplet from the OpenVPN Access Server 1-Click App using the control panel, you can also use the DigitalOcean API. As an example, to create a 4GB OpenVPN Access Server Droplet in the SFO2 region, you can use the following curl command. You need to either save your API access token to an environment variable or substitute it in the command below.

curl -X POST -H 'Content-Type: application/json' \
         -H 'Authorization: Bearer '$TOKEN'' -d \
        '{"name":"choose_a_name","region":"sfo2","size":"s-2vcpu-4gb","image":"openvpn-18-04"}' \
        "https://api.digitalocean.com/v2/droplets"

Getting Started After Deploying OpenVPN Access Server

Deployment steps

1. Create a Droplet from the OpenVPN Access Server 1-Click App. We recommend authenticating with an SSH key rather than a password.
2. Connect to your Droplet over SSH. The Access Server configuration tool runs automatically on first sign-in.
3. When setup completes, the console prints your Admin Web UI and Client UI URLs along with your temporary username and password. Copy the password before you close the session.
4. Open the Admin Web UI - for example https://123.45.67.89:943/admin/ - and sign in with the temporary credentials, then accept the End User License Agreement. Access Server uses Let’s Encrypt for the web certificate. If Let’s Encrypt is disabled or isn’t working, you may see a self-signed certificate warning - acknowledge it and continue, then configure your SSL certificate in the Admin Web UI to resolve it.

Our Quick Start Guide gives more details on how to quickly get started with your own Access Server.