OpenVPN Access Server (BYOL) / Self-Hosted VPN & ZTNA

I have been in the media field for fourteen years, helping different global customers by streaming videos and utilizing secure environments. We have been using OpenVPN Access Server for around nine years now.

Initially, we were using more traditional VPN solutions where we had to control the passwords carefully and be very cautious about whom to share those credentials with. Then we came across OpenVPN Access Server, which provides a self-hosted version for organizations, allowing us to avoid directly exposing internal applications to the Internet and instead offers a more secure channel between them. Our engineers work on laptops and used VPNs to connect to the Internet and the company network, which exposed internal applications. Instead, OpenVPN Access Server provides a controlled environment where engineers and vendors globally can access applications securely. With MFA implementation, it is very secure, using SSOs and encrypted secure tunnels, ensuring that if someone attempts to reach internal applications, everything is handled properly without compromising security, as access is granted only after extensive validation, verification, and authentication.

It saves our environment and makes work easier by allowing LDAP integration for authentication where group members easily gain access to platforms necessary for their work. In our organization, we work on various infrastructures such as production Kubernetes clusters, AWS VPCs, internal Grafanas, and Kibanas, alongside ServiceNow integrations and multiple customer environments with thousands of SSH servers and various monitoring platforms and APIs. Having everything exposed to the Internet would pose a significant threat. Therefore, OpenVPN Access Server acts as a middle layer between our environments and the Internet, allowing access to applications only based on defined roles and granular rules tailored to the users' needs. For instance, our SREs can make changes on YAML and JSON files, while SROs can only read without making changes, ensuring secure access levels based on expertise. Vendors are granted access for their specific needs as well, making our work environment well-managed and organized.

Recently, while working on the Olympics, there was a requirement involving two sets of customers; one was using OpenVPN Access Server, and the other was utilizing Cisco Secure. We were working with different tools for monitoring and needed to provide access through secure means to prevent data exposure. If security is compromised in any server, it can lead to threats and data breaches, so all data passing through environments must be monitored effectively by a specific set of individuals. When something goes wrong, those tasked with handling it must ensure that they investigate, troubleshoot, and fix any issues. Our team had three SREs working during this period, equipped to resolve high-severity events. The customer was simultaneously granted access to monitor data flows on their platform while management required detailed oversight on the services, encryption tests, and necessary adjustments. The environments were suitably hosted on Kubernetes in the cloud, and every team coordinated seamlessly without compromising security, resulting in smooth operations.

OpenVPN Access Server offers features such as local authentications, compatibility with LDAP, Redis, SAML, TOTP MFAs, and multi-factor authentication, which are great for security. It also supports SSO, which allows for easier management of user access without maintaining separate directories. Administrative tasks are straightforward, featuring a simple GUI that permits management of users, groups, authentication, VPN settings, and access policies effectively. This ease of management makes it a user-friendly tool for our needs.

A standout feature is its compatibility with multiple operating systems used by our media-focused company. OpenVPN Access Server works incredibly well with platforms such as Windows, macOS, Linux, Android, and iOS, ensuring comprehensive client support across our diverse operations.

OpenVPN Access Server saves us time compared to earlier VPNs where managing credentials had its challenges. We used to distribute VPN credentials, which required maintaining records and introduced security risks if anyone learned those passwords. Post-adoption of OpenVPN Access Server, it has positively structured roles based on tasks, troubleshooting, and support. Previously, one team handled user account management and password renewal, which was often tedious and prone to errors, complicating access for those in need. OpenVPN Access Server allows easy additions into LDAPS for secure access without complications, making work easier for everyone.

There are definitely areas for improvement. A broader network level access faces challenges, and the clustering configuration seems insufficient, posing a single point of failure. Moreover, patch management and monitoring are our ongoing responsibilities, which OpenVPN Access Server should consider addressing.

I would rate OpenVPN Access Server around a seven. While it is effective, there are instances where infected devices or incorrect configurations can create problems. The VPN struggles under these circumstances, and latency issues need attention, leading to slower performance.

The rating of seven reflects significant areas needing improvement such as latency, management issues, and vulnerabilities such as single points of failure. Managing certificates falls on us; any issues within the certificate or related layers can lead to complications that require extensive debugging, consuming valuable resources. Furthermore, the licensing cost is not user-oriented but based on the number of established connections, leading to elevated expenses.

Security is satisfactory; however, the challenge lies with infected devices. The channels are well-secured, and periodic upgrades enhance its defenses further. The primary focus should be on configuring our VPNs properly for optimal security.

The accuracy and reliability of OpenVPN Access Server's outputs are decent, albeit requiring improvements. I would appreciate a reduction in resource consumption, especially given the high costs associated with the infrastructure's current resource demands, particularly with OpenVPN Access Server's AI capabilities still in their developmental phase.

The connection speed utilizing OpenVPN Access Server is notably slow, with high latency affecting performance.

We have been using OpenVPN Access Server for around nine years now.

OpenVPN Access Server remains stable and scalable. I deem it quite flexible, bolstered by quality customer support.

Scalability is efficient, allowing multiple concurrent connections easily. The customer support provided is commendable and always responsive when needed, ensuring we receive timely assistance.

I would rate customer support as a solid nine out of ten due to the support and onboarding interactions we have experienced.

Previously, we utilized a different solution which failed to deliver adequate control over applications and posed firewall limitations; it was not well-aligned with our primary needs. Transitioning to OpenVPN Access Server was initiated due to better performance outcomes and enhanced management capabilities.

The installation and setup of OpenVPN Access Server is quite easy and efficient. The process involves a straightforward setup folder; clicking through within a minute can establish a working environment, facilitating quick onboarding for users.

Certain applications are effectively managed within OpenVPN Access Server. We have obtained device management capabilities seamlessly, simplifying user access across various devices. The centralized administrative mode enhances user group management and client provisioning, making it straightforward to operate.

Regarding return on investment, we are saving time by managing users and groups more efficiently since adopting OpenVPN Access Server. We have transitioned to using licenses effectively within departments and trimmed down the number of licenses required. This change allows us to keep security tight without overwhelming workloads for administrative teams, thereby saving time. Financially, we observe that while costs were initially high, optimizing user connections has rendered better financial management in the long run, improving user access without extensive management needs.

The pricing and setup costs for OpenVPN Access Server are on the high side since licenses are not user-dependent but based on the number of connections established. With two free simultaneous connections, the paid license hinges on concurrent active users, causing overhead for large enterprises due to the extensive number of simultaneous connections typically needed.

Before choosing OpenVPN Access Server, we evaluated others such as Wireguard and IPSec, but OpenVPN Access Server prevailed at that moment due to its superior control and simple self-hosting solutions.

There is a need for improvements, especially considering alternative solutions such as ZITNA, which offer dedicated application-level approaches. Moreover, considering Wireguard could provide simpler side-to-side tunneling, which has been discussed internally as a potential alternative.

For those looking into OpenVPN Access Server, I recommend it for its strong security, user-friendly access management, and operational scale. If you operate remotely or require easy scalability across multiple platforms, OpenVPN Access Server is a robust solution despite its latency concerns and slightly higher costs, making it a great asset for your organizational needs.

OpenVPN Access Server is deployed on AWS, providing a public cloud environment for our organizational needs. We utilize AWS, which stands for Amazon Web Services. We purchased OpenVPN Access Server through the AWS Marketplace.

Despite rising user levels causing potential complications, OpenVPN Access Server's effectiveness stands out. Our team, consisting of eighty people, finds that managing usernames and passwords becomes manageable with the help of LDAP, ensuring access aligns with specific roles and skill sets.

The user interface of OpenVPN Access Server is simple and intuitive. It provides diverse options, displaying the server version, name, license status, and active users. The current active user count and options for authentication are readily visible, along with configuration details, making it user-friendly and efficient for quick management.

I would rate this product overall a seven out of ten.

OpenVPN Access Server was primarily used to secure a fixed IP address, as some of my customers needed to access resources remotely. A concrete example is that a client of my client had restricted access so that they would only accept connections from specific IP addresses. When my client delivered work to that end client, they had to go through OpenVPN Access Server; in other words, we used it as a proxy.

In addition to the cloud, the client's company was using a NAS for internal sharing, so to access the NAS, they needed to go through OpenVPN Access Server.

One of the best features of OpenVPN Access Server is that its encryption is still more complex than L2TP, though it is weaker than WireGuard.

Regarding the strength of the encryption, one aspect is certificates; you absolutely need certificates, and on top of that, you also need a username and password, so the encryption strength is higher. However, the standard itself is a bit old now, and it is true that it has quite a few vulnerabilities.

The impact of OpenVPN Access Server for my company is really for my customers, but they have been able to provide their own customers with a safe remote environment and fixed IP addresses, which was the outcome.

OpenVPN Access Server could be improved in several areas. The encryption strength is inevitably lower compared with the latest technologies, and when I try to add features like two-factor authentication, the needed plugins and so on often are not really available or do not fit well. For my current customers and for myself, I try to have them use WireGuard instead.

I think the way forward is to move to WireGuard and to two-factor authentication. With OpenVPN, you use TCP, so attackers tend to target the port, which makes it pretty easy to figure out which port is being used. With WireGuard, which is locked down over UDP, it is harder for attackers to probe ports. For my current customers and my other customers, I am planning to migrate them to WireGuard.

I have been using OpenVPN Access Server at a customer site, and we operated it for about six years.

I would rate the stability of OpenVPN Access Server as unstable at first, but as we changed how we operated it, it rarely went down.

Scalability was available depending on configuration, and I did test it. However, for this customer, there were not enough users to really make use of that scalability, so we did not actually leverage it.

Customer support was basically via email only, but the person I dealt with was very technically knowledgeable. When I asked about SoftEther VPN, they gave very detailed answers.

In the past, I had both on-premises deployments and public cloud deployments for OpenVPN Access Server.

When I deployed SoftEther, it was very easy as I wrote my own script, and running that script was enough to get it up and running.

I used the open-source version of SoftEther VPN, so there were essentially no license costs regarding my experience with pricing, implementation costs, and licensing.

I did consider other options; for example, I looked at Tailscale, but it would have been very costly, so we decided not to adopt it.

I give OpenVPN Access Server an overall rating of seven out of ten because it supports certificate-based authentication. I give it that score because it lets you use certificates; if you do not have the certificate, you cannot access it, and that is the reason.

We are gradually shutting down our OpenVPN servers and switching to WireGuard for deploying OpenVPN Access Server in our organization.

I used RADIUS for authentication integration, but I stopped using it partway through. I would evaluate the effectiveness of RADIUS authentication as somewhat weak because the connection tends to drop fairly easily. Regarding some elements like usernames, it is not fully encrypted end-to-end, so that is a weakness and a concern, which is why I stopped using RADIUS.

Configuring ports took a bit of time when I was using both L2TP and OpenVPN. I used the access control features of OpenVPN Access Server, but because the customer's scale was small, we did not set very granular permissions.

As for SoftEther, I used SoftEther VPN, and it was relatively easy to understand, but I felt it could have had a few more configuration options. The connection speed was a bit slower compared with other VPN solutions because the headers become larger, so the speed inevitably drops somewhat. You also need to configure the MTU, so depending on the location, sometimes connections were easy, and sometimes they would not connect at all. When you tweak those settings, the speed can drop even further.

I did not purchase OpenVPN Access Server through AWS Marketplace; at that time, I installed the SoftEther application myself.

They should switch from OpenVPN to WireGuard. There are many areas where this interview could improve.

My main use case for OpenVPN Access Server is setting up security in a company where some private resources are not accessible, and some remote employees can use it as well.

A specific example of how I use OpenVPN Access Server for this purpose is that we gave OpenVPN Access Server access to every employee and put a firewall behind our database, which is only accessible by the VPN.

The best features OpenVPN Access Server offers are ease of setup, and it is just easy. The ease of setup helps my team day-to-day because you set it up once and then you forget about it.

OpenVPN Access Server has a significant positive impact on my organization for security, as it helps a lot.

I think OpenVPN Access Server's setup can be just one click; currently, it takes multiple steps, and when you forget the admin password, you are locked in.

I have been using OpenVPN Access Server for the last five years.

OpenVPN Access Server is stable, definitely.

I don't know how OpenVPN Access Server's scalability is; we only have one instance.

We haven't used customer support for OpenVPN Access Server.

We had another solution, but I cannot share which solution we used before switching to OpenVPN Access Server.

It is easy to install and set up OpenVPN Access Server within my organization, but it could be easier. You just need to set up the application itself, then configure it for your needs. After that, you configure the firewall and distribute it to all the team members, and you're done.

I am not the one who procured this product, as another team is handling it, so I cannot comment on pricing, setup cost, and licensing.

I have seen a return on investment, definitely for security, but I cannot share any metrics.

I am not the one who procured this product, as another team is handling it, so I cannot comment on pricing, setup cost, and licensing.

I did not evaluate other options before choosing OpenVPN Access Server.

My advice to others looking into using OpenVPN Access Server is to just try it. If you don't like it, you don't like it.

I don't know if I am using local, LDAP, RADIUS, PAM, or SAML authentication integration with OpenVPN Access Server.

I don't know if we have utilized the Access Controls feature of OpenVPN Access Server; another team is handling that.

I would describe the user interface of OpenVPN Access Server as not modern, but it works. The user experience could be better with all the statistics and everything.

My impression of the connection speed when using OpenVPN Access Server compared to other VPN solutions is that it is solid compared to others.