[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Tutorials](index.md) > Setting up VPN connections > Connecting to a cloud network using OpenVPN

# Connecting to a cloud network using OpenVPN

With TCP or UDP port tunnels and asymmetric encryption, you can create virtual networks. For example, you can use VPN to do the following:

* Connect networks residing in different locations.
* Provide contractors with an access to an in-house network.
* Set up an encrypted connection over Wi-Fi.

[OpenVPN Access Server](https://yandex.cloud/en/marketplace/products/yc/openvpn-access-server) is compatible with the OpenVPN [open-source version](https://github.com/OpenVPN) and built on it. It provides clients for Windows, Mac, Android, and iOS. You can also use its web UI to manage connections.

Learn how to configure auto-connection and a connection using a username and password below. To create a virtual network:

1. [Get your cloud ready](#before-you-begin).
1. [Create subnets and a test VM](#create-environment).
1. [Run a VPN server](#create-vpn-server).
1. [Configure network traffic permissions](#network-settings).
1. [Get the administrator password](#get-admin-password).
1. [Activate your license](#get-license).
1. [Create an OpenVPN user](#configure-openvpn).
1. [Connect to the VPN](#test-vpn).

If you no longer need the VPN server, [delete the VM](#clear-out).

## Get your cloud ready {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).

### Required paid resources {#paid-resources}

The cost of the OpenVPN infrastructure support includes:

* Fee for the disks and continuously running VMs (see [Yandex Compute Cloud pricing](../../compute/pricing.md)).
* Fee for a dynamic or static public IP address (see [Yandex Virtual Private Cloud pricing](../pricing.md)).
* Fee for the OpenVPN Access Server license (when using more than two connections).

## Create subnets and a test VM {#create-environment}

To connect cloud resources to the internet, make sure you have [networks](../operations/network-create.md) and [subnets](../operations/subnet-create.md).

Create a test [VM](../../compute/operations/vm-create/create-linux-vm.md) without a public IP address and connect it to the subnet.

## Run a VPN server {#create-vpn-server}

Create a VM to run the VPN server:

{% list tabs group=instructions %}

- Management console {#console}

  1. On the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) dashboard in the [management console](https://console.yandex.cloud), click **Create resource** and select `Virtual machine instance`.
  1. Under **Boot disk image**, enter `OpenVPN Access Server` in the **Product search** field and select a public [OpenVPN Access Server](https://yandex.cloud/en/marketplace/products/yc/openvpn-access-server) image.
  1. Under **Location**. Select the [availability zone](../../overview/concepts/geo-scope.md) where the test VM is already located.
  1. Under **Disks and file storages**, specify the boot [disk](../../compute/concepts/disk.md#disks_types) size: `20 GB`.
  1. Under **Computing resources**, navigate to the `Custom` tab and specify the [platform](../../compute/concepts/vm-platforms.md), number of vCPUs, and amount of RAM:

      * **Platform**: `Intel Ice Lake`
      * **vCPU**: `2`
      * **Guaranteed vCPU performance**: `100%`
      * **RAM**: `2 GB`

  1. Under **Network settings**:

      * In the **Subnet** field, select the network and subnet to connect your VM to. If the required [network](../concepts/network.md#network) or [subnet](../concepts/network.md#subnet) is not there, [create it](../operations/subnet-create.md).
      * In the **Public IP address** field, keep `Auto` to assign the VM a random external IP address from the Yandex Cloud pool or select a static address from the list if you reserved one.

          Either use static public IP addresses [from the list](../operations/get-static-ip.md) or [convert](../operations/set-static-ip.md) your VM IP address to static. Dynamic IP addresses may change after the VM reboots and the connections will no longer work.

      * If a list of **Security groups** is available, select a [security group](../concepts/security-groups.md). If you leave this field empty, the system will assign the [default security group](../concepts/security-groups.md#default-security-group) to the network.

  1. Under **Access**, select **SSH key** and specify the VM access credentials:

      * In the **Login** field, enter the username. Do not use `root` or other names reserved for the OS purposes. To perform operations requiring superuser privileges, use the `sudo` command.
      * In the **SSH key** field, select the SSH key saved in your [organization user](../../organization/concepts/membership.md) profile.
        
        If there are no SSH keys in your profile or you want to add a new key:
        
        1. Click **Add key**.
        1. Enter a name for the SSH key.
        1. Select one of the following:
        
            * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own.
            * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own.
            * `Generate key`: Automatically create an SSH key pair.
            
              When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home/<user_name>/.ssh` directory. In Windows, unpack the archive to the `C:\Users\<user_name>/.ssh` directory. You do not need additionally enter the public key in the management console.
        
        1. Click **Add**.
        
        The system will add the SSH key to your organization user profile. If the organization has [disabled](../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.

  1. Under **General information**, specify the VM name: `vpn-server`.
  1. Click **Create VM**.
  1. This will open a window with the licensing model: BYOL (Bring Your Own License). Click **Create**.

{% endlist %}

## Configure network traffic permissions {#network-settings}

{% list tabs group=instructions %}

- Management console {#console}

  [Security groups](../concepts/security-groups.md) act as a virtual firewall for incoming and outgoing traffic. Learn more about the default security group [here](../concepts/security-groups.md#default-security-group).
  1. To enable OpenVPN Access Server to work, [add](../operations/security-group-add-rule.md) the following rules to the default security group:

     Traffic<br>direction | Description | Port range | Protocol | Source | CIDR blocks
     --- | --- | --- | --- | --- | ---
     Inbound | `VPN Server` | `443` | `TCP` | `CIDR` | `0.0.0.0/0`
     Inbound | `VPN Server` | `1194` | `UDP` | `CIDR` | `0.0.0.0/0`
     Inbound | `Admin Web UI,`</br>`Client Web UI` | `943` | `TCP` | `CIDR` | `0.0.0.0/0`

     The VPN server can forward traffic from the `HTTPS` port. If required, leave only `TCP 443` open. See also the **Configuration** → **Network Settings** tab of the server admin panel.

  1. If you have configured a security group of your own, make sure it allows traffic between the VPN server and the required resources. For example, they share the same security group and there is a [Self rule](../concepts/security-groups.md#rules-types) for the whole group.

{% endlist %}

## Get the administrator password {#get-admin-password}

The openvpn user with administrator privileges was created on the `OpenVPN` server in advance. The password is generated automatically when you create a [VM](../../compute/concepts/vm.md).

Get the password in the [serial port output](../../compute/operations/vm-info/get-serial-port-output.md) or the serial console. The password will display in the following string:

```text
To log in, please use the `openvpn` account with the <password> password.
```

Where `<password>` is the `openvpn` user password.

Log in to the admin panel using the `openvpn` username and the obtained password.

If you do not get the password after [launching the VPN server](#create-vpn-server) for the first time, you need to re-create the VM running [OpenVPN Access Server](https://yandex.cloud/en/marketplace/products/yc/openvpn-access-server). The password will not display when reboot.

## Activate your license {#get-license}

{% note info %}

If you have up to two VPN connections, use the product for free (no activation required).

{% endnote %}

To activate the license:

1. Create an account on [openvpn.net](https://myaccount.openvpn.com/signup).
1. Enter the confirmation code sent to your email address.
1. In the **Where would you like to Go?** window, select the **Remember my choice** option and select the **Access serve** product.
1. In the **Tell us more** window, select the purpose: **Business use** or **Personal use**.
1. On the **Subscriptions** tab, select the maximum number of connections in the **How many VPN connections do you need?** field and click **Create**.
1. Your subscription will be displayed on the screen: **Subscription 1**.
1. To copy the activation key, click **Copy Key** under **Subscription Key**.

Wait until the VM status changes to `RUNNING` and enter the activation key in the admin panel at `https://<VM_public_IP_address>/admin/`.

You can look up the VM's public IP address in the [management console](https://console.yandex.cloud) by checking the **Public IPv4 address** field under **Network** on the VM page.

## Create an OpenVPN user {#configure-openvpn}

OpenVPN Access Server provides two web interfaces:

1. **Client Web UI** at `https://<VM_public_IP_address>/`. This UI allows regular users to download client applications and configuration profiles.
1. **Admin Web UI** at `https://<VM_public_IP_address>/admin/`. This UI allows the administrator to configure the server.

{% note info %}

By default, the server has a self-signed certificate. If you need to replace this certificate, follow the steps [here](https://openvpn.net/vpn-server-resources/installing-a-valid-ssl-web-certificate-in-access-server/).

{% endnote %}

To create a user, log in to the admin panel:

1. In your browser, open the URL in `https://<VM_public_IP_address>/admin/` format.
1. Enter the `openvpn` username and password (see how to get the administrator password [here](#get-admin-password)).
1. Read the license agreement of click **Agree**. This will open the OpenVPN Admin Web UI home page.
1. Expand the **User management** tab and select **User permissions**.
1. In the user list, enter a username for the new user in the **New Username** field, e.g., `test-user`.
1. Click the pencil icon in the **More Settings** column and enter a password for the new user in the **Password** field.
1. Click **Save settings**.
1. Click **Update running server**.

## Connect to the VPN {#test-vpn}

In the user panel, you can download [OpenVPN Connect](https://openvpn.net/vpn-client/) for Windows, Linux, MacOS, Android, and iOS. You can also use [OpenSource clients](https://openvpn.net/source-code/) for connection.
 
To make sure the connection is established and working properly, connect to the VPN and run the `ping` command for the internal address of the test VM:

{% list tabs group=operating_system %}

- Linux {#linux}

   1. Install `openvpn` using the package manager:

      ```bash
      sudo apt update && sudo apt install openvpn
      ```

   1. Allow automatic connection for `test-user`:

      * Log in to the admin panel at `https://<VM_public_IP_address>/admin/`.
      * Open the **User management** → **User permissions** tab.
      * Enable the **Allow Auto-login** option in the user line.

   1. Configure routing:

      * Log in to the admin panel at `https://<VM_public_IP_address>/admin/`.
      * Open the **Configuration** → **VPN Settings** tab.
      * Under **Routing**, disable **Should client Internet traffic be routed through the VPN?**.

   1. Download a configuration profile:

      * In your browser, open the user panel at `https://<VM_public_IP_address>/`.
      * Sign in using the `test-user` username and password.
      * Under **Available Connection Profiles**, click **Yourself (autologin profile)** and download the `profile-1.ovpn` file.
      * You can also download a configuration file in the admin panel at `https://<<VM_public_IP_address>/admin/`.

   1. Upload the configuration file to a Linux machine:

      ```bash
      scp profile-1.ovpn user@<IP_address>:~
      ```

   1. Move the configuration file to the `/etc/openvpn` folder:

      ```bash
      sudo mv /home/user/profile-1.ovpn /etc/openvpn
      ```

   1. Change the file extension from `ovpn` to `conf`:

      ```bash
      sudo mv /etc/openvpn/profile-1.ovpn /etc/openvpn/profile-1.conf
      ```

   1. Close access to the file:
 
      ```bash
      sudo chown root:root /etc/openvpn/profile-1.conf
      sudo chmod 600 /etc/openvpn/profile-1.conf
      ```

   1. The VPN connection will turn on automatically after restarting. To establish the connection manually, run the command:

      ```bash
      sudo openvpn --config /etc/openvpn/profile-1.conf
      ```

      Result:
   
      ```text
      2022-04-05 15:35:49 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
      2022-04-05 15:35:49 OpenVPN 2.5.1 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
      2022-04-05 15:35:49 library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
      2022-04-05 15:35:49 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
      2022-04-05 15:35:49 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
      2022-04-05 15:35:49 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
      2022-04-05 15:35:49 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
      2022-04-05 15:35:49 TCP/UDP: Preserving recently used remote address: [AF_INET]51.250.25.105:443
      2022-04-05 15:35:49 Socket Buffers: R=[131072->131072] S=[16384->16384]
      2022-04-05 15:35:49 Attempting to establish TCP connection with [AF_INET]51.250.25.105:443 [nonblock]
      ...
      ...
      2022-04-05 15:35:54 Initialization Sequence Completed
      ```

   1. Test the network using the `ping` command:

      ```bash
      sudo ping <test_VM_internal_IP_address>
      ```

      If the command is running, the VM can be accessed via VPN.

   1. To terminate a manually established connection, press **Ctrl** + **C**.

- Windows {#windows}

   1. Download the installation distribution:

      * In your browser, open the user panel at `https://<VM_public_IP_address>/`.
      * Sign in using the `test-user` username and password.
      * Download OpenVPN Connect version 2 or 3 by clicking the Windows icon.

   1. Install and run OpenVPN Connect.

   1. A VPN connection will turn on automatically if auto-login is enabled in the user profile.

   1. You can import a new configuration profile into the application by specifying `https://<VM_public_IP_address>/` or selecting a profile file.

   1. Open the terminal and run this command: `ping <internal_IP_address_of_test_VM>`. If the command is running, the VM can be accessed via VPN.

- macOS {#macos}

   1. Download the installation distribution:

      * In your browser, open the user panel at `https://<VM_public_IP_address>/`.
      * Sign in using the `test-user` username and password.
      * Download OpenVPN Connect version 2 or 3 by clicking the Apple icon.

   1. Install and run OpenVPN Connect.

   1. A VPN connection will turn on automatically if auto-login is enabled in the user profile.

   1. You can import a new configuration profile into the application by specifying `https://<<VM_public_IP_address>/` or selecting a profile file.

   1. Open the terminal and run this command: `ping <internal_IP_address_of_test_VM>`. If the command is running, the VM can be accessed via VPN.

{% endlist %}

## How to delete the resources you created {#clear-out}

Delete the resources you no longer need to avoid paying for them:

* [Delete](../../compute/operations/vm-control/vm-delete.md) the `vpn-server` and test VMs.
* If you reserved a public static IP address, [delete it](../operations/address-delete.md).

#### See also {#see-also}

* [OpenVPN Project Wiki](https://community.openvpn.net/openvpn/wiki)
* [Getting the contents of a Let's Encrypt certificate](../../certificate-manager/operations/managed/cert-get-content.md)
* [Connecting to Access Server](https://openvpn.net/vpn-server-resources/connecting-to-access-server-with-linux/#openvpn-open-source-openvpn-cli-program)