Vidensdatabase

How to Install OpenVPN Access Server Using Podman

This guide explains how to install OpenVPN Access Server using Podman on a Linux server.

Prerequisites

• Root or sudo access to the server
• AlmaLinux/RHEL-based Linux server
• Public IP address assigned to the server
• /dev/net/tun device available

Step 1: Install Podman

Install Podman and the Docker compatibility package:

dnf install -y podman podman-docker

Verify the installation:

podman --version
docker --version

Step 2: Create the OpenVPN Data Directory

Create a directory to store the OpenVPN Access Server configuration and persistent data:

mkdir -p /opt/openvpn

Step 3: Start the OpenVPN Access Server Container

Run the OpenVPN Access Server container using the following command:

podman run -d \
  --name=openvpn-as \
  --device /dev/net/tun \
  --cap-add=MKNOD \
  --cap-add=NET_ADMIN \
  --network host \
  -p 943:943 \
  -p 443:443 \
  -p 1194:1194/udp \
  -v /opt/openvpn:/openvpn \
  --restart=always \
  openvpn/openvpn-as

Command Options Explained

Note: Since --network host is being used, the port mapping options (-p) are not required for normal port publishing. The container uses the host's network stack directly.

Step 4: Verify the Container

Check whether the OpenVPN container is running:

podman ps

If the container is not running, check the logs:

podman logs openvpn-as

Step 5: Get the Initial Admin Password

OpenVPN Access Server generates an initial administrator password during the first startup.

docker logs openvpn-as 2>&1 | grep -i 'Auto-generated pass ='

Example output:

Auto-generated pass = XXXXXXXXX

The default administrator username is:

openvpn

Save the generated password securely.

Step 6: Enable IPv4 Forwarding

Enable IPv4 forwarding so that VPN clients can route traffic through the server.

echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-openvpn-forward.conf

Apply the configuration:

sysctl --system

Verify the setting:

sysctl net.ipv4.ip_forward

Expected output:

net.ipv4.ip_forward = 1

Step 7: Access the OpenVPN Admin Panel

Open the following URL in your browser:

https://SERVER_IP:943/admin

Replace SERVER_IP with the public IP address of your server.

Login using:

Step 8: OpenVPN Client Portal

The OpenVPN client portal can be accessed using:

https://SERVER_IP:943/

Step 9: Allow Required Firewall Ports

Make sure the following ports are allowed through the server firewall and any external firewall/security group.

For firewalld, use:

firewall-cmd --permanent --add-port=943/tcp
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --permanent --add-port=1194/udp
firewall-cmd --reload

Step 10: Verify the Installation

Check the OpenVPN container:

podman ps

Check the OpenVPN logs:

podman logs openvpn-as

Check listening ports:

ss -lntup | grep -E ':(443|943|1194)\b'

Verify IP forwarding:

sysctl net.ipv4.ip_forward

Useful Commands

Stop OpenVPN:

podman stop openvpn-as

Start OpenVPN:

podman start openvpn-as

Restart OpenVPN:

podman restart openvpn-as

View logs:

podman logs openvpn-as

Follow logs:

podman logs -f openvpn-as

Remove the container:

podman rm -f openvpn-as

The persistent OpenVPN data remains in /opt/openvpn unless the directory is manually removed.

Troubleshooting

Container is not starting

podman logs openvpn-as

TUN device is missing

ls -l /dev/net/tun

Verify that the TUN device is available on the host.

VPN clients cannot access the Internet

Verify IP forwarding:

sysctl net.ipv4.ip_forward

The expected value is 1. Also verify the firewall, NAT, and routing configuration on the server.

Cannot access the Web UI

Check whether OpenVPN is listening on the required ports:

ss -lntp | grep -E ':(443|943)\b'

Also verify that ports 443 and 943 are allowed through the server firewall and any upstream firewall.