Fix OpenVPN Access Server Not Working on a VPS

If your OpenVPN Access Server on a VPS has stopped connecting, won’t start, or drops clients, this guide walks you through the most common causes and their fixes. You’ll troubleshoot the service, network settings, firewall rules, and client configuration, then get the VPN back online.

What You’ll Need

• SSH access to your VPS (root or sudo privileges)
• The public IP address of your VPS
• OpenVPN Access Server admin credentials (for the web UI)
• Basic command-line comfort

Step-by-Step

1. Check if the OpenVPN processes are running.
   SSH into your VPS and run: ps aux | grep openvpn. You should see processes like openvpn-server or openvpn. If nothing appears, the service is down. Start it with systemctl start openvpn-server (or service openvpn start on older systems).
2. Verify the service status and logs.
   Run systemctl status openvpn-server to see if it’s active and check for errors. Then look at the logs: tail -n 50 /var/log/openvpn/as.log (or journalctl -u openvpn-server). Look for lines like “Initialization Sequence Completed” (good) or error messages about ports, certificates, or network.
3. Confirm the required ports are open.
   OpenVPN Access Server uses TCP 943 for the web admin and client web interface, TCP 443 for SSL/TLS (or UDP 1194 if you’ve configured it). On your VPS, check with netstat -tulpn | grep -E '943|443|1194'. If nothing listens, the service isn’t binding correctly. If you’re using a cloud firewall (like AWS Security Groups or DigitalOcean Cloud Firewall), ensure these ports are allowed for incoming traffic.
4. Test the firewall rules on the VPS itself.
   If you use UFW, run ufw status. If it’s active, allow the needed ports: ufw allow 943/tcp, ufw allow 443/tcp, ufw allow 1194/udp. For firewalld, use firewall-cmd --permanent --add-port=943/tcp and similar, then reload. Remember to also allow the OpenVPN client subnet (often 172.27.224.0/20) if you have internal routing rules.
5. Check the Access Server configuration.
   Run cd /usr/local/openvpn_as && ./sacli --key "vpn.server.ip_address" --value "YOUR_VPS_PUBLIC_IP" ConfigPut to ensure the server knows its public IP. Then restart the service: systemctl restart openvpn-server. Also verify that the client configuration uses the correct IP and protocol (UDP or TCP) by downloading a fresh client profile from the web UI.
6. Examine the client configuration.
   If the server is up but clients fail, open the .ovpn file in a text editor. Check that the remote line points to your VPS’s public IP and the correct port. If you changed the port or protocol, the client must match. Also ensure the certificate and key sections are not corrupted.
7. Restart the entire OpenVPN stack.
   Sometimes a clean restart resolves transient issues. Run systemctl restart openvpn-server and also systemctl restart openvpn if that service exists. Then wait a few seconds and check the status again.
8. Verify DNS and routing on the VPS.
   If clients connect but can’t access the internet, check that IP forwarding is enabled: sysctl net.ipv4.ip_forward should return 1. If not, set it with echo 1 > /proc/sys/net/ipv4/ip_forward and make it permanent in /etc/sysctl.conf. Also check that NAT is set up: iptables -t nat -L POSTROUTING should show a MASQUERADE rule for the VPN subnet.
9. Reinstall or upgrade if necessary.
   If all else fails, consider reinstalling the Access Server package. Backup your config first: cd /usr/local/openvpn_as && ./sacli --key "vpn.server.config" ConfigGet. Then uninstall and reinstall using the official .deb or .rpm package, and restore the config.

Common Mistakes

• Forgetting to open ports in the cloud provider’s firewall – even if the VPS firewall is fine, the provider’s external firewall can block traffic.
• Using the wrong protocol – if the server is set to UDP 1194 but the client tries TCP 443, it won’t connect.
• Not updating the server’s public IP after a VPS rebuild – the Access Server stores the IP and may still try to use an old one.
• Editing the client config manually and breaking the certificate block – always download a fresh profile.
• Ignoring the system clock – if the VPS time is off, certificate validation fails. Run timedatectl and enable NTP.

Tips

• Use the Access Server web UI (https://YOUR_VPS_IP:943/admin) to check the dashboard for error messages and current connections.
• Keep the Access Server software updated – the web UI has a button to check for updates.
• If you’re behind a NAT or a reverse proxy, make sure to forward both TCP 943 and TCP 443 correctly.
• For troubleshooting, temporarily disable the firewall to see if it’s the cause, but re-enable it immediately after.

Troubleshooting

If the service won’t start: Look at the log file. Common issues are missing certificates (run ./sacli --key "vpn.server.certificate" ConfigGet to verify), or port conflicts (check if another process uses 443). You can also try ./sacli --key "vpn.server.daemon" --value "true" ConfigPut to run in debug mode.

If clients can connect but have no internet: Check NAT and IP forwarding as above. Also verify that the client’s DNS settings are correct – in the Access Server admin UI, under Configuration > Client Settings, ensure the DNS servers are set (e.g., 8.8.8.8).

If the web admin UI is unreachable: Ensure the service is running and port 943 is listening. Try curl -k https://localhost:943 from the VPS – if that works, the issue is external firewall.

If you see “TLS Error: TLS key negotiation failed” in client logs: This usually means a mismatch between the client and server certificates. Re-download the client profile and try again.

If the connection drops frequently: Check the server log for “Authenticate/Decrypt packet error” – this often indicates a routing issue. Also try switching from UDP to TCP (or vice versa) in the client.

Frequently Asked Questions

Why does my OpenVPN Access Server stop working after a VPS reboot?

Often the service isn’t enabled to start on boot. Run systemctl enable openvpn-server to make it persistent.

Can I use the same port for the web UI and the VPN tunnel?

Yes, the Access Server can use TCP 443 for both the web UI and the VPN connection (this is the default). It multiplexes the traffic.

How do I change the VPN protocol from UDP to TCP?

In the admin UI, go to Configuration > Network Settings, and change the “VPN Protocol” to TCP. Then restart the service and download new client profiles.

What does “Initialization Sequence Completed” mean?

It means the OpenVPN client has successfully established a connection to the server. If you see this but still have no internet, the problem is likely routing or DNS.

Is it safe to run OpenVPN Access Server on a VPS with a shared IP?

Yes, it works fine, but you must ensure the VPS provider allows VPN traffic and that you have a static IP. Some providers block certain ports, so check their policy.

How do I reset the admin password?

SSH to the server and run ./sacli --user admin --newpass YOUR_NEW_PASSWORD from the /usr/local/openvpn_as/scripts directory.

Related

• Convert MOV to AVI: A Practical Guide
• Data Center Power Demand Growth & Limits
• Oracle Gas Truck Data Center Power Delays?