OpenVPN Community Edition - SSL VPN Gateway

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

OpenVPN Community Edition is the long-established open-source SSL/TLS VPN daemon, licensed under the GPL version 2. It builds an encrypted, certificate-authenticated tunnel between remote clients and a private network, and it is one of the most widely deployed remote-access VPN implementations in use today. This image from cloudimg packages the current upstream stable release, installed from OpenVPN Inc's own cryptographically signed software repository, together with the easy-rsa certificate tooling, kernel forwarding and NAT configuration, and a first-boot service that turns a bare instance into a working VPN gateway without manual certificate work.

This product ships the open-source Community Edition only. It is not OpenVPN Access Server and contains no Access Server software or licence.

## Per-Instance Certificate Authority

A VPN server is only as trustworthy as its private keys, so this image ships none. No certificate authority key, server key, client key, tls-crypt key or client profile is baked into the image. On first boot the instance generates its own elliptic-curve certificate authority, its own server certificate, its own control-channel key and one ready-to-use client profile, then verifies the tunnel by connecting a client to itself before it reports success. Two instances launched from this image therefore have entirely different certificate authorities, and a customer's clients can never be authenticated by anyone else's server.

The generated client profile at /root/client1.ovpn already carries the instance's public address, so the first client connects without editing anything. Further clients are issued with easy-rsa over SSH, and revocation is handled by the standard certificate revocation list.

## What You Get

• OpenVPN Community Edition running under systemd as openvpn-server@server, on UDP port 1194, in routed mode on the 10.8.0.0/24 tunnel subnet.
• AES-256-GCM data encryption, tls-crypt control-channel protection, TLS 1.2 minimum and SHA-256 authentication, configured out of the box.
• The easy-rsa PKI on a dedicated data volume, so the certificate authority can be encrypted, snapshotted and restored independently of the operating system disk.
• IP forwarding and an nftables masquerade rule already in place, so connected clients reach the internet through the instance.
• An unauthenticated plain-text health endpoint on port 80 for load balancer and uptime checks.
• Unattended security upgrades wired to both the distribution archive and OpenVPN Inc's own repository.

## No Web Console

OpenVPN Community Edition is a headless network service and has no web management interface. Administration is done over SSH: issuing and revoking client certificates, adjusting pushed routes and reading connection status are all command-line tasks. If you need a browser-based administration console you want a different product; this listing is deliberately the plain, well-understood daemon.

## Getting Started

1. Launch the instance and allow inbound UDP 1194 in its security group. The VPN cannot be reached until you do; cloudimg cannot open it for you.

2. Assign a public IP or Elastic IP so clients have a stable address to reach.

3. Connect over SSH and copy the generated client profile from /root/client1.ovpn to your device.

4. Import the profile into any standard OpenVPN client and connect.

By default the server pushes a default route, so client traffic egresses through the instance. Split tunnel, where only your own subnets go over the VPN, is a one-line change to the server configuration and is your choice to make. The deployment guide covers both.

## Evaluate Before You Commit

You can test the full product on a small instance type with no long-term commitment. This listing includes a 7-day free trial: launch it, retrieve your client profile, verify the tunnel carries traffic, and confirm it meets your requirements before scaling up. See the Pricing tab for current software charges.

## Support

cloudimg support covers deployment and launch problems, security group and routing configuration, certificate issuance and revocation, split and full tunnel setup, client onboarding, storage expansion and upgrades to newer OpenVPN releases. Support is available 24/7 by email and live chat, and we aim to respond within one business day.

OpenVPN is a registered trademark of OpenVPN Inc. cloudimg is not affiliated with, endorsed by or sponsored by OpenVPN Inc. This image packages the open-source OpenVPN Community Edition, licensed GPL-2.0.