Followed this same process, it went just fine with the free tier of Access Server. Linking the video from Grant Collins below then copy/pasting a summary from Gemini about the video to show off steps:
https://www.youtube.com/watch?v=-Cy68InF1Vc
This video provides a step-by-step tutorial on building a personal OpenVPN server using a Raspberry Pi.
Here's a summary of the key steps and considerations:
Project Overview & OpenVPN vs. WireGuard (0:16): The video explains why OpenVPN is chosen for its reliability and access control, especially in enterprise environments, over WireGuard's speed.
Pre-setup Check (0:42): Before starting, users should check if their ISP uses CGNAT (Carrier-Grade NAT) by running curl ifconfig.me. If the output doesn't match their router's public IP, they cannot host the VPN on their home network. This setup is not for circumventing geo-restrictions as it uses your own public IP.
Equipment & Raspberry Pi Setup (1:43):
Hardware: Raspberry Pi 3, 4, or 5, an 8GB+ micro SD card, a 5V 3A power supply, and optionally a spare keyboard/mouse.
Software: Imaging the Pi with Ubuntu 24.04 (without UI) using Raspberry Pi Imager.
Configuration: Setting hostname, username/password, Wi-Fi SSID/password, and enabling SSH access for initial setup.
Network: Finding the Pi's IP address via the router's admin portal or arp -na (Linux/Mac) / arp -a (Windows).
System Updates: Running sudo apt update and sudo apt install TZdata to set date and time.
Static IP: Assigning a static IP address to the Raspberry Pi by editing /etc/dhcpcd.conf (4:20).
OpenVPN Access Server Setup (5:10):
Download & Install: Downloading and installing OpenVPN's access server using a curl command to get the script, then running it with sudo bash /your_script_name.sh -y.
Activation: Obtaining a free OpenVPN activation key (supports two client devices) from the OpenVPN Access Server portal and applying it in the admin portal (6:11).
Admin Portal: Logging into the admin portal (your-pi-ip/admin) with the default credentials and highly recommending enabling MFA and changing the default password (6:33).
Firewall & Port Forwarding (7:26):
UFW Rules: Installing and configuring Uncomplicated Firewall (UFW) to deny incoming and allow outgoing traffic by default. Specific ports for OpenVPN (1194/UDP, 443/TCP) and the admin interface (943/TCP - never expose to WAN) are configured.
Router Port Forwarding: Adding port forwarding rules on your router for OpenVPN (1194/UDP and optionally 443/TCP) to expose the VPN to the internet.
Enable Full Tunnel Access (9:04):
NAT Postrouting: Modifying UFW rules to enable NAT postrouting for full internet access through the VPN.
Forward Policy: Changing the default UFW forward policy from drop to accept.
OpenVPN Settings: Ensuring "Internet Gateway" is selected in the OpenVPN admin portal under "Access Control" > "Internet Access and DNS" for full tunnel access.
Enable Dynamic DNS (Optional but Recommended) (10:39):
Using a service like DuckDNS to manage dynamic IP address changes, preventing configuration issues.
Setting up a script on the Raspberry Pi to update DuckDNS periodically using cron (every 5 minutes is suggested).
Updating the OpenVPN server's network settings in the admin portal to use the DuckDNS subdomain instead of the direct IP address.
Connect Devices (12:54): Creating a new user in the OpenVPN admin portal (separate from the admin user), downloading the client profile, and installing it on devices (e.g., Windows workstation, mobile phone) to connect to the VPN.
