Frequently Asked Questions – Licensing

Isn't OpenVPN open source and thus free?

The OpenVPN open source project is free to use if you keep to the software license agreement, but the commercial OpenVPN Access Server product sold by OpenVPN Inc. is not free. There are some vast differences between the two programs, and while Access Server does use at its core the OpenVPN open source program, it is much more than just that program.

What does the software license entitle me to?

With a license for the OpenVPN Access Server program you can unlock a certain amount of simultaneous VPN tunnel connections to your OpenVPN Access Server installation. You also get access to our professional support via the support ticket system. You are expected to provide your own server with the OpenVPN Access Server program installed on it, or to hire a server or a cloud based virtual system like Amazon AWS or such with the OpenVPN Access Server program installed on it.

If your Access Server is not licensed, it will only function in a sort of demonstration mode where only 2 simultaneous VPN connections are allowed. To allow more, a license is required.

Please also note that having a license does not mean you can connect to one of our servers. A license key is meant for an OpenVPN Access Server installation on a server you provide and manage. Purchasing and having a license key does not mean that you can connect to openvpn.net with your OpenVPN client program. That is not a service we offer on openvpn.net. However if you are looking for a VPN termination service where you can connect your computer to an already existing VPN server for the purposes of securing your Internet traffic, take a look at our offering called Private Tunnel instead. But if you want to set up your own OpenVPN server based on our OpenVPN Access Server product, and need more than 2 simultaneous connections, then purchasing a license for OpenVPN Access Server is the way to go.

Which licensing models are available for Access Server?

Currently there are two different licensing models available. There is the BYOL or "Bring Your Own License" licensing model, and the Amazon AWS tiered instances licensing model. These are explained below.

BYOL (Bring Your Own License) licensing model

The BYOL model works on any OpenVPN Access Server, except the Amazon AWS tiered instance type that comes with a specification of the amount of connected devices allowed. With the BYOL model you can purchase a license key through our main website and activate it on your Access Server. These license keys are single-activation and lock to the system you activate it on, and unlock a certain amount of simultaneous VPN connections for the duration of the license key. When the license key expires, the license key disappears off the server. As explained below this licensing model is also available on Amazon AWS if you choose the BYOL type OpenVPN Access Server instance from the AWS Marketplace. The instances that specifically mention the amount of "connected devices" do not work with the BYOL licensing model but are instead billed directly through Amazon.

Amazon AWS tiered instances licensing model

On Amazon AWS Marketplace you can look for "OpenVPN Access Server". You'll see a number of results. One of these will simply be titled "OpenVPN Access Server". This Marketplace image is suitable for the BYOL licensing system as long as you do not use auto-scaling and do not change the instance type after activating a license key. If you do then the virtual hardware that the license key has locked to will change and the license key may become invalid. In such a case you will have to contact us through the support ticket system to request a license key reissue. With this licensing model you pay for the AWS instance itself and any license keys that you purchase through us and activate on your Access Server installation. If no license key is installed, the Access Server goes into a demonstration mode where all functions work without time limitations, but it will only allow 2 simultaneous VPN connections to be established. A license key unlocks more connections.

The other images for OpenVPN Access Server listed on AWS Marketplace will have an amount of "connected devices" specified. These function using the Amazon AWS tiered instance licensing model, and these are billed directly through the Amazon systems per the stated hourly charges. The costs are separated into software licensing costs and AWS instance costs. These are billed hourly. If you launch an OpenVPN Access Server (?? connected devices) type instance on Amazon AWS you will incur charges for the use of the software and charges for the use of the instance you've launched while the instance is actively running. If you stop the instance, you will stop incurring additional costs. It is therefore possible to use such a system on demand, or in other words to have an instance on cold standby ready to be launched when needed.

Is there a trial version available?

Yes, the OpenVPN Access Server can be downloaded from our website and installed on any compatible Linux operating system, and during installation you may be asked for a license key, but if you do not provide one, it will automatically go into a sort of demonstration mode. In this demonstration mode, all functions are available and there is no time limit. However, you are limited to only 2 simultaneous active VPN tunnels to the Access Server. This allows for testing all the functions of the Access Server without having to pay a license key. So if you want to try out the Access Server, install Access Server on your Linux OS and you can start testing. Upon request we will also grant free temporary trial license keys for a larger number of connections if you require this for your testing purposes.

OpenVPN Access Server is also available on Amazon AWS as a ready-to-deploy system from the AWS Marketplace in 3 different types:

  1. One type is the BYOL licensing type OpenVPN Access Server instance which is known on the AWS Marketplace simply as "OpenVPN Access Server", and if installed without a license key, will go into a demonstration mode with full functionality and no time limit, but allows only 2 simultaneous VPN connections to be establish. With the BYOL type no software licensing costs are added on Amazon AWS but you only pay for the Amazon AWS costs for the running instance.
  2. Another type are the Amazon AWS OpenVPN Access Server tiered instance licensing type instances which aside from Amazon AWS costs for running an instance also have licensing software costs which are clearly shown on the right hand side on the AWS Marketplace when you click on a tiered instance on the AWS Marketplace.
  3. The third type is the OpenVPN Access Server for 5 connected devices. This one is different from the others because it comes with a 7 day free trial for the licensing costs. This means that for the first 7 days of running this instance type you pay only the Amazon AWS costs for having the instance up and running, but no software licensing costs are added. If after 7 days you continue using the instance, software licensing costs are added.

Amazon AWS in most cases charges for the use of running an instance on their systems, and this is separate from any software licensing costs, so please be aware of this and understand that that component of the costs you pay on Amazon AWS, or for that matter any cloud provider, are not caused or billed by us. It's also important to note that if you launch a tiered instance of OpenVPN Access Server that is licensed for a number of connected devices, and leave it running even if you're not using it, will mean you are still incurring costs on Amazon AWS.

How are licenses counted? By users, devices, or connections?

You may notice that different wording is used here and there in documentation and on the website. Here we aim to provide some clarification. What the licensing system really counts is the amount of active VPN tunnels. This means various scenarios are possible. For example, you can configure 1 user account on your OpenVPN Access Server and set it up so that with that same user name and password you can establish a VPN connection from multiple different devices at the same time. You could set up an account "andrew" and a password for it, and use that account on an iPad, a Windows computer, and two Macintosh computers, all at the same time. In such a situation if all those devices are connected at the same time you're using 4 connections on the license. If your server says it is licensed for 10, then that leaves 6 connections free.

It also works the other way around. You can have 500 user accounts on your Access Server but only license it for 100 connections, and if 25 of those 500 users are connected then you can still connect 75 VPN tunnels with any of the 500 accounts. So in other words, the licensing system does not look at how many user accounts you have, but how many VPN tunnel are connected at the same time. So if you have 500 user accounts but you anticipate that only about 90 of them will ever be online at the same time, then a license key for 100 is perfectly fine.

And if for example you have 10 VPN tunnel connections active on a server that is licensed for 10, then anyone trying to establish the 11th connection will be denied access and receive a message that the licensed amount has been exceeded. When one of the currently connected tunnels is stopped, then that opens up 1 license and the user can then log in.

How much does a software license cost?

Depends on the choices you make on where to deploy and how many simultaneous connections you need and for how long you want to purchase the license key. There is clear pricing information available on our software license pricing page.

I have a license already, how to increase the amount?

This is possible but with some caveats. If you are using the BYOL licensing system and have an existing license key active on your Access Server, it is not possible to change the licensed amount on the existing license key. But what you can do is purchase an additional license key and activate it on the same Access Server. The licensing system will then simply add them up. For example, if you have a license key that unlocks 10 connections installed on your Access Server and find that you need 30 in total, you can purchase a license key for 20 connections and activate it on that same Access Server. The license key for 10 connections and the license key for 20 connections then are both active and are added up to a total of 30 connections. The caveat here is that the license start date and end date of the newly purchased license key will be different for these two license keys. However when you renew license keys on our website you do have the option to select both license keys and set a single future date for both of them. The renewal system calculates and adjusts the costs automatically in such a case.

If you are using the Amazon AWS tiered instances licensing system then things are unfortunately not quite so easy, but still possible. Due to the way the licensing system works on Amazon AWS, the instance properties are very firmly tied to the amount of licensed connections. At this time you cannot click a button to switch from a 10 connected devices instance to a 25 connected devices instance. The solution here is to make a backup of the your existing AWS instance's OpenVPN Access Server configuration databases, and bring up a new instance with the desired amount of connected devices, and restore the backup of the configuration to that system. There are some caveats. If the old system was configured to function on IP basis instead of an FQDN DNS address, then clients that were installed on the old Access Server instance will continue to attempt to reach the old IP address. If possible, move the IP address to the new instance so that clients can find the server again. But the best option is always to set up an FQDN DNS address, which we recommend for any Access Server installation. With that, you can simply update the DNS record to point it to the IP address of the new instance, and clients will then automatically find the correct instance. And finally of course, the old instance should be stopped to avoid continuing to incur costs on the old instance.

Where can I find the free 2 user license key?

That system has been cancelled. In the past, years ago, Access Server would not allow any connections at all if you didn't have a license key. We would then issue free 2 user license keys for trial purposes upon request. We have cancelled that system and instead when you install the OpenVPN Access Server product now, and do not provide a license key, it will automatically allow 2 simultaneous VPN tunnel connections. Therefore you do not need to contact us anymore to try the product out. You will very easily be able to confirm that your Access Server allows 2 simultaneous connections by logging in to the Admin UI and looking on the right hand side at how many connections your server is licensed for. It will say 2, unless you have activated a license key to change that amount.

Why can I only make 2 connections with my AWS tiered instance?

If you encounter the problem where an OpenVPN Access Server with x amount of connected devices is showing you that your server is only licensed for 2 connections, while you launched an instance for 10 connected devices, or any of the instances that should come licensed for the chosen amount, but it won't allow more than 2 connections, then the most likely explanation here is that you are using a security group on this instance that is blocking access to the licensing servers. If that happens the OpenVPN Access Server cannot check to see if you are licensed and will fall back to its automatic built-in demonstration mode which allows all functionality without time limit, but allows only 2 simultaneous VPN connections. For more information see the troubleshooting page regarding Amazon AWS tiered instance software licensing.

How long do license keys last, do they ever expire?

Yes, they do expire. When you purchase a license key for the BYOL licensing system you purchase it for a certain amount of time. The choices are 1, 2, 3, 4, or 5 years. At the end of that time, when the license key reaches it end date and expires, it will disappear off your server automatically. If the last license key on your Access Server expires, it reverts back to its demonstration mode where only 2 simultaneous connections are allowed. A few weeks before the license key expires, you will receive emails from our automated licensing system on the email address of your account on our main website where license keys can be purchased, to remind you that the key is about to expire, and to ask that you renew it.

If you have in the past purchased a perpetual license key, then read the section below if you are having a problem with such a license key.

My perpetual license key doesn't work anymore?

Years ago, with Access Server version 1.8.4 and older, we sold what were labeled perpetual license keys. The conditions with these keys were the same as they are now with one exception; when the expiration date was reached, the license key would not disappear off the server by itself. It would instead remain activated as long as the server was not altered. When Access Server 1.8.5 was released, we have introduced a new licensing system and stopped selling these type of license keys. License keys sold now will disappear off the server when the expiration date is reached. But we still honor the old perpetual license keys under the conditions they were sold under.

If you have upgraded your older OpenVPN Access Server program to a modern version and your perpetual license key has disappeared, then downgrade your OpenVPN Access Server program back to 1.8.4 or older. That type of license key only works on the older versions of OpenVPN Access Server. If during your upgrade you didn't only upgrade the OpenVPN Access Server installation package, but instead did an installation on a new operating system or new server, or otherwise changed the hardware/software properties of the system that the license key was originally activated on, and your license key is expired, then your license key is lost and we point out the paragraph below which applied in the past just as it does now:

All license keys sold for OpenVPN Access Server are single-activation and lock to the hardware and software properties that you installed the license key on. If you want to move your license key to another installation, this is only ever possible when the license key is not expired. We only provide support on license keys if the license key is not expired. This was the case in the past, and still is the case now. So if you come to us with a request to move a license key from one Access Server to another, and the license key is expired, we cannot help you. If the license key is not expired, we will gladly help you to move the license key.

My license key suddenly stopped working, why?

If you're using the Amazon AWS tiered instances instead of using separately purchased and activated license keys then check the troubleshooting page regarding Amazon AWS tiered instance software licensing. In short if this licensing model doesn't work the problem is likely caused by a security group blocking access to the licensing systems.

If you are using license keys that you have purchased from our openvpn.net website and they have suddenly stopped functioning then check the troubleshooting page regarding OpenVPN Access Server license key issues. In short if your license key used to work before but now suddenly doesn't, the license key is either expired or something has altered the hardware/software significantly enough to make the licensing system believe it is now running on a different system, and the license key is not valid for the new configuration.

Is less than 10 connections on a license key possible?

Yes and no. To clarify, 10 connections on a license key is the minimum for the BYOL licensing system. It's important to note here that any value higher is possible, but lower is not. For example you can buy a license key licensed for 11 connections, or 35, or 524, and so on. But a value lower than 10 on an OpenVPN Access Server BYOL type license key is never possible. So if you intend to buy a license key for 10 connections and then ask us to split it up into 2 license keys of 5 connections each, that is not possible.

However, on Amazon AWS it is possible to use the Amazon AWS tiered instances licensing system and one of the instances we offer on the AWS Marketplace is available for 5 connections. It also comes with a 7 day free trial giving you the option to try the product out before paying software licensing costs. Please note that on Amazon AWS costs do apply for running an AWS instance.

If I buy one license, can I use it on multiple servers?

No, a license key is a single-activation key that locks to just one system. You can't share it between servers. So if you want to run 3 servers, each server will need its own license key. If however you have just purchased a license key and it's still unactivated, and you've just now realized you need separate keys, and need too split this license key up so each server can have its own license key, then this is possible under certain conditions. The minimum size of a single license key must contain 10 licenses. So if you purchase a single license key for 30 connections, and you want to have it split up, you can create a maximum of 3 license keys of 10 connections each. We normally only consider requests to split license keys up if the license key has not already been used for activating an Access Server. To request your license key to be split up contact us on the support ticket system.

Can I split up my license key into smaller ones?

If you need to split a license key up into smaller license keys, this is possible under certain conditions. The minimum size of a single license key must contain 10 licenses. So if you purchase a single license key for 30 connections, and you want to have it split up, you can create a maximum of 3 license keys of 10 connections each. We normally only consider requests to split license keys up if the license key has not already been used for activating an Access Server. To request your license key to be split up contact us on the support ticket system.

What is a license key reissue?

This is where we take an existing already activated license key, and remove it from our system (revoke it) and replace it with a new license key that can be activated on an OpenVPN Access Server installation. We call this a license key reissue, and it is to help people move a license from one server to another, or to resolve a problem that can occur when the hardware/software combination a license key has been activated on, has been altered. For example when you reinstall your server or when you replace hardware on a server (new mainboard, new network card, that sort of thing).

If you are using license keys that you have purchased from our openvpn.net website and they have suddenly stopped functioning then check the troubleshooting page regarding OpenVPN Access Server license key issues. In short if your license key used to work before but now suddenly doesn't, the license key is either expired or something has altered the hardware/software significantly enough to make the licensing system believe it is now running on a different system, and the license key is not valid for the new configuration.

We are only able to process license key reissue requests for the license keys that are valid, and not expired.

When a license key reissue is requested, we revoke the old key and issue a new one. The old key will function for up to 2 weeks, giving you time to migrate your settings and test your setup if you are currently working on migrating your installation from an old server to a new server. If after that 2 week period the old key is left on the old server installation and is still functioning, you could eventually get the problem where either the old or the new key ceases to function abruptly. So ensure that at the end of that 2 week period you have either decommissioned the old server, or removed the license key file from the file system of the old server, if you wish to keep the old server on.

What is the license replacement program?

It refers to the same thing as the license key reissue mentioned in the section just above.

May I resell license keys?

There is currently no restriction on this, although the customer is of course easily able to see the pricing information on our website just as well as you can, so there may not be much of an advantage to reselling. We do not have a special reselling program. Anyone is welcome to purchase license keys for the OpenVPN Access Server product either for themselves or another party, as long as payment is done and the license agreement terms for purchasing a license key are agreed to.

I bought a key for my customer, but he didn't pay me. Refund me?

We're sorry but we are unable to offer refunds or assistance with recovery of assets based on personal or civil matters. For this reason, if you choose to resell license keys, you are encouraged to secure payment before purchasing the product on your own personal funds. If however the license key is still unactivated, you can simply apply for a license key refund. If it is activated, then it is considered used and not eligible for refunds.

What is your refund policy on license keys?

We offer refunds on any purchased license key that has not been activated on a server and is still valid (not expired). To do so, please contact us on our support ticket system and mention that you want to request a refund, and mention the unused license key, the primary holder's email address and primary holder's contact name, as well as the order number associated with the license key. Upon validation of your information, we will then proceed with making a refund to the original method of purchase and revoke the license key in question.

Refunds are not given for used licenses, or licenses already activated on a server! This is because we assume that you are fully satisfied with the product before purchasing and applying the license key to the server. For this reason, you are highly encouraged to thoroughly test out the software using the fully functional demonstration mode that it automatically goes into when you do not install a license key, and which allows 2 simultaneous OpenVPN tunnel connections, before deciding to permanently purchase and activate a license key on your servers. If the 2 connections in the demonstration mode are not enough you can put in a request for a temporary trial key for more connections.

Can I clone/image/copy my Access Server installation without affecting the activation state of my license key?

No, license keys are single activation keys that lock to the hardware/software combination and cannot be moved to another system. If this action has already occurred and your license key is now not working anymore, then your only recourse is to contact us for a license key reissue, assuming that your license key is valid and not expired. We can then provide you with a new key that you can use to use your license again.

We would like to point out however that if you are deploying your system on Amazon AWS and you are looking to use autoscaling or you wish to rebuild your instance regularly for security regulatory purposes, then you can instead make use of the Amazon tiered instances on the Amazon Marketplace. These are launched through Amazon's systems and are billed directly through Amazon's systems as well, and these can be moved, copied, and reinstalled, just fine, as they will just pick up their licensed state from Amazon's systems and you will be billed for each instance that you actively have running.

Does license activation require Internet access?

Yes, our activation system relies on being able to contact licensing.openvpn.net at port TCP 443 in order to complete activation. However if your system is installed somewhere where Internet access is not possible or not allowed, then it is possible to do an offline activation. This can be done by us when you contact us and request an offline activation and provide us with the necessary hardware activation file, or you can do it yourself using a second Access Server installation that does have access to the Internet, and which can be provided with the necessary hardware activation file, after which the resulting activated key file can be stored on the file system of the Access Server. We intend to provide a guide on how to do this here on the website (UNFINISHED MARKER)

I cannot do an online purchase, can I do it offline?

Yes, we currently accept bank transfers/wires for license key orders of a minimum of 100 connections. We cannot accept orders smaller than this amount at this time due to the heavy transactional costs associated with an offline order. For more information about offline license purchasing options, please contact sales@openvpn.net directly.

Common errors during activation, and their meaning:

Fault 9000: 'twisted.internet.error.TimeoutError: User timeout caused connection failure.

In most cases this problem is caused by an inability of the OpenVPN Access Server installation to reach the Internet for an online activation. Please verify that Internet access is possible from this Access Server and that the DNS settings are correct. Verify on the command line that you can ping and reach Internet addresses from the operating system that the OpenVPN Access Server is installed on. Check that any firewalls or security groups are not blocking access. If your system is intentionally cut off from the Internet or if it is not possible to resolve this problem, request or perform an offline activation. In rare cases this error can also show up if the license key has already been used before for activation - all license keys are single-activation keys only. In such a case request a license key reissue.

Fault 9000: "twisted.internet.error.DNSLookupError: DNS lookup failed: address 'licensing.openvpn.net' not found: [Errno -2] Name or service not known." What's wrong?

This error is almost always due to a DNS resolver misconfiguration or a country-related block on your DNS servers. Please verify that Internet access is possible from this Access Server and that the DNS settings are correct. Verify on the command line that you can ping and reach Internet addresses from the operating system that the OpenVPN Access Server is installed on. Check that any firewalls or security groups are not blocking access. If your system is intentionally cut off from the Internet or if it is not possible to resolve this problem, request or perform an offline activation.

Do you offer discounts on large purchases of license keys?

We currently do not have any discount program available to the general public for bulk discounts. However, feel free to discuss your needs with some detail as to how many licenses you need with our sales team at sales@openvpn.net and someone will get in touch with you regarding your request.

Do you offer discounts at all?

Yes, on Amazon AWS for example with the Amazon licensing model it's possible to choose an annual payment model which offers 20% discount compared to hourly payment. And with the BYOL licensing system if you purchase for longer than a year, you get a discount as well. There are different discounts for 2, 3, 4, and 5 years.

Can I submit tickets even I am not the holder of a license key?

If for example you work for a company that does have license keys, but you have your own account and do not have a license key on your account, then you still have the right to support. If you provide the following information when you contact us on the support ticket system, then we'll give you support as if you were the holder of the license key. We require the following information from non-primary license holders to ensure that these individuals are in fact authorized to make changes to the account, as well as to protect the privacy of our valued customers.

  • The valid license key
  • Order ID # for the license key.
  • License holder name or email address.

If you do not have a license key at all, and you do not work for an organization that has a license key, then you can still contact us. We do want to help prospective customers to get things configured while they are trialing the software of course, but we do reserve the right to withhold certain support to users that are not actually paying customers of our OpenVPN Access Server product.

My colleague left, I need to transfer keys to my account.

When this happens you should do the following:

  • Register a new free account on openvpn.net
  • Contact us with the details of the license key / order ID
  • Request to have the keys transferred to your account

We will then verify the information you have given us, and transfer the keys. A transfer of a license key from one account to another does not affect your currently installed and activated Access Server installation at all. This is purely an administrative change here in our licensing system, and does not in any way touch the activation state of your Access Server.

I purchased some licenses on your website and would like instructions on how to connect to your VPN service. Can you provide me with these instructions?

OpenVPN Access Server is a piece of software that you install on your own server, which then provides VPN services to your clients. The licenses you have bought are designed to lift the restrictions on the concurrent connection counts for users connecting to your server. If you do not already own a server in which you can install Access Server on, the licenses themselves will not grant you access to any VPN services. If this was not your intention, and you have not yet activated the licenses you have bought, please submit a refund request on our ticketing system, and look at our Private Tunnel offering instead.

Q24: I would like to run a failover setup for my Access Server. Do I have to pay extra for a failover license key?

A24: No, a failover license key is issued free of charge upon request for users using our integrated failover functionality. Third party failover solutions are not covered under this provision and license keys will have to be purchased on our website to cover these solutions. To request a failover license key, please submit a ticket on our ticketing system (note that existing keys cannot be applied to failover servers.)

Q25: I would like to have a load balanced setup, does my current license key cover all of these servers?

A25: No, because load balanced servers allow more concurrent users to be connected at the same time, each load balanced server is licensed individually. For example, if you want each load balanced server in your pool to handle 25 concurrent connections, and you have 4 of these servers in the pool, then you would need 4 x 25 = 100 concurrent licenses total.

Q26: What is the process of migrating licenses from one machine to another, or for OS reinstallation / hardware reconfigurations?

A26: In order to transfer licenses from one system configuration to another, your license keys must have an active support/upgrade period. This period is listed under your license area on our website. Then, prior to your system reconfiguration, submit a ticket on our ticketing system requesting that your old license key to be deactivated and a new one be reissued to you. You will have approximately 1 week to complete the system reconfiguration before the old license key will stop working on your system. For license keys outside of their support/upgrade periods, new license keys will have to be purchased for such reconfigurations, as you are no longer entitled to our license replacement program.