AXS One VPN Server ¶

Introduction¶

About AXS One¶

AXS One is a next-generation secure access solution built upon the high-performance WireGuard architecture. Unlike traditional VPNs that provide broad, perimeter-based network entry, AXS One adopts a Zero Trust Network Access (ZTNA) model, operating on the principle of "never trust, always verify".

By leveraging an encrypted WireGuard-based peer-to-peer overlay, client connectivity is not only lightning-fast but also context-aware. Beyond strong authentication, AXS One also integrates rigorous security posture checks to ensure that every connecting endpoint meets specific corporate security standards, such as required OS versions or the presence of active antivirus and EDR agents.

Context-Sensitive Help¶

This document provides system administrators and IT professionals with the procedures required to configure the AXS One VPN server. To assist with the configuration process, context-sensitive help is available directly within the interface; simply click the blue i icon located next to any configuration field for detailed descriptions and requirements.

Requirements¶

Internet Reachability¶

The AXS One VPN server must be reachable from the public Internet to allow remote peers to establish a tunnel. This requires that the server is accessible via a routable public IP address.

Public DNS Record¶

To allow users to connect to your AXS One VPN server, you need a public DNS record (A record) that points to the server's public IP address. Refer to your DNS provider's documentation for specific instructions on creating an A record.

Server Certificate¶

The domain name of the AXS One VPN server must be secured by a valid certificate signed by a recognized commercial Certificate Authority (CA). Please note that the AXS One VPN client will, by default, reject self-signed certificates or those issued by an untrusted CA.

Pre-Configuration¶

Feature Activation¶

1. Log in to your AXS Guard appliance.
2. Navigate to Feature Activation > VPN.

3. Enable the AXS One VPN feature and update your configuration.

   

Certificate Import¶

1. Navigate to PKI > Certificates.
2. Click on the Import button to import your server certificate.

3. Enter the required information and click on the Save button.

   

Server Configuration¶

Connection Settings¶

1. Navigate to VPN > AXS One VPN > Server.
2. Enable the AXS One VPN Server.

3. Use the default connection settings, as shown in the example below.

   

Push-to-Client Configuration¶

1. Select the Push-to-Client configuration tab.
2. Adjust the settings to fit your needs.

3. Proceed to the next tab.

   

Local Access Server¶

1. Select the Local Access Server tab.
2. Enter the hostname that matches your server certificate and public DNS record.
3. Select the server certificate that you previously imported.
4. Specify the connection port for the access server. TCP port 443 is the recommended default.

5. Save your configuration.

   

Granting VPN Access¶

User access to AXS One is not granted by default; system administrators must explicitly enable access for each user or group.

Group-level Access¶

1. Navigate to Users & Groups > Groups.
2. Select the appropriate group.
3. Select the VPN tab and enable the AXS One VPN option.

4. Update your configuration.

   

User-level Access¶

1. Navigate to Users & Groups > Users.
2. Select the appropriate user.
3. Select the VPN tab and set the AXS One VPN option to on (select group configuration if the user's group already has access).

4. Update your configuration.

   

Firewall & Application Control¶

In a secure VPN architecture, firewall and application control policies serve as crucial mechanisms for enforcing the Principle of Least Privilege (PoLP). Rather than granting broad network access, these controls restrict remote users to the specific IP addresses, ports, services and verified applications that are essential to their roles. System administrators should implement appropriate firewall and application control policies to eliminate unnecessary lateral movement and reduce the attack surface. This allows potential threats to be contained within a narrow, monitored channel should an incident arise.

Group-level Settings¶

1. Navigate to Users & Groups > Groups.
2. Select the appropriate group.
3. Select the VPN tab to add the appropriate firewall and application control policies.

4. Update your configuration.

   

User-level Settings¶

1. Navigate to Users & Groups > Users.
2. Select the appropriate user.
3. Select the VPN tab to configure user-specific firewall and application control policies (for example, to override the user's default group policies when custom access is required).

4. Update your configuration.

   

User Authentication Policy¶

1. Navigate to Authentication > Services.
2. Click on the AXS One VPN service.
3. Configure the appropriate authentication policy (2FA is highly recommended).

4. Update your configuration.

   

System Status¶

From the Services page, system administrators can verify the health of individual AXS One VPN server components and use the Restart action for troubleshooting or maintenance.

1. Navigate to System > Status > Services.

2. Search for axsone.

   

Client Information¶

Connection History¶

The clients page provides a high-level overview of active and past user sessions. It logs the machine name, username, and both internal and external IP addresses, alongside a timestamp for the last connection event.

1. Navigate to VPN > AXS One VPN > Clients.

   

2. Click on a machine name to view its connection history.

   

Client Status¶

The client status page provides real-time monitoring of active sessions, specifically highlighting the status column to confirm successful connectivity. A green connected status indicates an active, healthy link between the client and the server.

1. Navigate to VPN > AXS One VPN > Client Status.

2. Click on a machine name to view its connection history.

   

Authentication Status¶

The authentication status page allows administrators to view all active users and log them out remotely.

1. Navigate to Authentication > Status > Authenticated Users > Firewall, Proxy & VPN.

2. Click on the logout link to log out a user.

   

Server Logs¶

1. Navigate to VPN > AXS One VPN > Logs.

2. Select the desired log type.

   

3. Click on the appropriate date to inspect the logs.

   

Gateway Server¶

The Gateway Server is a specialized AXS One client running on the appliance, configured as an Exit Node. While it functions as a client, it is the central hub allowed to connect to all other clients. These logs document the connection setup phase specifically for this node. They are the primary tool for verifying if external clients are successfully establishing a path to the Exit Node.

Management Server¶

The Management Server acts as the Control Plane and Authorization Engine. It does not perform authentication (that is handled by the Authentication Server), but it dictates Authorization: telling clients which peers they are allowed to see, providing their WireGuard configurations, and managing network policies.

Audit Events¶

The audit event logs provide a high-fidelity, JSON-structured record of every significant administrative and state change. While Management logs show background processes, audit logs focus on the "Who, What, and When" for security monitoring.

Authentication Server¶

Powered by Zitadel, this is the Identity Provider (IdP). These logs focus strictly on the Identity Layer—ensuring that the user or machine is who they claim to be before the Management server grants them access.

TURN & STUN Server¶

The TURN server acts as a relay for traffic when firewalls prevent a direct connection. Critically, it also provides STUN (Session Traversal Utilities for NAT) services, allowing clients to discover their own public-facing IP addresses to facilitate direct connections.

Signal Server¶

The Signal Server is the "matchmaker." It uses WebSockets to help peers exchange connection metadata (IPs and ICE candidates). While it identifies peers by their keys to route signals, it does not manage WireGuard keys (that is the Management Server's job).

Support¶

If you encounter a problem¶

If you encounter any issues with AXS One VPN, don't hesitate to reach out to our technical support department.

Contact Information¶

(+32) 15-504-400
support@axsguard.com