Create the VPN
Before you start
Sign in to the TSDATA Cloud console with an account allowed to manage the network. Identify the private network you want to access over VPN and its public Source NAT IP address.
This procedure uses Remote Access VPN to connect your computer to the environment. If the option is unavailable, contact the responsible team to check VPN support and your account permissions.
1. Select the Source NAT IP
- In the console menu, go to Network → Public IP Addresses.
- Locate the IP identified as Source NAT for the network you want to access over VPN.
- Open the IP details and confirm it belongs to the correct network.
- Open the VPN tab.
Choose the correct network
If your environment has multiple networks, check the Source NAT IP association before enabling the VPN. This will be the connection endpoint for the selected environment.
2. Enable remote access VPN
On the VPN tab, click Enable Remote Access VPN.
During creation, you can specify the VPN IP range. This pool assigns addresses to VPN connections; it is not the list of machines you want to access.
- Enter the start and end addresses in the format requested by the console.
- Choose a range that does not overlap with environment networks or the local networks of connecting computers.
- If unsure which range to use, confirm the address plan with the responsible team before proceeding.
CloudStack reserves the first IP in the range for the VPN server. This behavior is documented in the Remote Access VPN creation reference.
Confirm the operation and wait for creation to complete.
3. Retrieve the connection details
After creating the VPN, check the details displayed on the VPN tab:
| Detail | Connection usage |
|---|---|
| Connection IP | Public VPN server address to enter in the client. |
| Shared secret / Pre-shared key | IPsec key, also called the PSK. |
Keep these details for client configuration. The shared secret is different from the VPN user's password.
4. Add a VPN user
- Open Manage VPN Users.
- Choose the option to add a VPN user.
- Set a username and password for the connection.
- Save and confirm the user appears in the VPN user list.
These credentials are used by the VPN client. VPN user registration is separate from cloud console sign-in.
Store credentials securely
Keep the password and shared secret in a secure location. Do not include them in screenshots, support tickets or public documentation.
5. Configure the client with the new details
You now have the four details needed to connect:
| Source in CloudStack | Windows client field |
|---|---|
| VPN connection IP | Server name or address. |
| VPN shared secret | Pre-shared key. |
| User created in Manage VPN Users | User name. |
| Password set for the VPN user | Password. |
In Windows, select L2TP/IPsec with pre-shared key as the VPN type and User name and password as the sign-in information type.
Follow the VPN on Windows guide to create the connection, adjust security and IPv4 settings and verify access to a private resource. Also have the destination subnet and private resource address ready: access depends on the environment's routes and network rules.