AZTCOFW / DOCUMENTATION
Authenticating OpenVPN Users with RADIUS via Active Direc- tory
Configuration guides, troubleshooting and practical advice for AZTCOFW.
Articles
19 resultsChange the cryptoapicert SUBJ
Open C:\Program Files\OpenVPN\config\config.ovpn or C:\Program Files(x86)\ OpenVPN\config\config.ovpn and change the line that says cryptoapicert “SUBJ:” to cryptoapicert “SUBJ:username” . . . replace usern
Change the name of the .ovpn file
When connecting to the firewall OpenVPN shows a balloon announcing that the VPN is up. It contains a rather cryptic Windows Installer name, but that can be changed to something more appropriate by renaming the .ovpn file
Configure the firewall
Go to Firewall > Rules , WAN tab and click + to create a new rule. Enter these values: Action Pass Disabled not checked Interface WAN Protocol UDP Source unchecked, any Destination unchecked, WAN address Destination port
Create a Certificate
A certificate must be created for each user that is going to use the VPN system. In Descriptive and Common Name , enter the username the user uses to log on to Active Directory. Strictly speaking Descriptive name can be
Create a group VPNusers
Create a security group in Active Directory Users and Computers called VPNusers . Everyone could have access but it’s a good idea to keep some granular control over it. Add all accounts that need to use the VPN system to
Create an internal certificate
Go to System > Cert Manager , Certificates tab and click+ . Enter these values: Method Create an internal Certificate Descriptive name vpn-testdomain-network Certificate Authority TestDomain VPN CA Key length 2048 Certif
Edit more settings
More information on automation, customization and registry tweaks are available in this text document: http://openvpn.se/install.txt Troubleshooting If something doesn’t work, here are some pointers for troubleshooting:
Edit the shortcut to connect directly
The shortcut to OpenVPN GUI can be edited to directly connect to a firewall instead of first starting OpenVPN and then starting the connection by right-clicking the shortcut and adding to the Target field: –connect “Head
Install a Certificate Authority
Go to System > Cert Manager , CAs tab and click +. Enter these values: Descriptive name TestDomain VPN CA Method Create an internal Certificate Authority Key length 2048 Lifetime 3650 days Ten years should be enough for
Install and configure RADIUS
If RADIUS isn’t already set up, add the role to the Domain Controller. If it is set up, skip this step. Open Server Manager and click the Roles node in the tree on the left. On the right side, click Add Roles . This will
Install the OpenVPN Client Export Package
Go to System > Packages , Available Packages tab. Scroll down to OpenVPN Client Export Package and click on the right. Confirm the selection and the package will be installed. When it says Installation completed the inst
install the OpenVPN package
Copy the downloaded Windows Installed to the client. It is named after the tunnel configuration, for example router- udp-1194-install.exe . Run the installer with all defaults. When selecting components, make sure they a
On security and a disclaimer
I am not a security expert. However the method described in this article is they way it should be: Two-factor authentication: something the user has (the installed certificate) and something the user knows (AD user accou
Prepare the Windows package
Go to VPN > OpenVPN and note that there is an extra tab called Client Export . Click it. Enter these values: Remote Access Server VPN with RADIUS UDP:1194 Host Name Resolution If WAN has a static IP, enter Interface IP A
Set up the Authentication Server
In the AZTCO-FW webGUI, go to System > User Manager , on the Servers tab. Click on the right. Enter these values: Descriptive name RADIUS Type Radius Hostname or IP address 192.168.77.15 Shared Secret Paste the shared se
Set up the OpenVPN server
Go to VPN > OpenVPN , Servers tab and click+ . Enter these values: Server Mode: Remote Access ( SSL/TLS User Auth) Backend for authentication RADIUS Protocol UDP Device Mode tun Interface WAN Local port 1194 Description
Thanks
Thanks to the AZTCO-FW forum, in particular to user unguzov, who wrote a shorter version of this recipe. I adapted his version and added screenshots. Thanks to Evan Jensen for providing some English version screenshots.
Using the Windows client
Set the Windows Client to run as Administrator. To use the client, double click the OpenVPN GUI icon on the Desktop Windows will ask to confirm the execution. Confirm. OpenVPN will start but that’s not enough. Right-clic
Versions
AZTCO-FW software version 2.x Active Directory on Windows Server 2008 R2 – I’m using a Forest Functional Level of 2008 R2 but I don’t think that’s really a prerequisite. If it doesn’t work, user account passwords may nee