Dedicated VPN Server on OPNsense with different access for different groups.
CA: System -> Trust -> Authorities -> Add -> Name WPN01-CA or similar -> Create Internal -> Key length = 4096 -> Algorithm -> SHA256 -> Lifetime = 3650 -> set locality info -> leave common name default
System -> Trust -> Certificates -> Add -> Create Internal -> Name: OpenVPN Server Certificate -> Type: Server Certificate -> Key length 4096 -> Algorithm SHA256 -> Lifetime 3650 -> common name = fqdn such as wpn01.domainname.com
System -> Trust -> Revocation -> + next to the CA name -> Name: WPN01-CA Certificate Revocation List -> Save
Enable 2FA for OpenVPN Clients
System -> Access -> Servers -> Add server -> Descriptive Name: TOTP Server -> Type: Local + Timebased One Time Password -> Token length: 6 -> Check the box to reverse token order -> Save
</code>
Description: Use something like below if using several groups or just pick 1 if using a single groups.
CompanyName Employee Remote Access RDP CompanyName Vendor Remote Access Single Server CompanyName Employee Remote Access Full CompanyName Vendor Remote Access Full CompanyName IT Remote Access Full
Server Mode: Remote Access (SSL/TLS + User Auth) Backend for authentication: TOTP Server Local Port: pick an unused non-standard UDP port; this must be different for each OpenVPN server instance TLS Authentication: Enabled - Authentication & encryption Peer Certificate Revocation List: Select previously created certificate Server Certificate: OpenVPN Server Certificate Encryption algorithm: AES-256-GCM (Depreciated, only used by older clients) Auth Digest Algorithm: SHA256 IPv4 Tunnel Network: this is the IPs assigned to your road warrior VPN clients, it should be different from any of the subnets at the office and different from most home network subnets: eg. 10.99.100.0/24 IPv4 Local Network: this is the subnet your remote roadwarriors need to connect to, using the main subnet of your office, you can put multiple subnets here if needed and proper routing is in place: eg. 10.4.1.0/24 Compression: No Preference DNS Default Domain: use this only if you have an AD domain or equivalent on the office network eg. abc.companydomain.com DNS Servers: use this if you want VPN clients to resolve hostnames/computer names instead of using IPs only and you have AD DNS servers. Don't use if you're only giving access to a single server/computer that has a static IP. The DNS Servers should be your AD DNS server IPs. Force DNS cache update: Enable only if you're using DNS Servers Verbosity level: 3 Save
Username: vpn.employee.name or vpn.vendor.name Password: use something simple since they'll need to type it in with the TOTP key Fullname: same as Username Comment: VPN Account. VPN Server Used. Notes if Needed. Created by NAME on DATE. OTP seed: check the box at "Generate new secret"
Method: Create an internal Certificate Key length: 4096 Digest Algorithm: SHA256 Lifetime: 825 (this is when the user certificate expires in days) Save then Save again.
Note: when using a password on the OVPN connection, when in Linux, enter the username in the connection profile and save, and for password set “password is not required”, then it will prompt you for the password each time.
Action: Pass Interface: LAN Direction: In TCP/IP Version: IPv4 Protocol: UDP Destination port: port of OpenVPN server or port range of OpenVPN servers eg. 5175 Description: OpenVPN Server(s) Save -> Apply Changes
Action: Block Description: Block OpenVPN clients by default Save -> Apply Changes
Action: Pass Source: Single host or Network: Subnet assigned to OpenVPN clients of a particular group Destination: Single host or Network: Subnet of Office LAN that remote clients need access to Description: Name of Open VPN Server Instance eg. CompanyName Employee Remote Access Full Save -> Apply Changes
Make sure the overall “Block” rule is always at the bottom of the firewall list, or verify explicit allow rules are processed first.
Since this is a standalone VPN server for internal resources there is no need to use NAT, turning it off will also allow you to to filter IP traffic based on the IP of the VPN client in your other non-OPNSense firewalls.
Firewall -> NAT -> Outbound -> Disable outbound NAT rule generation (outbound NAT is disabled)
Remote Access Server: Choose the server with the permissions you want for this particular client Export Type: File Only Host Name: the public FQDN that points to your public WAN IP or your just your public WAN IP Click on the download icon next the other user you want.
Import your OVPN config file into Tunnelier on MacOS or OpenVPN client on Windows, or if using Linux the network manager, but in linux as of 03-27-2020 the “key direction” stays at 0 and should be set to 1 for the connection to work.
NOTE!!!! When prompted for the password on connecting to the VPN, put in the username then the password and TOTP code together on the password line. So username and passwordTOTPCODE.
Record the info in such a format:
WPN01.domainname.com Role: VPN server for road warriors OS: OPNsense x64 Location: Virtual Guest IP: ###.###.###.15 User/Pass: root | ############# Ports: ###6-###0 UDP ###6: CompanyName Employee Remote Access RDP 10.11.6.0/24 ###7: CompanyName Vendor Remote Access ERA Server 10.11.7.0/24 ###8: CompanyName Employee Remote Access Full 10.11.8.0/24 ###9: CompanyName Vendor Remote Full Access 10.11.9.0/24 ###0: CompanyName IT Access Full 10.11.10.0/24
Extra Note: For Linux users that use Network Manager, if you store the password in the Network Manager profile and leave it encrypted, it will prompt for the root password before prompting for the VPN password. To fix this, you'll need to choose unencrypted, but the profile where the VPN password is stored is still restricted to the root user, so if you did have other users on the same computer, as long as they don't have sudo or su or root, you'll be okay…