OPNSense + OpenVPN with two factor authentication and an Android Client

I recently tried to set up a two factor (user/pass and certificate) VPN connection using some tutorials from the Internet. Unfortunately these tutorials are no longer up-to-date, so I would like to describe here how it works! In using OPNSense v20.8.

First we need a certification authority for our own certificates, which we will create. To do this, log in to OPNSense and click on “System –> Trust –> Authorities“. Now click on the “Add” in the upper right corner and we can create a new certificate authority!

Let’s add the following:

Well done! With our own certification authority we can now issue certificates! You should now see something similar on the screen:

Then we let our new certification authority issue a certificate for our server right away! Via “System–>Trust–>Certificates” you should already see a certificate; the one for the WebGUI. Now click on “Add” to add a new one…

Perfect…. now we need to add a lot of data to generate our server certificate:

After saving, it should look like this:

Ok perfect. Now let’s add an user to OPNSense for VPN use. Go to “System–>Access->Users” and click “Add” in the upper right corner. This is a two-step process, so read carefully!

After clicking “Save“, a new prompt appears:

After changing the method to “Create an internal Certificate“, we need to add some data:

After saving, you come back to the first prompt. Now you’ll find the new certificate in “User Certificates”:

On the bottom click “Save and go back” and you’ll see all users again including “Manni”.

We’re half way through! Grab a coffee or/and some candy and move on installing the SSL server!

Go to “VPN–>OpenVPN–>Servers” and click “Add” in the top right corner.

Leave default settings except of:

After clicking “Save” you’ll see your server is up and running:

At this point we need to configure the firewall…

1. to allow incoming traffic on port 1194 from the WAN interface
2. the local network can be reached from the new subnet

Ok, ok.. the last step: exporting the configuration!

Go to “VPN–>OpenVPN–>Client Export” and select the newly created VPN Server from the list.

You should also see two certificates on the bottom of the page which can be exported. Choose the “Manni” certificate and click the download button on the right.

You’ll get and *.ovpn file. Just import this in any OpenVPN App on your Android phone and you’re good to go! You can now connect to the OPNSense appliance with “Manni’s” username and password!