MFA for OPNsense
OPNsense is the open-source firewall from Deciso, and its built-in OpenVPN server is how many teams give staff remote access. OPNsense can check OpenVPN and web GUI logins against a RADIUS server, but it has no second factor of its own for external users. Authnull becomes that RADIUS server and requires MFA on OpenVPN logins and firewall administration. You add Authnull as an access server, select it on the OpenVPN instance, and users must approve a factor before the tunnel comes up.
OPNsense forwards the login; Authnull adds the factor.
OPNsense sends the login to Authnull over RADIUS. Authnull checks the password against your directory, asks for the factor, and returns Access-Accept. Set the RADIUS timeout to 60 seconds so users have time to approve.
Configure MFA for OPNsense
Real steps — the exact menus, fields, and values. Follow along in your console; the whole thing takes about 15 minutes.
Add Authnull as an access server
Create a new server of type RADIUS with the Authnull connector IP, the shared secret, PAP as the protocol, port 1812 and a 60-second timeout.
Check the server responds
Use the built-in tester to send a login to Authnull and confirm you get the MFA challenge and a successful result.
Select it on the OpenVPN server
Edit your OpenVPN server instance and set its authentication to the Authnull RADIUS server.
Optional: protect the web GUI
Set Authnull as the authentication server for the web GUI so firewall admins are challenged too. Keep a local admin account as a fallback.
Test the connection
Connect with the OpenVPN client using a test account, approve the factor, and confirm the login in the Authnull logs.
Closes the MFA gap auditors look for
Enforcing MFA on OPNsense gives you evidence for the remote-access and privileged-access controls in SOC 2 and the access requirements under CCPA — with per-login logs you can hand straight to an assessor.
Add MFA to OPNsense — free to start.
Spin up Authnull, point OPNsense at it, and enforce a factor on a pilot group today. No card, no rip-and-replace.