VPN and Wi-Fi through RADIUS

In this tutorial, we connect the VPN, firewall or Wi-Fi to the service through RADIUS. People sign in with their email and password, and confirm with a code or an approval on their phone. In the console, open Manage, RADIUS clients. Each device is a client. If you don't see this item, ask your provider to turn on RADIUS. Choose Add client and give it a name you'll recognise, for example VPN Lisboa.

Choose the transport: RadSec, over TLS, is recommended across the internet; classic UDP identifies the device by its source address, and should only be used from a fixed public address. With UDP, enter the source address range and generate the shared secret. The secret is shown only once: copy it to the device straight away. With RadSec, register the SHA-256 fingerprint of the device's certificate.

Choose the second factor: a code from the authenticator app, approval on the phone, or either. Set how long the device waits for the approval, usually twenty-five seconds, and save. Now, on the device: point it at the service address, on port 1812 for UDP, or 2083 for RadSec. Use PAP, turn on Message-Authenticator, and set the timeout to at least the approval wait plus five seconds.

For whoever connects, the username is the account email, and the password is the same as the console's. With a code, people can type the password, a comma, and the six digits. With phone approval, a request to connect to the network arrives, with the VPN's name. The person confirms the code, approves, and confirms with their fingerprint or PIN. If they don't approve in time, the connection is refused.

For security, every refusal looks the same to the device. To find out why, open Operate, Audit: every RADIUS decision is recorded. Note that CHAP, MS-CHAP and EAP are not accepted, nor are Wi-Fi networks that use certificates. And that's it: VPN and Wi-Fi with a strong second factor. In the next tutorial, we'll protect Windows sign-in, even without a network.