pfsense HIP check with OpenVPN

[michmoor]

As the title suggests, does pfsense/OpenVPN support the ability to perform a HIP check?
Infosec wants to control where the VPN client gets installed and used - basically only VPN from corporate assets. I generally agree with the security posture but im not sure if OpenVPN is capable.

[stephenw10]

Not as far as I know. Not in the open source client at least.

[michmoor]

@stephenw10 gotcha.
Is there a workaround in OpenVPN that can allow only corporate assets to login?

Btw, thank you so much on the reassigning port issue. You saved the day more than you know

[stephenw10]

Hmm, effectively you're talking about a multi-factor auth setup but where one factor is built into the client device and cannot be removed?

Possibly something like a TPM stored client cert:
https://beaukey.blogspot.com/2014/12/openvpn-using-tpm-to-secure-identities.html

That's not something I've tried myself.

[michmoor]

@stephenw10 hmm something like that in a way

For example here

Essentially, i think the feature/logic needs to be built into OpenVPN and not a pfsense thing specifically.