Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense and Ubiquiti

    Scheduled Pinned Locked Moved General pfSense Questions
    21 Posts 6 Posters 6.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Works fine.

      If you can successfully authenticate using Diagnostics > Authentication you should be able to leverage that server with OpenVPN.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • S
        Smoothrunnings
        last edited by

        Is there a good walk through setting it up?

        The stuff I have seen pre-dates pfSense 2.3.x and server 2008.

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Everyone's AD is different enough that making a walkthrough is pretty much useless.

          General stuff though:

          Create a RADIUS client in NPS for the pfSense source address and password

          Set up a RADIUS Authentication server pointing to that.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            How many vpn users will you have that using radius to auth makes sense?  This is not a home setup I take it then?  Yeah Derelict is right what does the diagnostics auth section tell you?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • S
              Smoothrunnings
              last edited by

              @johnpoz:

              How many vpn users will you have that using radius to auth makes sense?  This is not a home setup I take it then?  Yeah Derelict is right what does the diagnostics auth section tell you?

              I think I need to take a break from this fourm. Instead telling what I want or what I should do you should offer to help me to get there. This isn't directly at only you (Johnpoz) but everyone who has contributed to this thread what I want or should do. I have found myself having to fight a battle here which I should have to do.

              Thanks,

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Good luck then.. But you have not actually asked a question that can just answer..  Other than can you put your unifi in front of pfsense.. Sure do that - do it via double nat, or turn off nat in pfsense and setup transit to pfsense want from your unifi router be it the pro line or the usg, etc.  Personally do not get what that gets you exactly?  And seem more like a discussion on how you can integrate unifi with pfsense - but with out some specific on that integration seems more of discussion.

                This is not really a ask a question get an answer forum. This is a discussion forum, not an interface for your support tickets ;)  If you want such support open a ticket with pfsense using your support subscription.

                Not sure what openvpn auth to windows AD has to do with unifi as example discussion..

                The ntopng info is vastly more useful than the eye candy the dpi gives in unifi..  How exactly are you trying to integrate your unifi with pfsense.  And be more than happy to answer that specific question - but software there has not been a specific question to answer from my take.. Its a discussion..

                Do you really need specific help putting pfsense behind usg - it would work out of the box in double nat setup, just like putting pfsense behind any other sort of nat router..  Do you need help on creating a transit network between your edge usg doing nat, and turning off pfsense from doing nat?  Problem with the nat option is your dpi info would just show pfsense wan IP doing all the traffic.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Yeah I am not exactly sure what OP expects to happen here. A complete AD authentication design consultation from a forum member?

                  • Enable NPS in AD

                  • Create an NPS client for pfSense

                  • Create a RADIUS authentication instance in pfSense

                  • Test in Diagnostics > Authentication - get it working there.

                  • Enable that for OpenVPN.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • M
                    mikeisfly
                    last edited by

                    LDAP works with OVPN too.

                    1 Reply Last reply Reply Quote 0
                    • R
                      robi
                      last edited by

                      @Derelict:

                      Yeah I am not exactly sure what OP expects to happen here. A complete AD authentication design consultation from a forum member?

                      The main pont was this sentence:

                      I actually make fun of them not owning the Pro saying they aren't "PRO" enough!

                      He wants to make a "PRO" looking thing to be able to boast to his friends. This whole topic and OP has nothing to do with real issues and solutions.
                      If somebody can't understand (including friends) that pfSense is more "PRO" than anytning containing "PRO" in its name, let them go…

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        Ah so he wants to brag to his buds hey I run "pro" usg and pfsense - so I am extra "pro" hehe

                        Think you hit it on the head..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • R
                          robi
                          last edited by

                          That's why I'll never, ever buy a BMW.  8)

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.