Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense - OpenVPN Connection to Radius Server

    Scheduled Pinned Locked Moved OpenVPN
    3 Posts 2 Posters 993 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      centuryx476
      last edited by

      Hello,
      I have a OpenVPN server up and running using RADIUS as a back-end authentication.
      All my windows server both in the DMZ and in the internal LAN have a "End to End" Encryption between themselves as well as to the client machines. This way no matter what communication they do, it is an encrypted connection.

      How can I verify that the pfsense connection to the RADIUS server is encrypted ?
      I ask this because in order to get the OpenVPN to work their is a option I must select in the NPS section of windows server that says "Unencrypted authentication (PAP, SPAP)" if I uncheck this option then the connections will not work.

      Is their a way around this ?
      Is the connection from the pfsense to the RADIUS server encrypted ?

      Thank You

      1 Reply Last reply Reply Quote 0
      • C
        centuryx476
        last edited by

        Slight Bump:

        Let me approach this from a different side.
        On my Windows Servers I have implemented End to End Encryption using IPSEC. All traffic between those servers are encrypted and secured.

        I guess to resolve this question I can implement IPSEC between the windows RADIUS server and the PFsense server. But is that possible ? On windows it is easy as heck but PFsense being a diff. platform and all.

        Anyone ever done that before ?

        Thanks

        1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate
          last edited by

          RADIUS is not encrypted. The protocol doesn't have any mechanism for it. You can use things like MSCHAPv2 to protect the actual passwords and credentials in transit though.

          But you have to handle the encryption between RADIUS server and client yourself (e.g. VPN)

          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.