Hello everybody,
I am actually quite new to pfSense and openVPN setup.
For my personal use I have installed a pfSense Server to connect to my experimental "LAB" on a rented root Server in a Data Center. On this server is running ESXi with a few virtual machines going through my pfSense machine to connect to the internet.
I would like to use the RADIUS authentication on my domain controller. I followed the instructions in this tutorial:
https://doc.pfsense.org/index.php/OpenVPN_with_RADIUS_via_Active_Directory
But unfortunately I always get the following error on my client:
Thu Feb 11 21:45:28 2016 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jan 4 2016
Thu Feb 11 21:45:28 2016 Windows version 6.2 (Windows 8 or greater)
Thu Feb 11 21:45:28 2016 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.09
Thu Feb 11 21:45:38 2016 Control Channel Authentication: using 'pfSense-udp-1194-testVPN-tls.key' as a OpenVPN static key file
Thu Feb 11 21:45:38 2016 UDPv4 link local (bound): [undef]
Thu Feb 11 21:45:38 2016 UDPv4 link remote: [AF_INET]5.x.x.x:1194
Thu Feb 11 21:45:38 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 11 21:45:39 2016 [DOMAIN] Peer Connection Initiated with [AF_INET]5.x.x.x:1194
Thu Feb 11 21:45:41 2016 AUTH: Received control message: AUTH_FAILED
Thu Feb 11 21:45:41 2016 SIGUSR1[soft,auth-failure] received, process restarting
Thu Feb 11 21:45:43 2016 UDPv4 link local (bound): [undef]
Thu Feb 11 21:45:43 2016 UDPv4 link remote: [AF_INET]5.x.x.x:1194
This is pfSense OpenVPN log:
openvpn: user 'test' could not authenticate.
openvpn[44139]: 92.224.183.171:57109 WARNING: Failed running command (--auth-user-pass-verify): external program exited with error status: 1
openvpn[44139]: 92.224.183.171:57109 TLS Auth Error: Auth Username/Password verification failed for peer
openvpn[44139]: 92.224.183.171:57109 [testVPN] Peer Connection Initiated with [AF_INET]92.x.x.x:57109
I assume pfSense can reach my RADIUS server, because if I purposely use wrong credentials the first line in the pfSense OpenVPN log changes to
openvpn: invalid user authentication environment
Last but not least my client config:
dev tun
persist-tun
persist-key
cipher AES-128-CBC
auth SHA256
tls-client
client
resolv-retry infinite
remote 5.x.x.x 1194 udp
lport 0
verify-x509-name "DOMAIN" name
auth-user-pass
pkcs12 pfSense-udp-1194-testVPN.p12
tls-auth pfSense-udp-1194-testVPN-tls.key 1
ns-cert-type server
comp-lzo adaptive
Does anyone of you guys know how to fix this issue?
Thank you in advance!
