External authentication

Besides local database authentication, OPNsense also supports an external authentication backend, such as Microsoft Active Directory or OpenLDAP, for example. The currently supported protocols are RADIUS and LDAP. There is a special authentication backend that is only used for the Captive Portal service: Voucher Server, which we will explore in detail in Chapter 14, Captive Portal. You can combine these backends with a Time-Based One-Time Password (TOTP) using Google Authenticator, for example, to enable 2FA.

If you aren't familiar with any of these protocols, you might be asking, When do I need to use an external authentication backend? Let's start with one common example.

VPNs

Try to imagine the following scenario: You need to set up a new VPN tunnel that will be used by one of your customers. The IT team told you that they need to provide secure access to employees – a few hundred. Most of them will work from home, but they already...