# OpenVPN with LDAP Authentication

> OpenVPN on VyOS with LDAP/Active Directory authentication - enterprise remote access with centralized user management

Source: https://opennix.org/en/docs/vyos/examples/openvpn-ldap/


OpenVPN with LDAP authentication for enterprise remote access deployments with centralized user management.

## Scenario

- Enterprise Remote Access: Employees connect to the corporate network
- LDAP/AD Integration: Centralized authentication
- Multi-Platform: Windows, macOS, Linux, iOS, Android clients

## VyOS OpenVPN Server Configuration

```bash
# OpenVPN Server
set interfaces openvpn vtun0 mode 'server'
set interfaces openvpn vtun0 server subnet '10.8.0.0/24'
set interfaces openvpn vtun0 server name-server '10.10.1.1'
set interfaces openvpn vtun0 server domain-name 'company.local'

# TLS
set pki ca OVPN-CA certificate 'MII...'
set pki certificate OVPN-SERVER certificate 'MII...'
set pki certificate OVPN-SERVER private key 'MII...'

set interfaces openvpn vtun0 tls ca-certificate 'OVPN-CA'
set interfaces openvpn vtun0 tls certificate 'OVPN-SERVER'

# LDAP Plugin
set interfaces openvpn vtun0 openvpn-option '--plugin /usr/lib/openvpn/openvpn-auth-ldap.so /config/auth/ldap.conf'

commit
```

## LDAP Configuration

`/config/auth/ldap.conf`:
```xml
<LDAP>
  URL             ldap://dc1.company.local
  BindDN          cn=openvpn,ou=Services,dc=company,dc=local
  Password        LDAPPassword123
  Timeout         15
  TLSEnable       yes
  FollowReferrals yes
</LDAP>

<Authorization>
  BaseDN          "ou=Users,dc=company,dc=local"
  SearchFilter    "(&(objectClass=user)(sAMAccountName=%u))"
  RequireGroup    false
</Authorization>
```

## Client Configuration

```
client
dev tun
proto udp
remote vyos.company.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
auth-user-pass
cipher AES-256-GCM
verb 3
```

Users enter their LDAP credentials when connecting.

## References

- [VyOS OpenVPN](https://docs.vyos.io/en/latest/configuration/interfaces/openvpn.html)
- [OpenVPN Auth-LDAP Plugin](https://github.com/threerings/openvpn-auth-ldap)
- [OpenVPN LDAP Example](https://docs.vyos.io/en/latest/configexamples/openvpn-ldap.html)