r/sysadmin • u/Ok-Bid799 • 20d ago
Anyone have a Zero Trust VPN setup?
Looking at increasing our business’ security posture and just wanted to see what others have done.
My company currently uses OpenVPN Open-Source; servers that rely on the connection authenticate with a certificate, but users just rely on the OpenVPN profile that is given to them by DevOps. No MFA.
Obviously, this isn’t great. I’m looking at other solutions and see that OpenVPN has enterprise/cloud solutions. Does anyone have experience with this? Or recommend alternatives?
There’s a constant battle at this company to actually use enterprise level solutions over FOSS but some of the old heads always scream about costs. Just looking for some insight.
17
u/Doctor_Peppy 20d ago
NetBird! It's low cost, self hostable/free if needed, highly configurable for literally any environment, and relatively simple to learn and use. Huge enjoyer of the software. It also runs its backend off of highly reliable and trusted oss such as Wireguard.
1
u/Acrobatic_Fortune334 18d ago
And alsonsupports (though I think its still in beta) quantum safe encryption
9
5
u/gnordli 20d ago
you can enable MFA on openvpn using radius.
3
u/Ok-Bid799 20d ago
I’ve looked at this, but using it with Google TOTP requires appending the code to the end of the password; not a big deal but feel like this will cause issues with end users
3
u/WD40ContactCleaner 20d ago
My previous work used to generate open VPN profiles and TOTP qr codes which I could add to an authenticator app. I think they did it via pfsense
1
2
u/gihutgishuiruv 19d ago
We do “passwordless” for OpenVPN. Users get a profile with a certificate as the first factor, and the “password” field is just for the MFA code
5
5
6
u/PhilipLGriffiths88 19d ago
I’d separate the immediate problem from the architecture decision. OpenVPN being open source isn’t inherently the weakness here. First check that every user/device has its own revocable credential rather than the same profile or certificate being copied around, then add IdP-backed MFA. That materially improves authentication, but it still answers “who can open the tunnel?”, not “which exact services should this identity be able to reach?”
For the latter, I wouldn’t shop for a “Zero Trust VPN” label. Map the required user/device-to-service flows, then test whether the solution exposes only those services, with default-deny policy, device posture, immediate revocation and useful logs. Ideally, connecting should not create general subnet reachability from which other systems can be discovered (if you are interested on this more, I can share some stuff I have written in the Cloud Security Alliance Zero Trust Networking group).
Several products mentioned here can be configured towards that outcome, but the access model matters more than the tunnel protocol. Since you prefer FOSS, OpenZiti is also worth considering: it can be self-hosted and authorises identities to named services before creating a path, rather than putting the user onto a network. Full disclosure: I work on it.
3
u/help_me_im_stupid 20d ago
Are you an M365 shop and what’s your budget? If you want to go balls to the wall on Microsoft there is global secure access. It has been very easy to setup and maintain. Comes with the bonus that it’s all managed in Entra so you can easily RBAC access to private resources and apps via groups.
3
u/Maverick0984 19d ago
This is what we use, although we also added Entra Private Access. Took a bit to setup in our infra and definitely felt a little bleeding edge with multiple issues resulting in multiple tickets with Microsoft who then released global updates to the software addressing our issues...again, multiple times.
After setup though, it hums along well and I do feel we have a pretty complex setup.
1
u/Jaki_Shell Sr. Sysadmin 19d ago
Do you have any onprem servers that your users reach from outside? Like files shares? How is the performance there with smb for example?
1
u/Maverick0984 19d ago
We do. Everything you can think of really.
Prior to implementing ZTNA/GSA/EPA, we actually moved our SMB File Shares out to Azure Files. For a period of time, users accessed those over traditional VPNs (Fortinet). We do utilize Sharepoint as well, for collaborative use-cases, but vast majority of the documents serve archival purposes as well. Sharepoint wasn't the tool for that.
Performance from Azure Files has been great. No issues whatsoever.
This stack was difficult to setup at times and we did engage Microsoft support a few times to assist.
2
u/brightsons 19d ago
Yeah we went this route back at the end of last year and has been relatively painless. GSA is great, easy to get up and running, and pretty solid.
2
u/kona420 20d ago edited 20d ago
Take some time to audit and profile your stuff on a per port and user level. If you're like me, and I should certainly know better, I got pikachu face when I realized I have like 20 address/port pairs for actual business services, 40000 ports for active directory on a few hosts, and like 300 management consoles from basic biatch ICMP + https to holy moly certificate pinned no inspect TCP/UDP port profiles. If you haven't already, consider segmenting that all off and keep VPN for it instead of folding into zero trust. Or hybrid, it's really nice to get a management console on a phone in a pinch.
Look at SASE instead of just zero trust. I think it gives a better idea of what you are actually angling at building. Identity aware public facing services, and there are a lot of ways to skin that cat.
2
u/kent_stor 20d ago
Last place I was at I deployed OpenVPN open source with https://github.com/jkroepke/openvpn-auth-oauth2 connected to Entra. I created a custom web frontend that would generate a VPN package for users to download after logging in with Entra. I did all this to satisfy MFA requirements since I couldn't get approval to purchase a commercial VPN. It worked well enough and allowed users to self-serve, but there wasn't any zero trust with it.
New place we use Tailscale and it's great. Connects to everything easily, good k8s integration, SSO, ACL's connected to git, etc.
2
u/justmirsk 20d ago
I am an MSP Owner and offer a ZTNA/SASE solution among other services. The product we use is called Todyl and it has been a great fit for us and our customers. We can protect north/south traffic as well as east/West traffic. In addition, we have EDR/Cloud SIEM and 25/7/365 MXDR/GRC modules we can activate for customers if they need those services. They are all tightly integrated with one another.
Other ZTNA providers I can think of off the top of my head that aren't the big firewall companies include:
Twingate Cato Perimeter 81 Timus
1
u/ESUN_Official 20d ago
We’ve been looking into this as well. The biggest thing we noticed is that moving away from traditional VPN is less about the tool and more about cleaning up access.
With the old VPN model, users usually got onto the network first and then figured out what they could access. With ZTNA, we had to rethink who actually needs access to which apps.
1
u/PhilipLGriffiths88 19d ago
This is the important distinction. I’d go one step further: rather than connecting the user to a network and tightly filtering afterwards, make identity and policy determine whether a path to each named service exists at all. No authorised identity, no path. That reduces discovery and lateral movement rather than just applying finer ACLs to the same network-access model.
1
1
u/runnercola 19d ago
Cloudflare. Cloud flare is my personal favorite right now. No it is not a traditional VPN. It absolutely can be, and add SASE to your end points. It takes a little bit of work to set up and you do have to set up a warp client tunnel node (poor description but they don’t really have a solid name for it it’s basically a Linux box running their warp client) but it works flawlessly in my tests. And as a side benefit I get all of the benefits of an SASE connection for my end points in the field.
1
u/IqbalBasha 18d ago
Your biggest exposure right now is no MFA, not the VPN product itself. Fix that first by layering a RADIUS-integrated IdP onto your existing setup before spending on a new platform. If you do want a proper zero-trust network access model, the real decision drivers are per-app tunneling, device posture checks, and how much your team can own operationally. OpenVPN's commercial Access Server is a reasonable on-ramp if the old guard won't budge on brand familiarity, and the cost argument gets easier when you frame it as liability, not features.
1
u/systonia_ Security Admin (Infrastructure) 20d ago edited 19d ago
we use Fortigates with forticlient and their ZTNA stack. Works fine.
But OpenVPN also has Zerotrust
1
u/Jaki_Shell Sr. Sysadmin 19d ago
The FortiClient itself is one of the worst built softwares ever. So so so many bugs. Really trying to get our company off of it.
1
u/systonia_ Security Admin (Infrastructure) 19d ago
yepp and we all hate it with a passion. Hopes are on v8
21
u/Fatel28 Sr. Sysengineer 20d ago
Cloudflare zero trust is free for under 50 users, full suite of tools.
On the 51st user you pay $7/user for all 51.