Duo only integrates with OpenVPN servers that employ certificate authentication and use a unique common name (CN) in each user's cert.First Stepsīefore moving on to the deployment steps, it's a good idea to familiarize yourself with Duo administration concepts and features like options for applications, available methods for enrolling Duo users, and Duo policy settings and how to apply them. See Duo Knowledge Base article 7546 for additional guidance.

If your organization requires IP-based rules, please review Duo Knowledge Base article 1337.Įffective June 30, 2023, Duo will no longer accept TLS 1.0 or 1.1 connections or support insecure TLS/SSL cipher suites. Then click on Add button under the Zones list to add a new zone.This application communicates with Duo's service on SSL TCP port 443.įirewall configurations that restrict outbound access to Duo's service with rules using destination IP addresses or IP address ranges aren't recommended, since these may change over time to maintain our service's high availability.

Go to Network –> Firewall, click on the Edit button of the Lan zone.Ĭlick on the Allow forward to destination zones: menu and deselect the WAN zone, then click on Save. If you are setting up a Killswitch, it's strongly recommended to set the OpenVPN client to start and connect automatically on boot with the “Enable” checkbox, so that if the router is rebooted you don't lose Internet access (as without a VPN connected you will not be able to access the Internet anymore).įirst remove the tun interface from wan zone in case you have followed the previous step 4. This also means that if the VPN connection is terminated, you lose access to the Internet, since no traffic is allowed outside of your VPN. This is best for privacy and security as it will ensure that no traffic can reach the Internet bypassing the VPN you have set up. It's a fancy name for what is actually just a firewall rule. The “Network Killswitch” functionality, forces all traffic to go through the VPN.

Openvpn mac client add user profile auto login