1

I've configured OpenVPN on CentOS7 to access my office network and it's working fine too. For authentication, it queries an LDAP server and it requires third-party software "OpenVPN client" in windows.

The only drawback that I face is that it doesn't work on android neither in iOS and also requires third-party. Now I don't want to use third-party for VPN access as there is already VPN option on all Windows as well as in Android, iOS. I want some suggestion for my VPN.

I've read about strongswan, openswan, libreswan, IPsecVPN but couldn't decide which one will be better in my case as they all suggest that some changes need to be done on windows registry which I don't want to do as there are maximum windows client in our office and It will be impossible to access individually and make some changes in their registry. Giving priority to windows client there shouldn't be any changes required and they can simply access through default VPN option.

I need a VPN server which can be run on CentOS 7 and it should be accessible by default VPN option on windows, android and iOS without any changes need to be done. If this can be possible than please suggest me. I want to run it on CentOS 7 and total clients will be around 250.

5
  • The question is borderline off-topic per our FAQ. However this is a complicated field with many options, and I prefer leaving a guiding answer with my tangible experience for future visitors. Jan 6, 2018 at 10:03
  • OpenVPN works on iOS and Android. Moreover, OpenVPN is actively maintained in homebrew and in the Debian repositories. You can easily install OpenVPN without a GUI remotely and then write a .bat script to execute the vpn connection in Windows.
    – oemb1905
    Jan 6, 2018 at 14:13
  • @oemb1905 I have configured tap interface on the server and connecting to it without rooted mobile or paid OpenVPN client is not possible as I know.
    – BDN
    Jan 10, 2018 at 2:34
  • OpenVPN is free on Windows as a client? Same on the other major platforms ... and you can easily install the server on plenty of free embedded systems like openWRT and vyos ... what’s the issue precisely? Perhaps I am not understanding ...
    – oemb1905
    Jan 10, 2018 at 2:57
  • I know for a fact that there are free clients for OpenVPN on Android, Windows and Mac. (I use them daily.) If you tweak your question (by removing the "must not be OpenVPN" implication) and allow this as an answer I'll be able to elaborate for you with links. It's far far more forgiving of dynamic IP addresses, and easier to configure correctly than IPsec, which I also have to use daily.. Mar 20, 2018 at 18:39

1 Answer 1

1

I have done such project in the past of setting up IPsec VPNs using the VPN native clients of OS/X, Mac, iOS and Android with PfSense + IKEv1. The changes to the Windows registry were automated via a .reg file, and the user took care of it.

If I were to do the project again, I would do it with FreeBSD + IKE v2, or Linux+StrongSwan + IKE v2.

PfSense is a firewall distro based in FreeBSD+StrongSwan with a web interface for configuring and doing maintenance, and whilst it has some limitations, I strongly advise it for less technically inclined people.

My OS/X/Linux/Android VPNs in PfSense were connected directly to an Windows Active Directory, and the Windows VPNs were connected to my FreeRadius for being able to talk EAP-MS-CHAPv2.

I also developed a portal that did automatic provisioning for Apple devices using python, and was doing that for Windows with powershell but then was reassigned to other projects. Those kind of stuff lends itself to be automated.

see PfSense - IKEv2 with EAP-MSCHAPv2

Any solution will support well around 200 clients. You might setup 2 VPNs for having redundancy if you wish.

There is always the option of maintaining the current OpenVPN solution that you are happy for Windows, and putting together a 2nd VPN server for iOS and Android.

1
  • 1
    I think I'll go with Linux+strongswan+IKE v2 with LDAP authentication. Thank you so much for sharing your knowledge.
    – BDN
    Jan 6, 2018 at 13:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .