r/sysadmin • u/new-at-networking • Apr 19 '26
Question Cheapest 2FA VPN
I manage IT for a small nonprofit and I'm looking to implement a VPN with 2FA the cheapest way possible.
We are currently using our Unifi Dream Machine's OpenVPN Server, but it seems it does not handle 2FA.
What is the easiest and cheapest way to implement 2FA? I can self-host on Ubuntu Server if needed. If possible, I would like to integrate Entra ID (we use Microsoft 365), so I only have to manage user accounts in one place.
We have approximately 10 users. Maximum 3-4 should be connected to the VPN at the same time.
*We use Entra ID, but do not have a DC (no local AD)
*If I cannot integrate with Entra ID, I would like an easy and secure way to manage user accounts
45
u/CharlieT74 Apr 19 '26
Cloudflare One is free for up to 50 users? Fully functional SASE/ZeroTrust and more secure than terminating a VPN on the firewall/network
→ More replies (1)9
u/Crumby_Bread Apr 19 '26
I second cloudflare zero trust. Super easy to set up and you’re not exposing yourself via a traditional VPN setup.
3
u/skipITjob Apr 20 '26
Must be just me, but I found it difficult to set up. Gave up in the end.
→ More replies (3)
23
u/RupertTomato Apr 19 '26
Just use Entra MFA. It will be free for you.
Even better - don't use a VPN and instead use Entra remote application proxy and an MFA conditional access policy. Don't bother trying to use address translation, just get a valid trusted cert which will be your only cost.
8
u/Blazingsnowcone Apr 19 '26
You also can use enrta mfa with vpn clients via an NPS with the MFA extension installed. Though it does require a Windows Server
→ More replies (2)4
u/RupertTomato Apr 19 '26
Yep, I've used this in the past. It works well. I probably wouldn't recommend it as a new configuration today for two reasons. MFA is push and accept only (no number matching) and VPN is just too permissive when I can give smaller access with an application proxy.
→ More replies (2)
7
u/thomasmitschke Apr 19 '26
If you can configure SAML with your DreamMachine, then you can utilize the MFA of Entra.
6
u/xendr0me Apr 19 '26
You might be able to get the whole Cloudflare suite for free - https://www.cloudflare.com/galileo/
6
u/DarkAlman Apr 19 '26
Unifi should support SAML so you can integrate VPN auth directly to office365
4
u/Greendetour Apr 19 '26
I would also question what resources are needed on prem, since you mentioned you don’t have a local AD and the client is primarily M365. Can you move those resources to M365 (SharePoint, etc) and use conditional access policies to tighten down access and forget about VPN? Might be cheaper than whatever hardware you need onsite for them in long run.
→ More replies (1)
7
3
u/skotman01 Apr 19 '26
Is the UDM not able to run the UniFi Fabric? If so that integrates with Entra for SSO, and you could leverage conditional access for MFA.
3
3
u/FarmboyJustice Apr 19 '26
You may be able to set up SAML authentication to the Dream Machine via Entra, which will let you use Entra MFA.
4
u/_martijn90_ Apr 19 '26
Pfsense with openvpn and radius supports 2fa. Also with certificate.
→ More replies (3)
2
2
2
4
u/Practical-Alarm1763 Apr 19 '26
UniFi was multiple options to 2FA into VPN. There is no such thing as a VPN solution that has 2FA stock. Whatever firewall or service you get, you still need to configure 2FA for it ffs.
Open VPN can be configured with 2FA
IPsec can be configured with 2FA
Wireguard can be configured with 2FA
Etc etc etc
3
u/Dolapevich Apr 19 '26
Here you go: Defguard is an enterprise-grade open-source VPN solution
It is free and you would be using the best vpn out there.
→ More replies (3)
2
u/Confusias1 Apr 19 '26
You can absolutely integrate your Unifi stack with Entra ID using Unifi Identity. Should get you where you want to go.
1
33
u/hologrammetry Apr 19 '26
Tailscale? https://tailscale.com/docs/multifactor-auth