Besides local database authentication, OPNsense also supports an external authentication backend, such as Microsoft Active Directory or OpenLDAP, for example. The currently supported protocols are RADIUS and LDAP. There is a special authentication backend that is only used for the Captive Portal service: Voucher Server, which we will explore in detail in Chapter 14, Captive Portal. You can combine these backends with a Time-Based One-Time Password (TOTP) using Google Authenticator, for example, to enable 2FA.

If you aren't familiar with any of these protocols, you might be asking, When do I need to use an external authentication backend? Let's start with one common example.

VPNs

Try to imagine the following scenario: You need to set up a new VPN tunnel that will be used by one of your customers. The IT team told you that they need to provide secure access to employees – a few hundred. Most of them will work from home, but they already...