Integrations · Any RADIUS VPN or firewall
VPN 2FA over RADIUS: phone approval for any VPN or firewall
For IT teams with any VPN concentrator or firewall that can point at a RADIUS server. The Notakey auth-proxy goes between the VPN and RADIUS, so every login needs the password and a tap on the phone. The RADIUS server and the users stay unchanged; on the VPN, only the RADIUS server address and timeout change.
How it connects
A transparent proxy in the RADIUS path
The user dials the VPN with username and password. The concentrator sends the RADIUS request to the auth-proxy instead of your RADIUS server. The proxy forwards it downstream; a failed password check is rejected immediately. If the password is good, the proxy pushes an approval request to the user’s phone and holds the RADIUS exchange open while the user responds, up to 30 seconds by default. Approve, and Access-Accept goes back to the VPN; deny or timeout, and the login is rejected.
Because the proxy speaks standard RADIUS on both sides, it works with almost any RADIUS server (FreeRADIUS, Microsoft NPS, MikroTik’s User Manager) and with any VPN concentrator that can point at RADIUS. Existing corporate RADIUS works unchanged; the proxy is transparent to it. The on-premise appliance ships with the proxy built in; with a cloud-hosted Notakey server, the same proxy runs as a container inside your own network, and an MSI installer is available for Windows.
If you do not run RADIUS at all, the appliance’s RADIUS plugin is a FreeRADIUS-based downstream server with one global password or a short list of per-user passwords in its configuration, so there is no RADIUS user database to build. The user is verified by the phone approval.
On the phone, the request shows who is logging in and from which IP address, with a countdown. A user who sees this while not dialling the VPN is looking at someone else using their password, and one tap on Deny stops the login and leaves an audit trail.
What to know before you start
- Your VPN’s RADIUS client timeout must be at least as long as the approval window, 30 seconds by default. Most RADIUS clients default to a few seconds or less; logins timing out even when you approve quickly is the most common mistake in this setup.
- The same username must exist in the Notakey service, in RADIUS and in the VPN. The proxy addresses the push by username.
- The RADIUS plugin does not check users’ directory passwords. If you need that, use Microsoft NPS or another RADIUS server connected to your directory.
- The plugin ships with a published default secret and password. Replace both before you expose it to anything.
- The proxy reads the client IP shown on the approval card from the standard Calling-Station-Id attribute. A VPN that does not populate it shows no IP on the card; Palo Alto GlobalProtect is one such case.
- A phone approval stops a stolen or guessed password from being enough on its own. It does not stop an attacker who relays a real login through a fake page in real time.
From zero to the first approval
- 01
Create the VPN application in Notakey
In the Notakey dashboard, create an application for the VPN, onboard the users’ phones with Notakey Authenticator, and copy the application’s Access ID.
- 02
Configure the auth-proxy
On the appliance, set the proxy’s listening port, downstream RADIUS address, the two shared secrets, the Access ID, the approval window and the message users will see, then start it. With a cloud server, run the notakey/authproxy container with the same values as environment variables.
- 03
Point the VPN at the proxy and raise the timeout
Change the VPN’s RADIUS client so the server address is the proxy, with the same secret as vpn_secret_in, and raise its RADIUS timeout to at least 30 seconds. Dial the VPN, approve the push on the phone, and the connection completes.
Frequently asked questions
- Which VPNs and RADIUS servers work with the auth-proxy?
- Any VPN concentrator or firewall that can point at a RADIUS server, and almost any RADIUS server: FreeRADIUS, Microsoft NPS, MikroTik’s User Manager or the appliance’s own RADIUS plugin. The proxy speaks standard RADIUS on both sides.
- Does my existing RADIUS server or user database change?
- No. The proxy is transparent to it. On the VPN, only the RADIUS server address and the timeout change.
- Why do logins time out even when I approve quickly?
- Almost always because the VPN’s RADIUS client timeout is shorter than the proxy’s 30-second approval window. Most clients default to a few seconds; raise it to at least 30 seconds.