Hello Forum,
i hope my english is good enough to explain my wishes for my OPNsense.
I startet with VPN for nearly twenty years using AVM (a german manufacturer), than switched to Bintec (also german) but both are no longer powerfull enough for my wishes an needs.
I´m very happy with firewall, multi WAN and so on, but currently i´m unable to use my most needed feature: Mobile Client connectivity.
With my old bintec it was easy: On Windows i used the Shrew Soft VPN Client for IKEv1 Connectivity, Android and iPhone connectet with their native clients.
Now, after switch to OPNsense, i have to find a working solution, if possible without client software. Is this a possible problem?
I thought it would be possible to realize it using IKEv2 with mobile client support, but right now i´m even to stupid to configure it running with all i need: I get a connection and IP packets are routed, but i have no name resolution. Windows 10 / 11 are connecting, but if i run ipconfig /all after establishing the connection there is no configured DNS Server or suffix on my client - and that even while i´ve configured both on my OPNsense.
My questions:
- is IKEv2 the correct solution for my needs?
- if IKEv2 is the correct soultion - how can i realize it that Windows is recognizing DNS Server and Suffix?
- if IKEv2 isn´t the correct solution - what´s the correct way for my needs?
Norbert
I use WireGuard personally.
WireGuard does not scale very well, because there is no mechanism comparable to XAUTH. IPsec and OpenVPN can both use Active Directory based AAA, for example.
To avoid the need of special client software, IPsec is the way to go, as WG and OVPN are not implemented in Windows.
I`m using WG because it offers great speed, but OVPN is always configured as fallback when WG will not work from time to time for unknown reasons.
I never used IPsec, so I can`t troubleshoot your DNS problems, with both WG and OVPN I have no issues using the Sense (AGH) as DNS server.
We´re currently switching all Client VPNs to OpenVPN witch works great for use becaus we can provide all functions we want:
- Authentication against Windows Domain Controller
- Access rules for groups and users
- Easy client setup on all used operating systems including mobile devices
Best regards from rainy germany
Norbert
Sounds good. :)
Also best regards from rainy Germany...