Checking the device that connects to VPN

[dzany]

Hello,

We are using OpenVPN at Opnsense, and we would like to restrict the use of client configuration to company-owned devices. So, for example, users cannot just copy the client configuration to some other device and connect. We are using per-client certificates and TOTP, but also I would like to be sure from which device the client connects.

I was thinking about checking the device UUID or some mac address of the client device, using some after-auth script. But that should work on MacOS, Windows, Linux, Android, and iPhone devices. Any thoughts on this subject?