how to create vpn ssl with client openvpn

Options
Publidok2022
Publidok2022 Posts: 1 image  Freshman Member
Second Anniversary
in Security

Accepted Solution

«1

All Replies

  • PeterUK
    PeterUK Posts: 4,228 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    Only the FLEX H models supports client openvpn

  • Dpj
    Dpj Posts: 196 image  Master Member
    Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security First Comment Friend Collector
    edited June 9

    i'm also testing with open vpn. What i found the easiest way: (im only using windows)

    I have an USG Flex 50h

    VPN - SSL VPN

    image.png image.png

    object - services - Service groups

    Default_Allow_WAN_To_ZyWALL

    Add SSLVPN to this group

    I created an group SSL-VPN-USERS

    And added an new User to it.

    image.png

    Click User Authentication

    image.png

    I think this were al the steps in de usg flex 50

    Then download this client:

    Community Downloads - Open Source VPN | OpenVPN

    just this one, because this one supports running scripts.

    So i created an batchfile

    @echo off
    start "" "msedge.exe"     https://192.168.1.1:300 ←information from the delivery settings here above.

    And saved it as c:\openvpn\test.bat

    download the ovpn config file inside the USG Flex50, and add these lines:

    script-security 2
    up "C:\\OpenVPN\\test.bat"

    offcourse, point to your location and script.

    after it, you could setup an connection to your usg flex, and after it connects, it directly opens the portal where you have to insert the OPT key.

  • Dpj
    Dpj Posts: 196 image  Master Member
    Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security First Comment Friend Collector
    edited June 9

    have not fully tested it, but i think this should work.

    @Zyxel_Melen end of this year i heard vpn will also be available in nebula for the FlexH series. Will open vpn also supported then? I realy hope so!

    yours Dennis

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,317 image  Guru Member
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    edited June 10 Answer ✓

    Hi @Publidok2022 ,

    ZLD firewall models (USG FLEX/ ATP…) don't support client openVPN, while uOS firewalls (H series) does.

    This article will guide you on how to configure an SSL VPN connection with the OpenVPN Connect client on USG FLEX H.

    https://community.zyxel.com/en/discussion/20526/how-to-configure-ssl-vpn-connection-with-openvpn-connect-client

    Zyxel_Judy

    Untitled Image
  • Zyxel_Judy
    Zyxel_Judy Posts: 2,317 image  Guru Member
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula

    Hi @Dpj ,

    Currently, USG FLEX H users can only configure site-to-site VPN through Nebula.

    We plan to support remote IKEv2 VPN and OpenSSL VPN on Nebula in October 2025. To know exactly when these features are released, please follow the Security News & Releases section.

    Zyxel_Judy

    Untitled Image
  • rcd
    rcd Posts: 4 image  Freshman Member
    First Comment Friend Collector
    https://community.zyxel.com/en/discussion/comment/78023#Comment_78023

    Hi,

    I thought 2FA couldn't work with openvpn clients but you managed to do it.

    In delivery settings I put https, user defined and my public ip address. Port 8008 and I allowed this port from WAN to Zyxel rules.

    I launch my VPN client, it connects, but when I try to reach https://my_public_ip:8008, it can't connect.

    May be I am totally wrong and I don't understand what are these delivery settings settings ?

  • rcd
    rcd Posts: 4 image  Freshman Member
    First Comment Friend Collector

    Hi,

    My openvpn works but when I try to set a two factor authentication, in delivery settings I enter https, user defined, my internet ip, port 8008

    In security policy I allow port 8008 from Wan to Zyxel

    I connect my openvpn client and try https://my_public_ip:8008 from a browser

    And nothing happens, it fails.

    I think I don't get what ip I should fill in devlivery settings.

    Can anyone help me please ?

  • zyman2008
    zyman2008 Posts: 241 image  Master Member
    50 Answers First Comment Friend Collector Eighth Anniversary

    Hi @rcd ,

    To narrow the attack surface. USG FLEX H is not allow to open 2FA page from Internet. It can only be access within the tunnel.

    You need to set the link IP to LAN interface IP. In my case, LAN interface is 192.168.5.1. And make sure it's in the local networks list if using split tunnel.

    image.png
  • rcd
    rcd Posts: 4 image  Freshman Member
    First Comment Friend Collector
    https://community.zyxel.com/en/discussion/comment/81490#Comment_81490

    Hi @zyman2008 ,

    Thanks for your reply.

    In your case, 192.168.5.1 is the IP of the Zyxel in the LAN allowed by the VPN right ?

    And about HTTP or HTTPS, you set HTTP : is it because HTTPS does not work here ?

  • zyman2008
    zyman2008 Posts: 241 image  Master Member
    50 Answers First Comment Friend Collector Eighth Anniversary

    Hi @rcd ,

    Yes, 192.168.5.1 is allowed by the VPN.

    Since the VPN tunnel already encrypted the traffic. HTTP in VPN tunnel is secured and is quick then HTTPs.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）