Flex200H - how to setup 2FA for openvpn ?

Hi @Asgatlat,

Regarding your question, please allow me to clarify that 2FA/MFA support does not depend on SecuExtender client. Two-factor authentication is a firewall-side feature and works with the supported Remote Access VPN types.

Since you prefer to use the OpenVPN client on the USG FLEX 200H, please refer to the following guides:

1. How to configure an SSL VPN connection with the OpenVPN Connect client
2. How to enable 2FA (Google Authenticator) for Remote Access IPSec VPN or SSL VPN — step-by-step configuration

Regarding 2FA behavior on the H series: The VPN tunnel is established first. The user is then required to open the 2FA authorization page in a web browser and enter their username, password, and Google Authenticator code before traffic is allowed. Please ensure that the 2FA authorization page is bound to an interface/IP address that is reachable from the VPN clients (default port: 8008).

Please also note that 2FA requires the SSL VPN sign-on method to be set to Local user — it is not supported when Cloud Authentication is selected.

Why can't I enable 2FA for SSL VPN on USG FLEX H using Google Authenticator? — Zyxel Community