Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my network I have an Ubuntu 12.04 server running Samba4, my domain is fully configured and functional.

Now, I would like to enable VPN access over the internet, and have another box to do so. I have been searching on the internet for guides and information etc, but have not been successful.

I have however found this guide but was wondering if I could adapt it somehow to enable access to my DC services.

EDIT: I would need to authenticate my VPN server with my DC, if that is possible of course.

Any insight would be wonderful.

Regards, Jack Hunt

share|improve this question
up vote 4 down vote accepted

From your question missing some vital informations, because here are 3 different situations:

  1. Your Ubuntu/Samba server is on the Internet

  2. Your Ubuntu/Sabma is in the local network, and you now want setup an new computer what should act as VPN server and internet gateway (and firewall and like).

  3. You already have a sort of simple NAT router (e.g. common onebox DSL router) on your network, and need setup an new computer BEHIND this router as an VPN server.

Here are basically 3 different common VPN solutions. PPTP(forget it just now), L2TP and OpenVPN. Good comparison is at

Variant 1.) Personally I'm not recommendig this variant, but (maybe) this is based only my paranoia, and don't want giving you pure subjective answers.

Variant 2.) Setup the Gateway/Firewall/VPN server.

The L2TP (on Ubuntu) solution is (nevertheless to downvote the inappropriate "one external link answer" from @slafat01), described in detail the in the provided link. IMO, configuring L2TP and IPSEC is too hard, my recommendation is (when you don't need communicate to Cisco router or soo) - use rather OpenVPN.

OpenVPN (as already @Anders told above) is nice cross-platform easy-to-configure-and-use VPN solution. You can use any OS Linux or Freebsd for using it.

One solution (already suggested by @nedm) is installing pfSense. This is an excellent recommendation.

Another solution (and I'm recommending this) is installing "full-blown" FreeBSD-9.0-RELEASE as FW/GW/OpenVPN. It is a bit more complicated as pfSense (not much), but you will get full-featured server, with zilion ports (packages).

Installation is easy, updates and upgrades too (thanks to freebsd-update command) are easy. You will need install and configure Freeradius on your Samba server for acting as IAS and OpenVPN on the Freebsd. (installing is easy - one command, configuration is simuliar as in the above link)

Variant 3). Like above, Freebsd with OpenVPN, FreeRadius, PF but you will need open and open and forward connections to port 1194 (default port) to server on you nat router.

Some comments:

  • you want use TAP/bridged mode for your OpenVPN because easier to setup and manage and the second benefit is the ability to use broadcast and all network protocols.
  • you want to use Radius server (freeradius) because in this way is possible authenticate users from your DC and don't need manage different user-database on the FreeBSD server. Configure your FreeBSD pam for openvpn to authenticate via Radius.
  • you want do not forget to add the push "dhcp-option DOMAIN ...... to your openvpn.conf. This is an common mistake. Allowing to your remote (road warriors) using your DC.

Sure forgotting something, others can extend my 1st post here, because unfortunately I can post only 2 external links yet.

share|improve this answer
Thanks for the response, very detailed :) I am thinking I shall go with Option 2 and OpenVPN. Thanks again. – VisionIncision Oct 3 '12 at 11:58

Use the other box to set up a pfSense firewall/gateway. pfSense is a fantastic FreeBSD-based firewall distro and has configurable options for PPTP, IPSec, and OpenVPN VPNs built in.

I would install pfSense, enable OpenVPN, and configure it to authenticate using either FreeRadius or LDAP against your internal AD. Lots of guidance for doing this is available on the forums.

share|improve this answer

How about setting up an (separate?Ubuntu) OpenVPN server? To get started, look here: also provides a OpenVPN Access Server Virtual Appliance that you could take a closer look at if you like to do a quick test setup.

There are plenty of information to find here at SF or via Google on how to setup a OpenVPN server on Ubuntu. OpenVPN server can also handle client connections from Windows, Linux, Andriod etc...) not only site-to-site connections.

share|improve this answer

I tried pfSense + PPTP RADIUS Authentication. Works like a charme and easy as a piece of cake.

share|improve this answer
To make this answer useful for the OP, I'd suggest providing some detail about how it worked for you. – Magellan Oct 1 '12 at 5:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.