I've been instructed to setup an OpenVPN Server on our local pfSense VM. I've combed over tutorials and guides, netgate, openvpn documentation and I feel I must be missing something.

I've tested the AD Servers ability to bind using ldp.exe* I can also see my various "Authentication Containers" using the [Select a container] button. (Meaning the user I'm using to authenticate to the AD Server is able to authenticate).

However when using Diagnostics>Authentication screen I fail to authenticate and receive the error in my logs: /diag_authentication.php: ERROR! Either LDAP search failed, or multiple users were found.

I feel like my issue is stemming from my entire lack of knowledge on this subject... also in my LDAP Server settings:

LDAP Server Settings on pfSense:

Hostname or IP Address: 10.x.x.x (IP of AD Domain Controller)

Port Value: 389

Transport: TCP-Standard

Peer Cert Auth: Cert Authority I created for this purpose in pfSense

Protocol Version: 3

Server Timeout: 45

Search Scope: Entire Subtree

BASE DN: DC=mydomain,DC=local

Auth Containers: CN=Users;DC=mydomain,DC=local

Extended Query: memberOf=CN=VPNUsers,CN=Users,DC=mydomain,DC=local

I really think my extended query is wrong and this is what's causing my problem. At one point i had it working it seemed but I managed to break it again?

Variations of extended query I've tried:

memberOf=CN=VPNUsers;CN=Users,DC=mydomain,DC=local

memberOf=CN=VPNUsers;CN=Builtin,DC=mydomain,DC=local

memberOf=CN=VPNUsers;CN=Users,CN=Builtin,DC=mydomain,DC=local
up vote 0 down vote accepted

I'm not 100% sure, but I think this is wrong:

memberOf=CN=VPNUsers;CN=Users,DC=mydomain,DC=local
memberOf=CN=VPNUsers;CN=Builtin,DC=mydomain,DC=local
memberOf=CN=VPNUsers;CN=Users,CN=Builtin,DC=mydomain,DC=local

I don't think you should use ; but use , instead.

Also here:

Auth Containers: CN=Users;DC=mydomain,DC=local
  • I'll give it a shot in a little bit! Thanks for the help. – NullReff Aug 10 at 18:10
  • memberOf=CN=VPNUsers,CN=Builtin,DC=mydomain,DC=local did the trick. Thanks a ton. – NullReff Aug 15 at 13:25
  • No problem, glad I could help ;) – Cris Kolkman Aug 16 at 14:07

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.