Use Case — OpenVPN Client VPN to the UDM Pro Max with RADIUS Authentication

1. Choosing the approach (read first)

UniFi's VPN options don't include a native "OpenVPN server + RADIUS" wizard. Pick the path that fits:

This document builds the OpenVPN + RADIUS path: the OpenVPN server authenticates users against the UDM's built-in RADIUS server via the OpenVPN RADIUS plugin. The tunnel still uses TLS (CA + server cert) for transport security; user identity comes from RADIUS.

Where the OpenVPN server runs — two options, same config:

• On the UDM via the community UDM-Utilities on-boot framework (matches "VPN to the UDM," but is unsupported by Ubiquiti and must be re-tested after firmware upgrades).
• On a small hardened host/VM in the Management VLAN (10.12.10.0/24) with the UDM forwarding UDP 1194 to it — cleaner and supportable. Recommended for production.

2. Where it fits

Remote user ──OpenVPN/UDP 1194──▶ UDM Pro Max (WAN) ──▶ OpenVPN server
                                                          │ auth: RADIUS 1812/1813
                                                          ▼
                                            UDM built-in RADIUS server (10.12.10.1)
   client pool 10.12.70.0/24  ──pushed routes──▶ office 10.12.0.0/16
                                              └─▶ AWS VPC 10.1.0.0/20 (via the office↔AWS tunnel)

Because the client pool 10.12.70.0/24 is inside 10.12.0.0/16 — which the office already advertises to AWS over the site-to-site tunnel — remote users reach AWS private resources with no extra AWS config. DNS pushed to clients points at the UDM, so they inherit the Route 53 split-DNS from the earlier setup.

3. Step 1 — Enable the UDM built-in RADIUS server

UniFi Network → Settings → Profiles → RADIUS (or Settings → Networks → RADIUS Servers) → Default RADIUS Server → Enable:

• Authentication port: 1812 Accounting port: 1813
• Shared secret: a strong secret (the OpenVPN server will present this as a RADIUS client).
• Optionally enable RadSec (RADIUS over TLS) — available in UniFi Network 8.4+.

Then create the VPN users under the RADIUS server's Users (username + password per user). These same accounts can back 802.1X WiFi later.

If the OpenVPN server runs on a separate host, that host must be allowed to query the UDM RADIUS on 1812/1813 with the shared secret. If it runs on the UDM, it talks to RADIUS locally.

4. Step 2 — OpenVPN server

4.1 PKI (one-time, with easy-rsa)

# Build a CA, server cert, DH params, and a tls-crypt key
easyrsa init-pki
easyrsa build-ca nopass
easyrsa build-server-full server nopass
easyrsa gen-dh
openvpn --genkey secret /etc/openvpn/pki/tls-crypt.key

No per-user client certificates are issued — identity comes from RADIUS — but the CA + server cert secure the TLS tunnel, and tls-crypt hardens the control channel.

4.2 Install the RADIUS plugin

# Debian/Ubuntu host or UDM container
apt-get install -y openvpn openvpn-auth-radius
# plugin lands at /usr/lib/openvpn/radiusplugin.so

4.3 /etc/openvpn/server.conf

port 1194
proto udp
dev tun
topology subnet
server 10.12.70.0 255.255.255.0          # VPN client pool = VPN VLAN

# TLS material
ca        /etc/openvpn/pki/ca.crt
cert      /etc/openvpn/pki/issued/server.crt
key       /etc/openvpn/pki/private/server.key
dh        /etc/openvpn/pki/dh.pem
tls-crypt /etc/openvpn/pki/tls-crypt.key

# Authenticate users via RADIUS (no client cert required)
plugin /usr/lib/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
verify-client-cert none
username-as-common-name

# Reach the office and AWS, and use the UDM for DNS (split-DNS to Route 53)
push "route 10.12.0.0 255.255.0.0"        # all office VLANs (per firewall policy)
push "route 10.1.0.0 255.255.240.0"       # AWS us-west-2 VPC, via office tunnel
push "dhcp-option DNS 10.12.10.1"          # UDM built-in DNS
push "dhcp-option DOMAIN aws.corp.example.com"

cipher AES-256-GCM
auth SHA256
keepalive 10 60
persist-key
persist-tun
user nobody
group nogroup
verb 3

4.4 /etc/openvpn/radiusplugin.cnf

NAS-Identifier=udm-openvpn
OpenVPNConfig=/etc/openvpn/server.conf
overwriteccfiles=true

server
{
    name=10.12.10.1            # UDM built-in RADIUS server (use 127.0.0.1 if on the UDM)
    authport=1812
    acctport=1813
    sharedsecret=<RADIUS_SHARED_SECRET>
    retry=1
    wait=2
}

Start/enable the service (systemctl enable --now openvpn@server), or on the UDM place it under /mnt/data/on_boot.d/ so it survives reboots.

5. Step 3 — UDM firewall, NAT, and routing

In UniFi Network:

1. Publish the listener. If the OpenVPN server runs on a separate host, add a NAT/port-forward: WAN UDP 1194 → OpenVPN host (Settings → Routing → NAT / Port Forwarding). If it runs on the UDM, allow inbound UDP 1194 to the gateway in the WAN-IN firewall policy.
2. Return routing. If on a separate host, add a static route so the office knows 10.12.70.0/24 is reached via that host (or enable NAT on the OpenVPN host so client traffic is sourced from its LAN IP). On the UDM it's local.
3. Zone policy. Treat 10.12.70.0/24 as the VPN zone and apply the office segmentation matrix: VPN → Corporate/Application/Cloud-Transit allowed, Data only via the Application tier, Management gated to admins. Guest/IoT remain unreachable.
4. AWS reachability needs no change — 10.12.70.0/24 is covered by the 10.12.0.0/16 already advertised over the office↔AWS tunnel.

5.1 Client profile (client.ovpn)

client
dev tun
proto udp
remote vpn.corp.example.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth-user-pass                 # prompts for the RADIUS username/password
cipher AES-256-GCM
auth SHA256
verb 3

<ca>
# contents of ca.crt
</ca>
<tls-crypt>
# contents of tls-crypt.key
</tls-crypt>

Distribute this single .ovpn to all users (it carries no per-user secret); each signs in with their RADIUS credentials in the OpenVPN Connect client.

6. Native alternative — L2TP "Remote User VPN" + RADIUS (no scripting)

If you'd rather use a fully GUI-supported path with built-in OS VPN clients:

1. Enable the built-in RADIUS server and create users (§3), or create a RADIUS Profile pointing at an external server (e.g., Windows NPS / FreeRADIUS).
2. UniFi Network → Settings → VPN → Remote Access (L2TP) (or create a network of type Remote User VPN): set the client subnet (10.12.70.0/24), a pre-shared key, and select the RADIUS profile.
3. Clients use the OS-native L2TP/IPsec VPN with their RADIUS username/password.

This is the supported route; the trade-off is L2TP instead of OpenVPN (some networks block L2TP/IPsec, where OpenVPN-over-UDP/TCP is more firewall-friendly).

7. Verification and notes

• Test auth: connect with a valid RADIUS user (should succeed) and a bad password (should be rejected). Check the OpenVPN log for RADIUS-PLUGIN: ... authenticated.
• Test reach: from the connected client, ping an office host (10.12.x.x), an AWS private IP (10.1.x.x), and resolve db.aws.corp.example.com (should return its private VPC IP via the pushed UDM DNS).
• MFA / stronger auth: point the RADIUS plugin at a RADIUS server that supports MFA (e.g., NPS with an MFA extension, or FreeRADIUS + a TOTP/duo module) instead of the built-in server if you need second-factor.
• Accounting: the plugin's acctport sends start/stop records to RADIUS, giving you per-user connection logs.
• Supportability: running OpenVPN on the UDM via on-boot scripts is community tooling and not covered by Ubiquiti support; the dedicated mgmt-VLAN host is easier to patch and survives firmware upgrades cleanly.
• Scale/modern option: for a low-maintenance remote-access VPN, UniFi Identity (Teleport/WireGuard with SSO) is worth evaluating — it trades RADIUS username/password for key-based + identity-provider auth.