You cannot add an RFC 6238 suffix to OpenVPN passwords in pfSense because RFC 6238 defines Time-based One-Time Passwords (TOTP), which are generated dynamically by a client application like Google Authenticator, not static password modifications. To implement this security feature, you must configure the pfSense OpenVPN server to require TOTP authentication using the totp-secret field and enable the appropriate auth provider.
Understanding RFC 6238 and OpenVPN Authentication
RFC 6238 is the standard for Time-based One-Time Password Algorithms. In the context of network security, it is almost exclusively used for Two-Factor Authentication (2FA). It is critical to correct the common misconception that one can simply append a six-digit code or specific suffix to a static user password within the pfSense configuration interface. The protocol requires a shared secret key stored on both the server and the client device to generate synchronized time-based codes. OpenVPN supports this mechanism through its built-in authentication modules. When you configure an OpenVPN server instance in pfSense, you are not modifying the password string itself. Instead, you are instructing the server to validate two distinct components during the handshake: the standard username/password credential and a dynamic TOTP code provided by the client. This ensures that even if a password is compromised, the attacker cannot connect without access to the user’s authenticator app. For users managing complex routing setups, it is worth noting that enabling 2FA does not alter the underlying tunnel mechanics. If you are setting up a remote access client-to-site VPN, the connection process remains standard, but the client must now supply the additional token. You can review how to establish such connections in our guide on Creating an OpenVPN Remote Access Client-to-Site VPN without Routing All Traffic. This ensures your base connectivity is solid before adding the layer of authentication complexity.Configuring TOTP in pfSense OpenVPN Server
To properly implement RFC 6238 support, you need to access the pfSense web interface and navigate to the OpenVPN configuration. Start by going to VPN > OpenVPN and selecting the server instance you wish to modify. Click the edit icon (pencil) to open the configuration details. The first step is to locate the Auth Provider section. By default, many installations use local system authentication. However, to support TOTP, you generally need to ensure that the authentication backend can handle extra fields. In modern versions of pfSense, the local user database can store TOTP secrets, but you must explicitly enable the option to require them. Look for a checkbox labeled Require TOTP or similar wording depending on your version. If this option is missing, you may need to install thepfsense-openvpn-auth-radius package or ensure your user accounts have been updated with the necessary secret keys via the command line or API, as the GUI sometimes hides advanced crypto settings.
Next, verify the Cipher and Key Direction settings. While these do not directly affect TOTP generation, they must be compatible with the clients you intend to support. Ensure that the Protocol is set to UDP or TCP as required by your network infrastructure. Incorrect protocol settings can cause timeouts that mimic authentication failures, leading administrators to believe their TOTP setup is broken when it is actually a network issue.
Generating and Distributing TOTP Secrets
Once the server is configured to expect TOTP codes, you must generate the shared secrets for each user. This is typically done outside the main OpenVPN configuration page. In pfSense, you can manage users under System > User Manager. Select the user who needs 2FA enabled. Inside the user profile, look for a tab or section dedicated to Two-Factor Authentication or TOTP Secret. Here, the system will generate a Base32-encoded secret key. You should display this key securely, preferably as a QR code, so the user can scan it with their authenticator app (such as Google Authenticator, Authy, or Microsoft Authenticator). Do not distribute these secrets via email or unencrypted channels. After the user has scanned the code, you must test the synchronization. Ask the user to enter their current six-digit code into the "TOTP Code" field on the pfSense user edit screen if available, or simply attempt a login. If the code matches the expected value based on the current time window, the secret is correctly linked. If you encounter issues where programs fail to connect despite correct credentials, check your firewall rules and routing tables. A common pitfall is that the OpenVPN service might be blocked from reaching certain internal resources. Refer to Verify whether a tun interface (created by OpenVPN) offers access to the Internet to ensure your tunnel interfaces are functioning correctly before blaming the authentication module.Client Configuration and Troubleshooting
On the client side, the OpenVPN configuration file (usually a.ovpn file) must be updated or interpreted by the client software. Most modern OpenVPN clients (like OpenVPN Connect or the desktop client) will prompt for a second password or a separate TOTP field automatically if the server requests it.
If the connection fails, check the pfSense logs under Status > System Logs > OpenVPN. Look for entries indicating ERROR: Invalid username/password combination or specific TOTP validation errors. A frequent error is "Time skew," which occurs when the client device's clock is significantly out of sync with the pfSense server. NTP drift of more than 30 seconds can cause TOTP codes to be rejected. Ensure both the pfSense box and the client devices are syncing time via reliable NTP servers.
Another common issue arises when users try to reuse old passwords or skip the TOTP step. Since RFC 6238 is a stateful protocol based on time, there is no "suffix" to remember statically. Users must generate a new code every 30 seconds. Educate your team that this is not a password extension but a dynamic token. For further assistance with general connectivity problems, see Program won't connect through OpenVPN.
Frequently Asked Questions
Can I manually type a TOTP code into the password field?
No, the TOTP code must be entered in a separate field designated for the second factor. Mixing it with the static password will result in an authentication failure because the server validates the TOTP against the shared secret independently of the password hash.
What happens if my device clock is wrong?
If the time difference between your client and the pfSense server exceeds the allowed skew (usually 30-90 seconds), the TOTP code will be rejected. Synchronize your device time using NTP to resolve this issue immediately.
Does this work with RADIUS authentication?
Yes, if you are using a RADIUS server like FreeRADIUS, you can configure it to handle TOTP verification. pfSense acts as the client to the RADIUS server, passing the username, password, and TOTP code together in the authentication request.
How do I reset a user's TOTP secret?
Navigate to the user account in the pfSense User Manager, find the TOTP section, and click the regenerate or delete button. This will create a new secret key that the user must re-scan with their authenticator app.
Is RFC 6238 supported on all OpenVPN clients?
Most modern desktop and mobile clients support TOTP natively. However, older or lightweight CLI clients may require plugins or manual script hooks to provide the second factor during the connection phase.