Most small office VPNs still log in with nothing but a config file. Whoever holds that file holds the keys to your network. This upgrade adds a named account, a password and a one time code to every login - using the OpenVPN built into your firewall.
In the video, the whole upgrade happens inside the firewall admin interface: open the firewall address in a browser, go to OpenVPN, open the Server settings, and work through authentication first. Nothing here needs a new server or a paid add on. The order matters though - switch things in the wrong sequence and you can lock everyone out, including yourself. This page follows the safe order: audit, authenticate, name every user, add MFA, replace the configs, then test.
A standard OpenVPN setup authenticates the file, not the person. The client config contains the certificate and keys, so a copied file - from an old laptop, a pen drive, a forwarded email - connects exactly like the real user. There is no password to change and no way to ask "who was that?" afterwards. If your office still runs one shared config for everybody, that file is effectively a master key to your LAN, and it has probably been copied more times than anyone remembers.
The first change in the video is in the OpenVPN server settings on the firewall: choose username and password authentication and Save. From that moment a config file alone is no longer enough - the client also asks who you are. Do this before creating users only if you can finish the whole job in one sitting; otherwise create the users first (next step) and flip this switch when at least the admin account exists and is tested. The rule is simple: never enable a login requirement before the logins exist.
Next, the video builds the user list in the Local Directory: open Configure Local Directory, add each person with their name, full name and a proper password, then Save. One account per human being - never a single "office" login that five people share. Named accounts are what make everything else in this guide possible: MFA is enrolled per account, access is revoked per account, and the connection logs finally mean something because each line carries a real name.
This is the heart of the upgrade. For each account, the video uses the Add MFA client configuration option and saves it; the server then offers an MFA key or QR code for that user. The user scans the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator or any TOTP app), and from then on every connection needs three things: the config file, the username and password, and the six digit code from the phone. A stolen config or a leaked password on its own now connects nothing. Enrol each person with their own phone present - the QR code is a secret and should never be sent around as a screenshot.
After MFA is on, go back and download the client configuration file for each user from the same interface, the way the video does, and have every user import the fresh config into the OpenVPN client and delete the old one. Treat the new files like keys: hand them over through a channel you trust, not in a group chat. The first connection with the new setup asks for the username, the password and then the one time code - if a user still connects without being asked, they are using an old config or an old session, and that needs chasing down the same day.
Before touching everyone's laptop, prove the whole chain with one test account: connect, enter credentials, enter the code, open an office application, disconnect, reconnect. Only then roll out person by person. Keep the firewall's configuration backup from before the change until a full week has passed without complaints - it is your way back if something subtle breaks. The video closes with an important practical note: test the final setup from a genuinely external network (mobile data works), because a VPN that only works from inside the office proves nothing.
Every click shown live - authentication settings, local directory users, the MFA QR code and the first connection with a one time code.
▶️ Watch Full VideoOn the firewall based OpenVPN shown in the video, the two step verification option is built into the server settings - you enable it per user account and enrol with a free authenticator app. No separate MFA product is purchased in the video.
Three things, in order: they open the connection with their client config, enter their username and password, and then enter the six digit one time code shown in their authenticator app. The code changes every 30 seconds.
You can keep the file, but sharing one account defeats the upgrade. MFA and revocation only work when every person has their own named account, so create one local directory account per person first, exactly as the video shows.