OpenVPN timeout with MFA

dakotabcn · June 16, 2026, 2:32pm

Hello, I'm configuring OpenVPN + MFA using OpenTOP. Using AI, I've been refining and adjusting parameters, but I've run into a problem. If the user approves the connection quickly, everything works fine. However, if they take 10-15 seconds, I see in "active connections" that the connection has been approved, but the OpenVPN client doesn't register it and sends the request again.

I've been analyzing and consulting, and according to AI, it's an issue with the OpenVPN server. Their explanation:
"In MikroTik, the OpenVPN server (ovpn-server) isn't managed in isolation, but rather runs in the background within the PPP subsystem (just like L2TP or PPTP).

The RouterOS PPP daemon has a strict internal timeout for the authentication phase (usually around 3 to 5 seconds). This is what happens chronologically when you take 15 seconds:

The PC requests a connection. MikroTik freezes the session and sends a RADIUS request to WebADM.

5 seconds pass. The MikroTik PPP subsystem gets tired of waiting, internally declares the negotiation thread expired, and stops listening to the client on your PC.

After 15 seconds, you tap "Approve" on your mobile device.

WebADM responds to MikroTik with a RADIUS packet." Access-Accept (Access Granted).

Here's the MikroTik flaw: The router's RADIUS client receives the "OK," blindly accepts it, and takes the user to the Active Connections tab. However, since the original PPP negotiation thread with the PC had already closed after 5 seconds, the router never sends the final confirmation packet to the PC.

How can I fix this? If I'm quick, everything works fine, but if the user is slow or their phone is far away, the connection drops. I need a 30-second window where, if the connection is approved, the client is notified. How can I do this with MikroTik?

dakotabcn · June 17, 2026, 11:00am

Screenshots showing the problem: The OpenVPN Client makes the request. Upon receiving the request, the Mikrotik checks that it's not a local user and passes it to the RADIUS router. The RADIUS router then sends it to OpenOTP, and since it's a user of that system, it sends a validation push request to the user's mobile device. The user validates it, and OpenOTP confirms to the Mikrotik that it's valid.
If this happens in less than 5 seconds, the Mikrotik sends the OK to the user's OpenVPN client, and everything works perfectly. However, if it takes longer, as in the screenshots, the Mikrotik validates it, puts the user in active connections, but doesn't send the message to the client. Since the OpenVPN Client doesn't seem to recognize the request, after 30 seconds it sends another connection request. The Mikrotik processes it and sends another request to OpenOTP, which then sends it to the client... but this shouldn't happen.

Is there a solution to prevent this from happening if the RADIUS request takes more than 5 seconds? And confirm to the user that their session is active?