Hey Guys, i love the uncomplicated way how WireGuard works and the Users are much more confident with a stable working VPN. But in nearest time i need to secure these way with 2FA. I just read some threads where they hint to UserManager and OTP Secret. But i really need some more help with this. …

You can’t Wireguard doesn’t have any accounting as far as I know. 2FA with userman

You can’t Wireguard doesn’t have any accounting as far as I know. 2FA with userman Yes i found this wiki but there is no description from where i get the OTP Secret

Not helpful but wondered if tailscale does this… https://tailscale.com/kb/1075/multi-factor-auth/ About WireGuard and 2FA/MFA login WireGuard® is a modern and fast encrypted networking protocol that offers a number of performance benefits over traditional VPNs and TLS. Among other important featu…

http://forum.mikrotik.com/t/feature-request-two-factor-authentication/60077/38

Hey, as far as i unterstand its more a Problem of the Client as an Problem with the Server. I’ve found the tunsafe Client as a github Project, as far as i understand i just have to add this line to my ServerConfig [Peer] RequireToken = totp-sha1:SECRET,digits=6,period=30,precision=15 and if i u…

Main problem is that WG is just tunnels with static config using only keys, there’s no support for anything else. So if you see WG with 2FA, it’s either something extra aside handling it and controlling WG layer (Tailscale) or custom extension to standard WG (TunSafe): They’re right, some standard…

Main problem is that WG is just tunnels with static config using only keys, there’s no support for anything else. So if you see WG with 2FA, it’s either something extra aside handling it and controlling WG layer (Tailscale) or custom extension to standard WG (TunSafe): They’re right, some standa…

It may work, but non-standard is bad. Even if MikroTik implemented this extension, it still wouldn’t work with any standard WG client. And then someone else would come with own incompatible solution, because they wouldn’t like this one for some reason. And someone else would implement that. And ther…

But on Server side there is nothing more to implement as the posibility to set this Parameter or not On „normal“ Wireguard Servers you only add the line and go for it. And that is per Peer so you can decide which peer becomes totp and which not

Did you test it with normal server (e.g. standard unmodified Linux WG) and did it work? I didn’t study it in detail, but from the quick look, if it’s extension to protocol, standard server wouldn’t have any support for it.

MikroTik community forum

Wireguard / 2FA

RouterOS General

anav November 25, 2025, 3:03pm 20

How to add 2FA to MikroTik logins Security

Important: The RouterBOARD (and the device where the code is generated) must be perfectly synchronized with NTP. Otherwise, it is impossible to log in. No RouterBOARD sold since 2007 has an internal battery; the device ALWAYS starts with the wrong time. ASCII-7 table: <SPACE>!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ Before starting, as a general rule, use only ASCII-7 characters on usernames and passwords, and never any other characters …

show post in topic

Home
Categories
Guidelines

Powered by Discourse, best viewed with JavaScript enabled