Pritunl for Corporate VPN: Web Interface, MFA, and WireGuard

Pritunl for Corporate VPN: Web Interface, MFA, and WireGuard Turnkey

Imagine you administer 50–100 remote employees and manually generate an OpenVPN config for each. Creating one takes 10–15 minutes, revoking another five. As the team grows, this becomes a headache, and support time eats resources. Pritunl solves this: all management via web interface or API, users added in a couple of clicks. We deploy Pritunl as an alternative to commercial VPN solutions—with centralized management, support for OpenVPN and WireGuard, built-in MFA, and clustering. Our experience includes over 50 successful VPN projects. Certified engineers ensure stable 24/7 operation with 99.9% SLA. Contact us for professional Pritunl setup—forget routine operations.

Why Choose Pritunl Over OpenVPN Access Server?

Let's compare the two solutions:

Pritunl can save up to 80% of budget on licenses compared to commercial alternatives. Average deployment time is 1 day, while OpenVPN Access Server can take up to 3 days for LDAP integration and cluster setup.

How to Install Pritunl on a Server

Installation is performed on Ubuntu LTS (recommended 22.04). Add the repository with a single command:

# Add Pritunl repository
echo "deb https://repo.pritunl.com/stable/apt jammy main" | sudo tee /etc/apt/sources.list.d/pritunl.list
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com --recv 7568D9BB55FF9E5287D586017AE645C0CF8E292A
sudo apt update
sudo apt install -y pritunl mongodb-org
sudo systemctl enable --now pritunl mongod

After starting, obtain the setup key and enter it in the web interface via HTTPS. Configure the connection to MongoDB—either local or remote replica. Learn more about the project on GitHub.

What's Included in Turnkey Pritunl Setup

We offer a comprehensive deployment service:

• Installation and configuration on Ubuntu LTS.
• Organization, users, and server setup (OpenVPN or WireGuard).
• LDAP/Active Directory integration (Enterprise version).
• Enable MFA (TOTP) for all users.
• Monitoring setup via Prometheus and Grafana (including dashboards).
• Performance optimization: protocol, encryption, DNS selection.
• Documentation and team training.
• Post-release support for one month (99.9% SLA).

We guarantee SLA and provide replacement in case of issues. Contact us to discuss your project details.

How to Set Up High Availability

For high availability, we deploy multiple Pritunl servers and connect them via MongoDB replication. Each server runs pritunl and mongod (or uses external MongoDB). Traffic is distributed via DNS round-robin or a load balancer. The web interface and API are accessible through any node. Recommended configuration: three nodes in the cluster, ensuring 99.9% availability.

User Management and MFA

Pritunl uses the architecture: Organization → Users → Servers. A server is linked to an organization, and users receive personal configs. Through CLI, you can bulk import users:

# Create organization
pritunl create org MyCompany

# Import users from CSV
while IFS=',' read -r name email; do
    pritunl create user "$name" --org MyCompany --email "$email"
done < users.csv

Enable MFA for an individual user:

curl -X PUT "https://localhost/user/<user_id>" \
 -u admin:<api_token> \
 -H "Content-Type: application/json" \
 -d '{"otp_auth": true}'

The user sees a QR code for TOTP on first connection.

Monitoring and Security

For monitoring, we use Prometheus with an unofficial exporter or set up log collection via Syslog. Open VPN ports (1194/udp for OpenVPN, 51820/udp for WireGuard) via ufw:

ufw allow 1194/udp
ufw allow 51820/udp
ufw allow 443/tcp
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

We ensure that the firewall configuration follows best practices. Additionally, we set up monitoring metrics: active connections, bandwidth, authentication errors.

Protocol Comparison: OpenVPN vs WireGuard

Protocol choice depends on tasks: WireGuard is better for mobile employees and high speeds, OpenVPN for legacy compatibility.