Centralized Authentication for WireGuard: LDAP and RADIUS
Managing access to a corporate VPN without centralized authentication means manually adding keys for each employee, errors during offboarding, and lack of auditing. In companies with 50+ users, such approaches lead to wasted time and security gaps. For example, a typical delay when an employee leaves is 2–3 days until the key is deactivated. Over a year with 10 departures, this amounts to 300 hours of unauthorized access. Automation via LDAP or RADIUS eliminates these risks.
We offer integration of WireGuard with LDAP or RADIUS. This reduces administrative burden by 70% and eliminates human errors. Return on investment is achieved within 3–6 months due to savings on administration. Contact us for an audit of your infrastructure and an accurate cost estimate.
How to Integrate WireGuard with LDAP?
There is no pure native integration of WireGuard with LDAP. The protocol operates at L3 level and does not know about user authentication. Therefore, we use one of two approaches.
Approach 1: wg-portal — a web interface for managing WireGuard with LDAP authentication support. Users log in through the corporate directory and download the client config themselves. The administrator manages accesses via UI. LDAP configuration in config.yml:
Example wg-portal configuration with LDAP
ldap:
enabled: true
url: "ldaps://dc01.corp.example.com:636"
base_dn: "DC=corp,DC=example,DC=com"
bind_user: "CN=vpn-bind,OU=ServiceAccounts,DC=corp,DC=example,DC=com"
bind_password: "${LDAP_BIND_PASSWORD}"
user_filter: "(&(objectClass=user)(memberOf=CN=VPN-Users,OU=Groups,DC=corp,DC=example,DC=com))"
user_id_attribute: sAMAccountName
user_mail_attribute: mail
sync_interval: 300
tls_ca_cert: /etc/ssl/certs/internal-ca.crt
The VPN-Users group in AD controls access: add a user to the group — they get access to the portal. Remove them — at the next synchronization (every 5 minutes by sync_interval), their peer is deactivated. Supports up to 500 users without performance loss.
Approach 2: RADIUS — for companies that already use RADIUS (Cisco ISE, FreeRADIUS, NPS). Authentication is configured via wg-easy with a RADIUS backend or a custom script based on pyrad. This integrates naturally into the existing security infrastructure. Comparison:
| Criteria | wg-portal | RADIUS |
|---|---|---|
| Ease of setup | High | Medium |
| Connection audit | Via portal | Via RADIUS logs |
| PKI support | No | Yes (when configured) |
| Maintenance complexity | Low | Medium |
Advantages of wg-portal over RADIUS
wg-portal is better suited for most medium and large companies. It provides a ready-made self-service interface for users and reduces the time the IT department spends managing VPN accesses by 3–5 times. Unlike the RADIUS scheme, it does not require additional infrastructure and is easily scalable. Total cost of ownership (TCO) is reduced by up to 50% through automation. For a typical company of 100 people, this results in significant annual savings.
How to Set Up Split Tunneling for Corporate Networks?
In the client config, specify only the required subnets in AllowedIPs, for example 10.0.0.0/8, 172.16.0.0/12. Then internet traffic goes directly, and only internal addresses go through the VPN. This reduces server load and improves speed. When integrated with LDAP, the portal automatically generates a correct config for each user.
Automatic Key Rotation on a Schedule
Key rotation is a weak point of any WireGuard installation. WireGuard documentation recommends changing keys every 90 days. When using wg-portal, rotation is done via the UI with automatic distribution of the new config. With manual management, a process is needed: calendar reminders, update script, distribution procedure. We guarantee that our solutions include automatic key rotation on a schedule.
Operational Details and Security
WireGuard connection logging is minimal: wg show shows the last handshake, but not history. For auditing, we use journald + wg-portal's access log or a separate syslog-forwarder. When integrated with RADIUS, each authentication event is logged on the RADIUS server side — providing a full audit trail.
Firewall on the server: port 51820/udp is open only to corporate networks or through a cloud security group. The wg-portal web interface (usually :8888) is exclusively behind a reverse proxy with TLS and, ideally, IP restriction. Our certified specialists ensure compliance with security policies.
What Is Included in the Work
- Audit of existing LDAP/AD structure: identify required OUs, groups, bind account with minimal permissions.
- Installation and configuration of WireGuard on the server.
- Deployment of wg-portal with LDAP integration configuration.
- DNS split-tunneling setup for traffic routing.
- Testing of onboarding/offboarding: adding to AD group → appearing in portal, removal → blocking.
- Documentation of procedures for the IT department.
- Training for administrators on using the portal.
- 30-day warranty support.
Timeline and Cost
| Scope | Timeline |
|---|---|
| Up to 50 users, one site | 2–3 days |
| 50–200 users, multiple offices | 4–7 days |
| Integration with existing PKI and RADIUS | up to 2 weeks |
Cost is calculated individually after an infrastructure audit. Request an assessment of your project to receive a detailed commercial proposal and timeline. We also provide post-deployment support: monitoring, fine-tuning, training your engineers.
WireGuard — open-source VPN protocol. LDAP — directory access protocol.