Hackers breached Colonial Pipeline using compromised password
If your budget is tight you might consider the following for MF for your VPNs:<p>pfSense VM at work with a single interface and an OpenVPN server listening with a server cert minted from your AD CA - this is your VPN concentrator.  You get your OpenVPN server to hand off auth to RADIUS which is a DC with the NPS service installed.  Mint SSL certs for all your domain joined users and computers via your AD CA.  Investigate this parameter: cryptoapicert &quot;SUBJ:&quot; on your OpenVPN clients.<p>All of this stuff is documented in various places and I&#x27;ve dropped most of the clues!<p>You can actually fold in more factors with this.  So the PC&#x2F;user must have a SSL cert minted by the AD CA and a password, and a OTP via something like Google authenticator.<p>I&#x27;d start with short lived (say one month) AD minted SSL certs and then decide whether you need more factors.<p>Remember that a domain joined PC doesn&#x27;t work very well at password change time if encryption and VPN connections rely on AD passwords.<p>Now, once you allow your folks on site - what do you allow them to access?  Get your firewall rules sorted.