OpenVPN + MikroTik
A webhook on connect/disconnect, personal NAT rules on the perimeter equipment, granular access to resources.
- ~131 users in production
- Address-list and NAT per user
- Access closes automatically when the VPN drops
GersaSoft · on-premise
GERSA MFA
Multi-factor authentication and dynamic network access control: VPN, personal NAT rules, anti-vishing and Office 2FA.
Three protection contours
One platform joins remote access, messenger approval and two-factor Windows sign-in.
MAX / Telegram 2FA
Two-step approval: “were you asked to sign in?” → “allow / deny”. A block on a vishing attempt.
- Push in MAX and Telegram
- TOTP (Google, Yandex, MTS)
- Event log and audit
Office 2FA
A Credential Provider for Windows: login + password + TOTP for domain sign-in and RDP. Enabled by the AD group “2FA”.
- Windows logon and RDP
- Active Directory / LDAP
How it works
The VPN tunnel and access to an application resource are different stages. Access opens only after a successful 2FA.
| Stage | Action |
|---|---|
| 1 | The user opens a VPN session to MikroTik OpenVPN |
| 2 | The gateway sends a webhook to the access-control server |
| 3 | 2FA starts: a messenger push or a TOTP prompt |
| 4 | After approval, the personal NAT rule is enabled |
| 5 | The user reaches their TS/PC through a VIP address |
| 6 | On VPN disconnect the rule turns off automatically |
Platform components
| Component | Role |
|---|---|
| VPN gateway (MikroTik) | OpenVPN/PPP, webhook connect/disconnect |
| 2FA server (Python/Flask) | Webhook API, NAT control, MAX/TG bots |
| Admin panel | Users, NAT, certificates, Office 2FA, TOTP |
| Active Directory | Accounts, groups, LDAP |
| Windows CP | Three-field sign-in: login + password + TOTP |
GERSA MFA pricing
A per-user license or full unlimited for $8,319.04 in the first year — VPN, anti-vishing, Office 2FA and personal NAT.
Prices are the ruble amounts at the Bank of Russia rate.
Full unlimited — the first year, turnkey. The plan includes the license and deployment ($2,297.05): MikroTik, AD/LDAP, VPN, MAX/Telegram bots, Office 2FA, personal NAT. CAL plans are the license only. For self-deployment, unlimited is $6,021.99 instead of $8,319.04.
Start
$122.92 / user / year
5–24 users · VPN + TOTP
Business
$74.50 / user / year
25–99 · + MAX / Telegram anti-vishing
Corporate
$49.67 / user / year
100–499 · + Office 2FA, personal NAT
Full unlimited
$8,319.04 · first year
∞ users · every platform module
Deployment — $1,862.47 separate
| VPN users | CAL (by plan) | Full unlimited | Saving |
|---|---|---|---|
| 50 | $3,724.95 | $8,319.04 | CAL for now |
| 112 | $8,343.88 | $8,319.04 | crossover point |
| 131 | $6,506.24 | $8,319.04 | ∞ modules and users |
| 200 | $9,933.19 | $8,319.04 | $1,614.14 per year |
| 500 | $24,832.97 | $8,319.04 | $16,513.92 per year |
Minimum order — 5 users. CAL is the license for a year. Full unlimited is the first year with deployment ($2,297.05); self-deployment is $6,021.99. Unlimited renewal from year 2 does not include deployment. Individual terms on request.
Considering an MFA deployment?
We will discuss the architecture for your network, MikroTik and security policy.