In case you’re using self-signed x509 certificates you may see this error message within the traefik logs – the solution is quite easy: the first certificate of your combined pem file (ca+intermediate+server) has to be the server certificate!
Grandstream VoIP telephones are very popular because of their high build quality compared to an excellent price. In some cases you want to use an encrypted communication channel between your device and the PBX (e.g. asterisk). The current grandstream firmware includes basic OpenVPN support (client mode, tun) which allows you to tunnel the whole SIP/RTP traffic over an encrypted channel. This is also the best solution to avoid any kind of NAT/routing issues because all devices are directly accessible within the virtual ip subnet.
Use the following (minimal) configuration as template. The important options are set to work with the current grandstream firmware (1.0.4.106). Certificate based authentication is preferred for security (login/password not needed)!
tls-server dev tunX topology subnet server 172.16.1.0 255.255.255.0 port 10111 proto udp # cert based auth pkcs12 server.p12 # 1024 and 2048 bit dh params are supported dh dh2048.pem keepalive 10 120 script-security 2 # bh-cbc as well as aes-128-cbc are supported by the current firmware cipher aes-256-cbc # well sha1 is a bit weak but its set within grandstream firmware auth sha1 # compression has to be enabled comp-lzo tun-mtu 1500 mtu-disc yes # custom logging verb 3 # retain TOS flags (VoIP) passtos # internal network (VOIP Server) push "route 10.16.0.1 255.255.255.0"
You may use Strato HiDrive as an external storage for team collaboration, internal file-sharing or remote backups. In such cases it can be very useful to establish the secure connection via your corporate UTM Gateway instead on each client. This only requires an additional HiDrive Account which has the ability to connect via VPN (Login allowed via OpenVPN).
This solution requires the HiDrive business plans with advanved protocol featureset!
First of all, you have to download the official openvpn config package directly from the Strato Website. It contains the CA, TLS-Auth Key as well as a poor OpenVPN Config.
Go into the pfSense Webinterface and add a new CA – paste the content of the ca.drive.strato.com.crt file into the textarea and save it. The CA is now available within the OpenVPN Client config.
Finally goto VPN -> OpenVPN -> Clients and create a new instance.
You should use a dedicated HiDrive User-Account which has the ability to connect via VPN. Use this account credentials for the OpenVPN User Authentication.
By default, OpenVPN uses BF-CBC as cipher with SHA1 auth – not AES as set in pfSense GUI.
This is the most tricky/weak part..Strato is using the TLS-Auth Key in bidirectional mode, which is not recommended. Normally the key-direction 0 will be used for servers, 1 for clients and pfSense is not offering an option to change this via the GUI.
But its possible to add the TLS-Auth Key as inline statement under “Advanced Configuration -> Custom Options” without a key-direction (bidirectional by default). Just paste the following code. It contains the TLS-Auth key as of Mai 2017.
Manual TLS-Auth Config
tls-auth [inline]<tls-auth>-----BEGIN OpenVPN Static key V1----- aa21c5facb594491bc40959f73ff1f79 be815195f2b9b22d3c672e9580db574a ada6fa5e22a9be42c744b91fe988f4fc 582480ae85ea00fd59b60757d7cf859d ceb3ca0f35b0ba9af1947521de78a917 7947ffb55a1fef3d800779fac89d2879 fe9f8fd87a99b1f82561ab9b2e91e5c2 e788f92016f5f47ba1ff158897a26a5c 79f627de5c48a9828c0ca4df34b5ef40 eab016669f28e0c84ed6c7974a12ec19 15a16e213d4a70832c85b59ccc74277f da3309006c90289f1fca2c726eada188 3a86299a865149b7e178ad6235e1a153 775896594296ff24d2ab63f881021a2b 8a23e100df2153e332c0d0bb555185eb 2da94fd9b2b1b950acd075044607eddf -----END OpenVPN Static key V1-----</tls-auth>