By default, the phone does not attempt to connect using OpenVPN. These options must be enabled.
At present, all released versions of firmware support OpenVPN connectivity.
OpenVPN connectivity is supported by models A20, A22, A25, and A30.
OpenVPN server configuration must not require manual password entry in order to connect. The phone does not provide the user a means of inputting user and/or password credentials as a part of VPN connection.
Certificates have been tested in CRT format only.
In order to connect to an OpenVPN server, the phone utilizes an OpenVPN configuration file (client.ovpn), a Root (CA) certificate (ca.crt) ,client KEY (client.key), and client CRT (client.crt) files. These files must be manually updated to the phone, using an admin web UI user. Or, the phone must be configured to retrieve a .tar.gz file containing them, using its configuration file. The phone will, when directed by its configuration, attempt to cURL those files in from a defined http or tftp server.
These files can only be retrieved from a location that requires no HTTP authentication. Once the files are retrieved, the phone will store them locally and will use them on successive boots. If the phone receives a new configuration file, and the URL has changed, the phone will retrieve the new package and use its contents instead.
It is important to note that the phone must be able to retrieve the OpenVPN configuration files without actually being connected to the VPN. This presents a chicken-and-egg scenario that is most often solved by connecting the phone to an already-secure network, feeding it a configuration file that points to VPN configuration files that can be retrieved, and then, once successfully loaded, moving the phone to the insecure network.
Configuration of OpenVPN can be performed via the phone's web UI. This section will cover configuration via the phone's configuration file.
The VPN mode element controls the type of VPN to be used. In this case, we are configuring for OpenVPN, so the value is 2.
The Enable VPN Tunnel element controls whether or not the phone is to start up the OpenVPN connection. It defaults to 0, so it must be set to 1.
The Auto etc Url element contains the URL path to a .tar.gz package of the OpenVPN configuration files, containing:
The .tar.gz file should contain the configuration files and may be constructed as such:
When the VPN is Enabled
When the Enable VPN Tunnel element is enabled on the phone, the phone will display a lock in the status bar, e.g.:
Which differs from the normal, not connected to a VPN, icon:
The VPN-connected IP address is visible only in the phone's web UI, in the Network>VPN screen under "Virtual Private Network (VPN) Status."
The OpenVPN configuration file
OpenVPN has myriad configuration options, and not all can be or have been tested with Digium's A-Series phones. A tested, sample configuration file is provided here:
Within this file you must pass in the ca, cert, and key parameters as ca.crt, client.crt, and client.key. Further, they must be passed in without directory declarations - OpenVPN will search for them in the local directory.
It is not possible to in-line the ca, cert, or key parameters.