Abratel Telecom & Info

Yealink T20P

Versao do firmware 9.73.0.40
Versao do hardware 7.0.0.54

Existe um bug que se colocar o nome dns do servidor de destino openvpn, o telefone não funciona. Sendo necessário desativar a VPN pelo painel frontal e posterior mudar o arquivo de conf do cliente para o número do ip do servidor.

<strong>[root@ipbx ~]# openvpn --version</strong>
OpenVPN 2.4.4 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 26 2017

[root@ipbx ]# uname -a
Linux ipbx.localdomain 3.10.0-693.5.2.el7.x86_64 #1 SMP Fri Oct 20 20:32:50 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

CENTOS 7

Step 1 — Installing OpenVPN

yum install openvpn easy-rsa -y

cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn

mkdir /var/log/openvpn
touch/var/log/openvpn/openvpn.log

Let’s create a directory for the keys to go in.

mkdir -p /etc/openvpn/easy-rsa/keys
# We also need to copy the key and certificate generation scripts into the directory.

cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa
# or download in git. I install version 2.2 

To make life easier for ourselves we’re going to edit the default values the script
uses so we don’t have to type our information in each time. This information is stored
in the vars file so let’s open this for editing.

vi /etc/openvpn/easy-rsa/vars

We’re going to be changing the values that start with KEY_. Update the following values to be accurate for your organization.

The ones that matter the most are:

KEY_NAME: You should enter server here; you could enter something else, but then you would also have to update the configuration files that reference server.key and server.crt
KEY_CN: Enter the domain or subdomain that resolves to your server
For the other values, you can enter information for your organization based on the variable name.

# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="BR"
export KEY_PROVINCE="RJ"
export KEY_CITY="RiodeJaneiro"
export KEY_ORG="Abratel"
export KEY_EMAIL="sammy@abratel.com"
export KEY_OU="AbratelTelecom" here i put same the name server

We’re also going to remove the chance of our OpenSSL configuration not loading due to the version being undetectable. We’re going to do this by copying the required configuration file and removing the version number.

Certificate:

openssl-1.0.0.cnf
easy-rsa release 2.2

I need change for SHA1 (because Yealink and Mikrotik clients)

[root@ipbx easy-rsa]# cat /etc/openvpn/easy-rsa/openssl.cnf 

default_days    = 3650                  # how long to certify for
default_crl_days= 30                    # how long before next CRL
default_md      = SHA1          # use public key default MD
preserve        = no 

[ req ]
default_bits            = $ENV::KEY_SIZE
default_keyfile         = privkey.pem
default_md              = SHA1


cp /etc/openvpn/easy-rsa/openssl-1.0.0.cnf /etc/openvpn/easy-rsa/openssl.cnf

To start generating our keys and certificates we need to move into our easy-rsa directory and source in our new variables.

cd /etc/openvpn/easy-rsa
source ./vars

Then we will clean up any keys and certificates which may already be in this folder and generate our certificate authority.

./clean-all 

When you build the certificate authority, you will be asked to enter all the information we put into the vars file, but you will see that your options are already set as the defaults. So, you can just press ENTER for each one.

./build-ca 

The next things we need to generate will are the key and certificate for the server. Again you can just go through the questions and press ENTER for each one to use your defaults. At the end, answer Y (yes) to commit the changes.

./build-key-server server 

We also need to generate a Diffie-Hellman key exchange file. This command will take a minute or two to complete:

./build-dh 

That’s it for our server keys and certificates. Copy them all into our OpenVPN directory.

cd /etc/openvpn/easy-rsa/keys
cp dh2048.pem ca.crt server.crt server.key /etc/openvpn 

All of our clients will also need certificates to be able to authenticate. These keys and certificates will be shared with your clients, and it’s best to generate separate keys and certificates for each client you intend on connecting.

Make sure that if you do this you give them descriptive names, but for now we’re going to have one client so we’ll just call it client.

cd /etc/openvpn/easy-rsa
./build-key client 

That’s it for keys and certificates.

YEALINK CLIENT:

vpn.cnf

client
remote A.B.C.D
nobind
persist-key
persist-tun
port 1195
proto tcp
dev tun
verb 4

ca /yealink/config/openvpn/keys/ca.crt
cert /yealink/config/openvpn/keys/client4.crt
key /yealink/config/openvpn/keys/client4.key

Todos os arquivos ca.crt, client4.crt e client5.key devem conter dentro do diretório keys
No windows pode-se utilizar o compactar 7zip para criar o tar.

vpn.cnf
|–> keys/ca.crt
|–> keys/client4.crt
|–> keys/client4.key

  tar -cf openvpn.tar vpn.cnf keys/ 

Os nomes devem ser respeitador (openvpn.tar, vpn.cnf)

[root@ipbx easy-rsa]# tail -f /var/log/openvpn/openvpn.log

ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref

GLOBAL STATS
Max bcast/mcast queue length,1
END
Sat Jan 27 21:25:13 2018 TCP connection established with [AF_INET]C.C.C.C:2864
Sat Jan 27 21:25:14 2018 C.C.C.C:2864 TLS: Initial packet from [AF_INET]C.C.C.C:2864, sid=0777373e dc508015
tail: /var/log/openvpn/openvpn.log: file truncated
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 VERIFY OK: depth=1, C=BR, ST=RJ, L=RiodeJaneiro, O=Abratel, OU=ipbx, CN=ipbx.intranet, name=EasyRSA, emailAddress=xxxx@xxxx.com
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 VERIFY OK: depth=0, C=BR, ST=RJ, L=RiodeJaneiro, O=Abratel, OU=ipbx, CN=client4, name=EasyRSA, emailAddress=xxxxx@xxxxx.com
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 Outgoing Data Channel: Cipher 'BF-CBC' initialized with 128 bit key
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 Incoming Data Channel: Cipher 'BF-CBC' initialized with 128 bit key
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate SWEET32 attacks.
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Jan 27 21:25:26 2018 C.C.C.C:2864 [client4] Peer Connection Initiated with [AF_INET]C.C.C.C:2864
Sat Jan 27 21:25:26 2018 MULTI: new connection by client 'client4' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Sat Jan 27 21:25:26 2018 MULTI_sva: pool returned IPv4=10.8.0.14, IPv6=(Not enabled)
Sat Jan 27 21:25:26 2018 MULTI: Learn: 10.8.0.14 -> client4/C.C.C.C:2864
Sat Jan 27 21:25:26 2018 MULTI: primary virtual IP for client4/C.C.C.C:2864: 10.8.0.14
Sat Jan 27 21:25:29 2018 client4/C.C.C.C:2864 PUSH: Received control message: 'PUSH_REQUEST'
Sat Jan 27 21:25:29 2018 client4/C.C.C.C:2864 SENT CONTROL [client4]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.1,topology net30,ifconfig 10.8.0.14 10.8.0.13' (status=1)
tail: /var/log/openvpn/openvpn.log: file truncated

Log aparelho YEALINK

Jan 27 00:00:17 openvpn[299]: OpenVPN 2.1.3 mipsel-unknown-linux-uclibc [SSL] [LZO2] [EPOLL] built on Sep 30 2013
Jan 27 00:00:17 openvpn[299]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jan 27 00:00:17 openvpn[299]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Jan 27 00:00:17 openvpn[299]: WARNING: file '/yealink/config/openvpn/keys/client4.key' is group or others accessible
Jan 27 00:00:17 openvpn[299]: Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Jan 27 00:00:17 openvpn[299]: Socket Buffers: R=[43689->131072] S=[16384->131072]
Jan 27 00:00:18 openvpn[299]: Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Jan 27 00:00:18 openvpn[299]: Local Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_CLIENT,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Jan 27 00:00:18 openvpn[299]: Expected Remote Options String: 'V4,dev-type tun,link-mtu 1543,tun-mtu 1500,proto TCPv4_SERVER,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Jan 27 00:00:18 openvpn[299]: Local Options hash (VER=V4): 'db02a8f8'
Jan 27 00:00:18 openvpn[299]: Expected Remote Options hash (VER=V4): '7e068940'
Jan 27 00:00:18 openvpn[301]: Attempting to establish TCP connection with A.B.C.D:1195 [nonblock]
Jan 27 00:00:18 netS[262]: SRV <3+error > sendto v6 ntp socket err
Jan 27 23:25:14 openvpn[301]: TCP connection established with A.B.C.D:1195
Jan 27 23:25:14 openvpn[301]: TCPv4_CLIENT link local: [undef]
Jan 27 23:25:14 openvpn[301]: TCPv4_CLIENT link remote: A.B.C.D:1195
Jan 27 23:25:14 openvpn[301]: TLS: Initial packet from A.B.C.D:1195, sid=4aba1b0f 2963060c
Jan 27 23:25:14 openvpn[301]: VERIFY OK: depth=1, /C=BR/ST=RJ/L=RiodeJaneiro/O=Abratel/OU=ipbx/CN=ipbx/name=EasyRSA/emailAddress=uxxxx@xxxx.com
Jan 27 23:25:14 openvpn[301]: VERIFY OK: depth=0, /C=BR/ST=RJ/L=RiodeJaneiro/O=Abratel/OU=AbratelTelecom/CN=server/name=EasyRSA/emailAddress=xxxx@xxxx.com
Jan 27 23:25:26 openvpn[301]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan 27 23:25:26 openvpn[301]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 27 23:25:26 openvpn[301]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan 27 23:25:26 openvpn[301]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 27 23:25:26 openvpn[301]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Jan 27 23:25:26 openvpn[301]: [server] Peer Connection Initiated with A.B.C.D:1195

MIKROTIK

Para funcionar no mikrotik, no server da openvpn não pode ter:
— Compressão Lzo
— Porta UDP

Alguns ajustes são necessários. Ainda no linux, converter as chaves para RSA:

openssl rsa -in ca.key -text > ca.rsa
openssl rsa -in client2.key -text > client2.rsa

NO MIKROTIK

Importar do linux esses 4 arquivos abaixo e arrasta-los para dentro do mikrotik.
Depois no terminal do mesmo executar

/certificate import file-name=ca.crt (pressione enter até concluir)
/certificate import file-name=ca.rsa (pressione enter até concluir)
/certificate import file-name=client4.crt (pressione enter até concluir)
/certificate import file-name=client4.rsa (pressione enter até concluir)

No MIKROTIK:
INTERFACES –> ADD –> OPENVPN CLIENT

Dialup: A.B.C.D (ip do servidor openvpn)
porta: 1195
mode: ip
user: cliente4 (nome da chave)
pass: vazia
profile: default-encryptation
Certificate: client4.crt_0
Auth: sha1
Cipher: blowfish 128

Após conexão, em IP –> ROUTE eu pude observar que automaticamente criou minha rota para o rede 192.168.1.0/24 saindo pelo openvpn clint.

Criei um masquerad no firewall com:

SOURCE: rede LAN mikrotik 
OutInterface: openvpncliete criada
Aba Action: Masquerad

Step 4 — Routing – SOMENTE SE NECESSITAR ACESSAR A REDE INTERNA LAN ONDE O SERVIDOR VPN ASTERISK ENCONTRA-SE

To keep things simple we’re going to do our routing directly with iptables rather than the new firewalld.

First, make sure the iptables service is installed and enabled.

yum install iptables-services -y
systemctl mask firewalld
systemctl enable iptables
systemctl stop firewalld
systemctl start iptables
iptables –flush
Next we’ll add a rule to iptables to forward our routing to our OpenVPN subnet, and save this rule.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
Then we must enable IP forwarding in sysctl. Open sysctl.conf for editing.

vi /etc/sysctl.conf
Add the following line at the top of the file:

net.ipv4.ip_forward = 1

Then restart the network service so the IP forwarding will take effect.

systemctl restart network.service

Step 5 — Starting OpenVPN

Now we’re ready to run our OpenVPN service. So lets add it to systemctl:

systemctl -f enable openvpn@server.service
systemctl start openvpn@server.service

Foi criada uma regra de mascaramento:
NAT –> ADD
Chain: srcnat
Src. Address: rede lan (exemplo: 192.168.88.0/24)
Dst. Address: rede lan da vpn do outro lado (192.168.218.0/24)
Out Interface: nome-da-open-vpn-interface
Action: Masquerade

Em MANGLE:
ADD
Chain: Prerouting
Src. Address: rede lan (exemplo: 192.168.88.0/24)
Dst. Address: rede lan da vpn do outro lado (192.168.218.0/24)
Action: Mark routing
New Routing Mark: OpenVpn-NOME
Desmarcar Passthrough

IP –> ROUTES
ADD
Dst. Address: 192.168.218.0/24 (lan do outro lado)
Geteway: openvpn-gw-criado-automaticamente
Routinha Mark: OpenVpn-NOME (dado a regra acima de Mangle)

Obs Final: Não consegui autenticar via UDP no asterisk. Sendo necessário trocar tudo para TCP. Não achei vantajoso a Mikrotik não tem lançado uma versão em UDP ainda para openvpn.

Para funcionar os aparelhos yealink tive que refazer todas as rotas do mikrotik usando ao invés do 192.168.218.0/24 o ip do servidor openvpn 10.8.0.1 … Contrario a isso a voz não passou nos dois canais.