.

2026-03-26 08:57:55 +01:00
parent 2b1ca2d5be
commit bb55664283
19 changed files with 2671 additions and 0 deletions
@@ -0,0 +1,59 @@
+---
+opnsense_api_key: "uTaG84sB3dhZtBgTxXV3oXh0aD5dhsR8xxfRYjP6SeAhmYM055dvo89BlfrpLTE01Rwwm7FVZLwZiTiS"
+opnsense_api_secret: "nrFEVYPBBcuan53v+BBOwUWaBGMEt03+mbU2SZq0q0K90CX2w1h18fsFBiLCNa91yEFQZUSyuWPlx4Yp"
+opnsense_ssl_verify: false
+
+opnsense_openvpn_static_keys:
+  - name: MCI-VPN-TLS-CRYPT
+    mode: crypt
+    key: |
+      -----BEGIN OpenVPN Static key V1-----
+      a68d0dba3e2efe7e83c3887cc7fcb759
+      c86a6b4984ea7ffa230dafe1fb4e9ca7
+      66f3667fe75fd8d368b9a0aae7024603
+      f88cf00baf1eab326b222b4321e9cddd
+      8b287265c3ee2d0053193dea1dbdda75
+      e869c7d7d580c0b42421bb5a1af22f80
+      4d058aebc2cf1d8c83cc88948807fbf9
+      3bfc122cab4a650f258f7a57716daa95
+      da3898acfd80481b9d81e9b3d07aeea0
+      11b6c6508324ef89c6812028c345f274
+      f6a51c669c49295e07e8385435f713c0
+      5eaa46b3ccb69888a5b477df79675d66
+      365c4ce5f7684984980731d5eacd0a1a
+      77a9449533076c098cde36c45e54342e
+      27a920724f64eddeb16dcef134adb4b9
+      e0bcaa4ade9ebf2c45d679bd016f7f2e
+      -----END OpenVPN Static key V1-----
+
+opnsense_openvpn_clients:
+  - name: MCI-VPN
+    enabled: false
+    remote:
+      - vpn.mci.edu:1194
+      - 193.171.232.106:1194
+      - 193.171.232.107:1194
+      - "[2001:628:2260:850::106]:1194"
+      - "[2001:628:2260:850::107]:1194"
+    protocol: udp
+    mode: tap
+    ca: MCI-VPN-CA             # import CA cert in WebUI first: System → Trust → Authorities
+    certificate: majanetschek  # import client cert+key in WebUI first: System → Trust → Certificates
+    key: "MCI-VPN-TLS-CRYPT [crypt (Encrypt and authenticate all control channel packets)]"  # workaround: oxlorg.opnsense uses endswith() matching
+    authentication: SHA384
+    verify_remote_certificate: true
+    username: "majanetschek"
+    password: "1234"
+    keepalive_interval: "20"
+    keepalive_timeout: "60"
+    renegotiate_time: "3600"
+    log_level: 1
+    # NOTE: The following options must be set manually in OPNsense WebUI
+    # under VPN → OpenVPN → Clients → Edit → Custom options:
+    #   ncp-disable
+    #   tls-version-min 1.2
+    #   tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
+    #   cipher AES-256-GCM
+    #   remote-cert-ku e0
+    #   reneg-bytes 104857600
+    #   reneg-pkts 100000