---
opnsense_api_key: "uTaG84sB3dhZtBgTxXV3oXh0aD5dhsR8xxfRYjP6SeAhmYM055dvo89BlfrpLTE01Rwwm7FVZLwZiTiS"
opnsense_api_secret: "nrFEVYPBBcuan53v+BBOwUWaBGMEt03+mbU2SZq0q0K90CX2w1h18fsFBiLCNa91yEFQZUSyuWPlx4Yp"
opnsense_ssl_verify: false

opnsense_openvpn_static_keys:
  - name: MCI-VPN-TLS-CRYPT
    mode: crypt
    key: |
      -----BEGIN OpenVPN Static key V1-----
      a68d0dba3e2efe7e83c3887cc7fcb759
      c86a6b4984ea7ffa230dafe1fb4e9ca7
      66f3667fe75fd8d368b9a0aae7024603
      f88cf00baf1eab326b222b4321e9cddd
      8b287265c3ee2d0053193dea1dbdda75
      e869c7d7d580c0b42421bb5a1af22f80
      4d058aebc2cf1d8c83cc88948807fbf9
      3bfc122cab4a650f258f7a57716daa95
      da3898acfd80481b9d81e9b3d07aeea0
      11b6c6508324ef89c6812028c345f274
      f6a51c669c49295e07e8385435f713c0
      5eaa46b3ccb69888a5b477df79675d66
      365c4ce5f7684984980731d5eacd0a1a
      77a9449533076c098cde36c45e54342e
      27a920724f64eddeb16dcef134adb4b9
      e0bcaa4ade9ebf2c45d679bd016f7f2e
      -----END OpenVPN Static key V1-----

opnsense_openvpn_clients:
  - name: MCI-VPN
    enabled: false
    remote:
      - vpn.mci.edu:1194
      - 193.171.232.106:1194
      - 193.171.232.107:1194
      - "[2001:628:2260:850::106]:1194"
      - "[2001:628:2260:850::107]:1194"
    protocol: udp
    mode: tap
    ca: MCI-VPN-CA             # import CA cert in WebUI first: System → Trust → Authorities
    certificate: majanetschek  # import client cert+key in WebUI first: System → Trust → Certificates
    key: "MCI-VPN-TLS-CRYPT [crypt (Encrypt and authenticate all control channel packets)]"  # workaround: oxlorg.opnsense uses endswith() matching
    authentication: SHA384
    verify_remote_certificate: true
    username: "majanetschek"
    password: "1234"
    keepalive_interval: "20"
    keepalive_timeout: "60"
    renegotiate_time: "3600"
    log_level: 1
    # NOTE: The following options must be set manually in OPNsense WebUI
    # under VPN → OpenVPN → Clients → Edit → Custom options:
    #   ncp-disable
    #   tls-version-min 1.2
    #   tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
    #   cipher AES-256-GCM
    #   remote-cert-ku e0
    #   reneg-bytes 104857600
    #   reneg-pkts 100000