60 lines
2.2 KiB
Plaintext
60 lines
2.2 KiB
Plaintext
---
|
|
opnsense_api_key: "uTaG84sB3dhZtBgTxXV3oXh0aD5dhsR8xxfRYjP6SeAhmYM055dvo89BlfrpLTE01Rwwm7FVZLwZiTiS"
|
|
opnsense_api_secret: "nrFEVYPBBcuan53v+BBOwUWaBGMEt03+mbU2SZq0q0K90CX2w1h18fsFBiLCNa91yEFQZUSyuWPlx4Yp"
|
|
opnsense_ssl_verify: false
|
|
|
|
opnsense_openvpn_static_keys:
|
|
- name: MCI-VPN-TLS-CRYPT
|
|
mode: crypt
|
|
key: |
|
|
-----BEGIN OpenVPN Static key V1-----
|
|
a68d0dba3e2efe7e83c3887cc7fcb759
|
|
c86a6b4984ea7ffa230dafe1fb4e9ca7
|
|
66f3667fe75fd8d368b9a0aae7024603
|
|
f88cf00baf1eab326b222b4321e9cddd
|
|
8b287265c3ee2d0053193dea1dbdda75
|
|
e869c7d7d580c0b42421bb5a1af22f80
|
|
4d058aebc2cf1d8c83cc88948807fbf9
|
|
3bfc122cab4a650f258f7a57716daa95
|
|
da3898acfd80481b9d81e9b3d07aeea0
|
|
11b6c6508324ef89c6812028c345f274
|
|
f6a51c669c49295e07e8385435f713c0
|
|
5eaa46b3ccb69888a5b477df79675d66
|
|
365c4ce5f7684984980731d5eacd0a1a
|
|
77a9449533076c098cde36c45e54342e
|
|
27a920724f64eddeb16dcef134adb4b9
|
|
e0bcaa4ade9ebf2c45d679bd016f7f2e
|
|
-----END OpenVPN Static key V1-----
|
|
|
|
opnsense_openvpn_clients:
|
|
- name: MCI-VPN
|
|
enabled: false
|
|
remote:
|
|
- vpn.mci.edu:1194
|
|
- 193.171.232.106:1194
|
|
- 193.171.232.107:1194
|
|
- "[2001:628:2260:850::106]:1194"
|
|
- "[2001:628:2260:850::107]:1194"
|
|
protocol: udp
|
|
mode: tap
|
|
ca: MCI-VPN-CA # import CA cert in WebUI first: System → Trust → Authorities
|
|
certificate: majanetschek # import client cert+key in WebUI first: System → Trust → Certificates
|
|
key: "MCI-VPN-TLS-CRYPT [crypt (Encrypt and authenticate all control channel packets)]" # workaround: oxlorg.opnsense uses endswith() matching
|
|
authentication: SHA384
|
|
verify_remote_certificate: true
|
|
username: "majanetschek"
|
|
password: "1234"
|
|
keepalive_interval: "20"
|
|
keepalive_timeout: "60"
|
|
renegotiate_time: "3600"
|
|
log_level: 1
|
|
# NOTE: The following options must be set manually in OPNsense WebUI
|
|
# under VPN → OpenVPN → Clients → Edit → Custom options:
|
|
# ncp-disable
|
|
# tls-version-min 1.2
|
|
# tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
|
|
# cipher AES-256-GCM
|
|
# remote-cert-ku e0
|
|
# reneg-bytes 104857600
|
|
# reneg-pkts 100000
|