Yealink VPN not connecting

[Mowser]

Hello everyone,

I must admit defeat and ask for help here. I am having issues connecting Yealink phones to the FreePBX VPN. I’m not sure where the issue is here; the phone, the firewall, or the PBX VPN.

I have a few FreePBX setups that I look after with this setup and have never had an issue after I managed to understand how Yealink handles VPN configs. The only difference here is that the VPN server is not running on its default port (1194) and running on 1195 because there is already an OpenVPN server running. The other sites have multiple external IP addresses so I have always taken one for the second VPN server with no issues. Unfortunately, I can’t use the existing server that is hosted on PfSense because it uses SSL/TLS + User Auth which the phone can’t handle. I have tried setting up an OpenVPN server on pfsense with the correct auth and it doesn’t work. Then I tried on FreePBX and still not working.

I wish I could see some kind of logs to see where the connection is getting stuck. The Yealink handset is a T46U. I have tried every version of the config file I can find online, but my current one is:

# Configuration automatically generated via Sysadmin RPM
# MODIFICATIONS TO THIS FILE WILL BE OVERWRITTEN.
# Generated at: Wed, 28 Jun 2023 17:34:29 +0000
client
dev tun
proto udp
resolv-retry 60
nobind
persist-key
persist-tun
remote-cert-tls server
ca /keys/ca.crt
cert /keys/client.crt
key /keys/client.key
comp-lzo
verb 3
reneg-sec 3600
remote [IP OF HOST, Hidden from you naughty lot] 1195

I have a folder called ‘keys’ with the CA and two Client files in.
Is anyone able to share any advice on what I am doing wrong?

Thanks in advance!

[Ret (Ret McAsdd)]

I remember having problems creating VPN zip file for those phones. My solution was to write a zip file containing only vpn.cnf file and the keys crypto-data inserted inline in that file.

In you case, try deleting the lines:
ca /keys/ca.crt
cert /keys/client.crt
key /keys/client.key

And replace them at the end of your file with:

<key>
-----BEGIN PRIVATE KEY-----
 <Cryptodata from keys>
-----END PRIVATE KEY-----
</key>

<cert>
-----BEGIN CERTIFICATE-----
 <Cryptodata from keys>
-----END CERTIFICATE-----
</cert>

<ca>
-----BEGIN CERTIFICATE-----
 <Cryptodata from keys>
-----END CERTIFICATE-----
</ca>

You should fill in you customs keys where it says “Cryptodata from keys”

Hope it helps