T20P: VPN/OpenVPN - Just SIP or also RTP?

[rfrantik@rfcinc.com]

You've done a good job of posting all your OpenVPN configs... and it looks like you have it right for what you are trying to do. Typically on the Yealink phones you'll see the little VPN icon come up on the LCD screen once the link is established. That's a good sign that it's working.

From there it generally comes down to standard networking rules.

We generally have our voice server included in the OpenVPN environment... then we just need to specify the voice server's VPN IP address (typically 172.16.0.1) in the phones SIP configuration. By using the VPN IP as the only server address you will force both SIP and RTP traffic across the VPN link as they have no other choice. A common mistake our technicians make is putting the actual Public address of the server in the SIP config of the phone... at that point the phone establishes the VPN link, but then uses it's internet connection to find the voice server.

With the OpenVPN config files it may be possible to force a range of traffic out across the VPN link... but the server on the other end would need the same rules in place to send the traffic back... and that is generally the tricky part if it's not really part of the VPN.

One question I had with your setup... where is all your equipment located? You mention you have the T20P connecting to your DD-WRT OpenVPN server... is the phone on the internet and your server is behind the firewall on the protected LAN? or vice-versa? Makes a difference whether your DD-WRT should really be in client or server mode.