hepstunnel

HEP Encrypted Tunnels

Introduction

In this example we will setup a local stunnel instance for HEP agents to use and forward packets over an encrypted tunnel to a HOMER instance. Stunnel should be installed on both linux machines – it is avaialble from http://stunnel.org.

• NOTE: CaptAgent 4/6 fully supports SSL encryption and does not require a tunnel.

Server Side (Homer)

Create a certificate:

cd /etc/stunnel
openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout stunnel.pem -out stunnel.pem

Edit stunnel.conf with the following lines:

cert = /etc/stunnel/stunnel.pem
setuid = nobody
setgid = nobody
pid = /tmp/stunnel.pid
debug = 7
output = stunnel.log
[hep_server]
client = no
accept = 9061
; address of your Kamailio/OpenSIPS HEP Socket
connect = 127.0.0.1:9061

• start stunnel

Client Side (Agents)

Create a certificate:

cd /etc/stunnel openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout stunnel.pem -out stunnel.pem

Edit stunnel.conf with the following lines:

cert =/etc/stunnel/stunnel.pem
pid = /tmp/stunnel.pid
setuid = nobody
setgid = nobody
debug=7
output=stunnel.log
client = yes
[my_client]
client = yes
; port where HEP Capture Agents will connect
accept = 9061
; address of remote HOMER Instance
connect = hep.server:443

• start stunnel