hepstunnel

HEP Encrypted Tunnels

Introduction

In this example we will setup a local stunnel instance for plain HEP agents to use and forward packets over an encrypted tunnel to a remote HOMER instance. Stunnel should be installed on both ends – it is avaialble from http://stunnel.org.

NOTE: CaptAgent 4/6 fully supports SSL encryption and does not require a tunnel. 

Server Side (Homer)

Create a certificate:

cd /etc/stunnel
openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout stunnel.pem -out stunnel.pem

Edit stunnel.conf with the following lines:

cert = /etc/stunnel/stunnel.pem
setuid = nobody
setgid = nobody
pid = /tmp/stunnel.pid
debug = 7
output = stunnel.log
[hep_server]
client = no
accept = 9061
; address of your Kamailio/OpenSIPS HEP Socket
connect = 127.0.0.1:9060

• start stunnel

Client Side (HEP Proxy)

Create a certificate:

cd /etc/stunnel
openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout stunnel.pem -out stunnel.pem```

Edit stunnel.conf with the following lines:

cert =/etc/stunnel/stunnel.pem
pid = /tmp/stunnel.pid
setuid = nobody
setgid = nobody
debug=7
output=stunnel.log
client = yes
[my_client]
client = yes
; port where local plain HEP Capture Agents will connect
accept = 9061
; address of remote HOMER Instance
connect = hep.server:443

• start stunnel

Configure Agents

Configure your Capture Agents to send HEP packets to your local HEP proxy instance and verify they are delivered remotely to your HOMER instance. Voila'!