Obi100 encryption with voip.ms

JEDI-JF

I have been using a Obi100 for more than 10 years with voip.ms and it works great. However I recently tried to enable encryption but it didn't work.
I followed the instruction here: https://wiki.voip.ms/article/OBi_100/110_%26_OBi_200

The problem is there is no X_OutboundProxyTransport setting. All the other options are there but not this one.

I am wondering if anyone else with a Obi100 got it working and if you have this setting (is it needed?). The only thing I can think of is that I don't have the latest firmware (1.3.0 (Build: 2824)) but I am not sure it would change anything (and I cannot find a link to download the latest official firmware). I am also not sure if I want to risk bricking it (even if unlikely)

px_eliezer_

JEDI-JF

The Voip.MS Wiki does say this:

In order to use TLS/call encryption with OBi devices, you'll need to modify the following parameters accordingly. Please note that this is only available for some OBi devices, and the screenshots are from the most recent firmware version.

FBOFW, that's probably your answer.

It's probably not even the firmware, rather the more limited capability of the 100/110 vs the 200, this is well known.

JEDI-JF

Yes it is possible. I simply find it very strange that out of the 7 settings needed to be changed according to that page, my Obi100 has 6. Why would these 6 settings be in the Obi100 if in the end encryption cannot be used?

And while I don't have the last build of the firmware, it is still 1.3.0. I would assume they would have bumped to at least 1.3.1 if there was any relevent difference.

OzarkEdge

JEDI-JF

I have a collection of fw that includes:

But I have never used an OBi100 and can't vouch for what I have. I'd wait for an OBi100 user here to comment.

TLS settings for my OBi202 (ignore the WORD spell checker underlining):

The X_OutboundProxyTransport default setting is Follow ProxyServerTransport. Maybe the OBi100 already does the same, so not the issue(?)

I do set ProxyServer to washington1.voip.ms... the server number was required for TLS. Try appending the server number and see if that makes a difference.

I also enable X_SymmetricRTPEnable and set X_SRTP to SRTP Only. I believe both are required. Poly firmware exposes the X_SRTPCryptos setting, but I suspect that will not be exposed on the OBi100... it is not exposed on my OBi202 3.2.2 (Build: 5921EX).

px_eliezer_

JEDI-JF

Here is (another) example of a security setting that is available on many Obi devices but NOT on the 100/110----Just as an EXAMPLE:

A more fool-proof method is to enable the parameter: X_EnforceRequestUserID. This parameter is under SPn in the SIP Credentials section. What this does, is it makes sure the incoming INVITE has a User ID that matches the User ID of your SIP service account. If it does not match, the INVITE will be rejected and the phone will not ring. Enabling this parameter will maintain normal voice service as well as block SIP scanners. Notes: Some service providers do not adhere to this rule. This parameter is not available on the OBi100 and OBi110 devices.

https://forum.fongo.com/viewtopic.php?t=7112

It does seem chintzy but overall, these devices were designed many years ago (the Obi 100 came out 14 years ago) so perhaps this kind of security was not considered so important at that time....

JEDI-JF

Thanks OzarkEdge, I tried those settings but unfortunately it didn't work. I have the 2824 firmware but the latest one is 2886.

px_eliezer_, yes maybe it cannot work with the Obi100, it is old.

In the end I don't think it is an issue, I have been using it like that for more than 10 years but it would have been nice to add some extra security.

MurrayB

I went through this when T Mobile home internet would not allow VOIP so I had to encrypt following OzarkEdge instructions. However, it works fine on the Obi202 and like you are finding I could not encrypt the Obi110 it does not have this parameter so no encryption. Perhaps you can find a resale Obi 200 series making sure that it is not locked to a carrier. Fortunately, my Obi110 works fine unencrypted on Spectrum Internet.

Good Luck!

MZB

IIRC it was EOL before LetsEncrypt did its root certificate change - so you would need to update its SSL certificates to connect to voip.ms.

Nice ATA in its day...