Remote phones over VPN
For an individual desk phone outside the office — the classic home-office phone — Exovo runs its own OpenVPN server. The phone's built-in VPN client dials home, and the phone behaves exactly as if it sat on the office LAN. No router configuration at the user's house, no exposed SIP.
Enabling the VPN server
Admin → Advanced → VPN → Enable VPN server. The server listens on UDP 5091 (already in the installation port table) and gives each phone its own certificate on the private VPN network. The page lists every issued client — device, extension, tunnel address, certificate status — with per-device revocation when a phone is lost or retired.
Provisioning a VPN phone
On the user's IP Phone settings, set Connection type to VPN Phone (the option is offered only for models with a suitable built-in VPN client). That's the whole procedure for Yealink: the phone receives its VPN bundle — config and certificates — automatically at provisioning time, connects, and registers through the tunnel.
Grandstream phones get the VPN settings automatically but need their certificates uploaded once in the phone's own web UI (their firmware can't receive certificates via provisioning). Snom doesn't offer a VPN mode — remote Snoms belong behind an SBC.
Practical notes
- Each certificate identifies one physical phone; devices are isolated from each other — the tunnel reaches the phone system, not other phones or your network.
- The phone must first be provisioned somewhere it can reach the system (the office LAN, or anywhere with the provisioning URL) before it's carried home.
- Once connected, everything works: calls, BLF lamps, provisioning updates, even the console's phone web-UI access reaches the phone through its tunnel.
- One or two phones → VPN; a whole branch → SBC. Per-phone tunnels don't scale gracefully past a handful of devices at one site.