The easier method is to authenticate SIP requests at the proxy and use a trust relationship between the proxy and the voicemail server. If you define your proxy as a peer in * sip.conf, then * will only accept SIP requests from your proxy.
Thank you, but I think I found another way of doing this as well.
In * sip.conf I changed the realm to "vm.dom.tld" and in openSer openser.cfg I check for INVITES with that realm in the Proxy-Auth header and send them straight back to * with rewritehostport.
This works and has the advantage that * still authenticates all peers which allows our peers to call into the voicemail box without a voicemail password.
M