<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2769" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hello,</FONT></DIV>
<DIV><FONT face=Arial size=2>I have trouble getting asterisk to work with my new
firewall script (see below).</FONT></DIV>
<DIV><FONT face=Arial size=2>I used this info as base: </FONT><FONT face=Arial
size=2>'<A
href="http://www.voip-info.org/wiki-Asterisk+firewall+rules">http://www.voip-info.org/wiki-Asterisk+firewall+rules</A></FONT></DIV>
<DIV><FONT face=Arial size=2>And then modified it to suit my needs.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I use only SIP and the problem is that the calls
get in to asterisk when the firewall is activated.</FONT></DIV>
<DIV><FONT face=Arial size=2>But my agents/phones cant register or receive any
calls. So all calls get stuck in queue on asterisk.</FONT></DIV>
<DIV><FONT face=Arial size=2>So I believe Im missing some rule
perhaps?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Can anyone help me sort this out?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks...</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Best Regards</FONT></DIV>
<DIV><FONT face=Arial size=2>Goran</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>/etc/init.d/firewall</FONT></DIV>
<DIV><FONT face=Arial size=2>======================================</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>#IPTables firewall configuration for X</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>export PATH=$PATH:/sbin</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>case "$1" in<BR> start)</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> echo "Starting iptables
firewall..."</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> iptables
--flush<BR> iptables --delete-chain</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> iptables -A INPUT -p icmp -i
eth0 -j ACCEPT</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> # START OPEN
PORTS<BR> #=================</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> #SSH (22)<BR>
iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> #SAMBA: netbios (139) ,
microsoft-ds (445)<BR> iptables -A INPUT -p tcp -i eth0
--dport 139 -j ACCEPT<BR> iptables -A INPUT -p tcp -i eth0
--dport 445 -j ACCEPT<BR> <BR>
#ASTERISK</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> # SIP (UDP
5060)<BR> iptables -A INPUT -p tcp -m tcp -i eth0
--dport 5060 -j ACCEPT<BR> iptables -A INPUT -p
udp -m udp -i eth0 --dport 5060 -j ACCEPT</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> # IAX2/IAX
<BR> iptables -A INPUT -p udp -m udp -i eth0
--dport 4569 -j ACCEPT<BR> iptables -A INPUT -p
udp -m udp -i eth0 --dport 5036 -j ACCEPT </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> # RTP - the media
stream <BR> iptables -A INPUT -p udp -m udp -i
eth0 --dport 10000:20000 -j ACCEPT </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> # MGCP - if you use
media gateway control protocol in your configuration
<BR> iptables -A INPUT -p udp -m udp -i eth0
--dport 2727 -j ACCEPT </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> #END ASTERISK
</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> #MySQL
(3306)<BR> iptables -A INPUT -p tcp -i eth0 --dport 3306 -j
ACCEPT<BR> iptables -A INPUT -p udp -i eth0 --dport 3306 -j
ACCEPT</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> #SNMP (161) - Allow from cacti
server<BR> iptables -A INPUT -p tcp -i eth0 --dport 161
--source x.x.x.x -j ACCEPT<BR> iptables -A INPUT -p udp -i
eth0 --dport 161 --source x.x.x.x -j ACCEPT</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> #Ftp / Passive
ports<BR> iptables -A INPUT -p tcp -i eth0 --dport 21 -j
ACCEPT<BR> iptables -A INPUT -p tcp -i eth0 --dport
64785:64799 -j ACCEPT</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> #Http /
Web<BR> iptables -A INPUT -p tcp -i eth0 --dport 80 -j
ACCEPT</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> #Webmin
(10000)<BR> iptables -A INPUT -p tcp -i eth0 --dport 10000 -j
ACCEPT</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> # END OPEN
PORTS<BR> #=================</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> #Deny everything
else<BR> iptables -A INPUT -p all -i eth0 -j DROP</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> exit 0;<BR>
;;</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> stop)</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> echo "Stopping iptables
firewall..."<BR> iptables --flush<BR>
iptables --delete-chain</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> exit 0;<BR>
;;</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2> *)<BR> echo "Valid
switches: firewall start , firewall stop";</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>esac;<BR></FONT></DIV></BODY></HTML>