<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I do not want set allowguest=yes. The problem is, there is no official list with ip addresses of Telekom Germany. But I think all ip addresses comes from the ip range 217.0.0.0/13.<div class=""><br class=""></div><div class="">I have now the following addition to sip.conf. I think it is the only safe option. Or what would you say?</div><div class=""><br class=""></div><div class=""><div class="">[telekom](!)</div><div class="">context=from-trunk</div><div class="">type=peer</div><div class="">defaultuser=</div><div class="">authuser=</div><div class="">remotesecret=</div><div class="">fromdomain=<a href="http://tel.t-online.de" class="">tel.t-online.de</a></div><div class="">qualify=no</div><div class="">dtmfmode=rfc2833</div><div class="">directmedia=no</div><div class="">sendrpid=pai</div><div class="">trustrpid=no</div><div class="">insecure=port,invite</div><div class="">disallow=all</div><div class="">allow=g722</div><div class="">allow=alaw</div><div class="">allow=gsm</div><div class="">deny=0.0.0.0/0</div><div class="">permit=217.0.0.0/13</div><div class=""><br class=""></div><div class="">[DTAG-IP_IN18_016](telekom)</div><div class="">host=217.0.18.16</div><div class=""><br class=""></div><div class="">[DTAG-IP_IN18_036](telekom)</div><div class="">host=217.0.18.36</div><div class=""><br class=""></div><div class="">etc.</div><div class=""><br class=""></div><div class=""><br class=""><div class=""><div class=""><div><blockquote type="cite" class=""><div class="">Am 02.04.2015 um 23:21 schrieb Scott Griepentrog <<a href="mailto:sgriepentrog@digium.com" class="">sgriepentrog@digium.com</a>>:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_default" style="color:#660000">That sounds like asterisk was working 100% correctly. If you receive an INVITE from an unknown IP address, then it should fail. Unless you want to allow anonymous, which is genearlly a very bad idea.</div><div class="gmail_default" style="color:#660000"><br class=""></div><div class="gmail_default" style="color:#660000">If you are registering to IP X, but the provider may be transmitting invites from any number of other IP addresses, then you need a list of IP addresses, and have a trunk configuration set up for each one so that they are all recognized (with insecure=port,invite).</div><div class="gmail_default" style="color:#660000"><br class=""></div><div class="gmail_default" style="color:#660000">If the provider is requiring you to accept invites from random IP addresses, get a new provider.</div><div class="gmail_default" style="color:#660000"><br class=""></div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Thu, Apr 2, 2015 at 3:23 PM, Daniel Heckl <span dir="ltr" class=""><<a href="mailto:daniel.heckl@gmail.com" target="_blank" class="">daniel.heckl@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div class="">Okay, Scott, I think we are on the wrong path. Maybe I'm wrong though.
</div><div class=""><br class=""></div><div class="">I will summarize again briefly the problems together:</div><div class=""><ul class=""><li class="">The peer ip address could be another than the ip address of incoming invites</li><li class="">After an re-register the REGISTER is send to the new SIP server, answered with OK. But the peer ip address is still the old one (sip show peers).</li><li class="">If now is a INVITE, the request is answered with 401 Unauthorized.</li></ul><div class=""><br class=""></div><div class="">That’s why I would say, the problem is not the port or a needed authentication. My Asterisk works behind a NAT without port forwarding and nat=no, I have qualify=yes that it does not come to a NAT timeout.</div><div class=""><br class=""></div><div class="">Here is an example. The peer ip address was at this time 217.0.23.100, the INVITE came from 217.0.23.68 an was rejected with 401 Unauthorized:</div><div class=""><br class=""></div><div class=""><div class="">INVITE <a class="">sip:06123456789@80.000.111.222:45061</a> SIP/2.0</div><div class="">Max-Forwards: 58</div><div class="">Via: SIP/2.0/UDP 217.0.23.68:5060;branch=z9hG4bKg3Zqkv7ib7h2smv8whryjnos88srot1i7</div><div class="">To: <<a class="">sip:6123456789@telekom.de</a>></div><div class="">From: <<a class="">sip:+49123456789@tel.t-online.de;user=phone</a>>;tag=h7g4Esbg_44c62525</div><div class="">Call-ID: <a href="mailto:af71bbfbf269b895@62.155.0.75" target="_blank" class="">af71bbfbf269b895@62.155.0.75</a></div><div class="">CSeq: 3950540 INVITE</div><div class="">Contact: <<a class="">sip:sgc_c@217.0.23.68;transport=udp</a>></div><div class="">Record-Route: <<a class="">sip:217.0.23.68;transport=udp;lr</a>></div><div class="">Min-Se: 900</div><div class="">P-Asserted-Identity: <<a class="">sip:+49123456789@tel.t-online.de;user=phone</a>></div><div class="">Session-Expires: 3600</div><div class="">Supported: histinfo</div><div class="">Supported: timer</div><div class="">Supported: norefersub</div><div class="">Content-Type: application/sdp</div><div class="">Content-Disposition: session</div><div class="">Content-Length: 204</div><div class="">Allow: ACK, BYE, CANCEL, INFO, INVITE, OPTIONS, PRACK, REFER, REGISTER, UPDATE</div><div class=""><br class=""></div><div class="">v=0</div><div class="">o=- 0 0 IN IP4 217.0.23.68</div><div class="">s=-</div><div class="">c=IN IP4 217.0.4.134</div><div class="">t=0 0</div><div class="">m=audio 36480 RTP/AVP 9 8 102</div><div class="">a=rtpmap:9 G722/8000</div><div class="">a=rtpmap:8 PCMA/8000</div><div class="">a=rtpmap:102 telephone-event/8000</div><div class="">a=maxptime:20</div><div class="">a=ptime:20</div></div><div class=""><br class=""></div></div><div class=""><div class="h5"><div class=""><blockquote type="cite" class=""><div class="">Am 02.04.2015 um 22:00 schrieb Scott Griepentrog <<a href="mailto:sgriepentrog@digium.com" target="_blank" class="">sgriepentrog@digium.com</a>>:</div><br class=""><div class=""><div dir="ltr" class=""><div class="gmail_default" style="color:#660000">Actually, the IP address is still used to identify the incoming invite. With the insecure=port option set, Asterisk will presume the invite to still match the trunk account even if the NAT router has mangled (changed) the port number. My suspicion is that when the new register goes out, it's creating a new state in the firewall, resulting in a new port number, which is why you would have to allow anonymous calls to then accept it without insecure=port. The other possibility is that you have a port forward in the router set, which is similarly mangling the port number. With a valid registration being held, and assuming the router does not drop UDP states faster than 30 minutes, and also assuming that the provider is sending you invites on the registered port rather than always on 5060, there should not be a need for an inbound port forward to Asterisk, and you should not need insecure=port.</div><div class="gmail_default" style="color:#660000"><br class=""></div><div class="gmail_default" style="color:#660000">The invite option disables authentication - which means only that Asterisk will not force a check of the password on the other end. Where the IP address is well known and trusted, the extra overhead and delay of authenticating incoming INVITEs is not needed.</div><div class="gmail_default" style="color:#660000"><br class=""></div><div class="gmail_default" style="color:#660000"><br class=""></div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Thu, Apr 2, 2015 at 2:28 PM, Daniel Heckl <span dir="ltr" class=""><<a href="mailto:daniel.heckl@gmail.com" target="_blank" class="">daniel.heckl@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div class="">Scott, I have changed the configuration as said it and will test it. I’m curious.
</div><div class=""><br class=""></div><div class="">Can you briefly explain what insecure=invite,port does?</div><div class=""><br class=""></div><div class=""><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;line-height:18px;white-space:pre-wrap" class="">;insecure=port ; Allow matching of peer by IP address without</span></div><div class=""><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;line-height:18px;white-space:pre-wrap" class=""> </span><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;line-height:18px;white-space:pre-wrap" class="">; matching port number</span></div><div class=""><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;line-height:18px;white-space:pre-wrap" class="">;insecure=invite </span><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;line-height:18px;white-space:pre-wrap" class="">; Do not require authentication of incoming INVITEs</span></div><div class=""><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;line-height:18px;white-space:pre-wrap" class="">;insecure=port,invite ; (both)</span></div><div class=""><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;line-height:18px;white-space:pre-wrap" class=""><br class=""></span></div><div class=""><span style="color:rgb(51,51,51);line-height:18px;white-space:pre-wrap" class="">Do I understand correctly that in this mode the IP address is not checked and no authentication is required? </span></div><div class=""><div class=""><div class=""><span style="color:rgb(51,51,51);font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;line-height:18px;white-space:pre-wrap" class=""><br class=""></span></div><div class=""><blockquote type="cite" class=""><div class="">Am 02.04.2015 um 20:11 schrieb Scott Griepentrog <<a href="mailto:sgriepentrog@digium.com" target="_blank" class="">sgriepentrog@digium.com</a>>:</div><br class=""><div class=""><div dir="ltr" class=""><div class="gmail_default" style="color:rgb(102,0,0)">I'd be curious if setting</div><div class="gmail_default" style="color:rgb(102,0,0)"><br class=""></div><div class="gmail_default" style="color:rgb(102,0,0)">insecure=invite,port</div><div class="gmail_default" style="color:rgb(102,0,0)"><br class=""></div><div class="gmail_default" style="color:rgb(102,0,0)">makes any difference either (without alllowguest on).</div><div class="gmail_default" style="color:rgb(102,0,0)"></div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Thu, Apr 2, 2015 at 9:03 AM, Daniel Heckl <span dir="ltr" class=""><<a href="mailto:daniel.heckl@gmail.com" target="_blank" class="">daniel.heckl@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Ok, I have tested dnsmgr. This is not a solution, the situation has not changed. With dnsmgr I can not place outbound calls. I do not know why and what dnsmgr really do.<br class="">
<br class="">
My current solution is as follows:<br class="">
<br class="">
Say allowguest=yes, configure the default context that there can not be placed outbound calls. Use iptables to DROP all at your SIP port and allow only your local phones and the sip trunk ip range. I think srvlookup must be set to yes to place outbound calls if there is an ip address change.<br class="">
<br class="">
I think with the restriction of the firewall that should be a secure solution.<br class="">
<div class=""><div class=""><br class="">
> Am 01.04.2015 um 19:23 schrieb Sebastian Kemper <<a href="mailto:sebastian_ml@gmx.net" target="_blank" class="">sebastian_ml@gmx.net</a>>:<br class="">
><br class="">
> On Wed, Apr 01, 2015 at 11:00:56AM -0400, Andres wrote:<br class="">
>> On 4/1/15 10:48 AM, Daniel Heckl wrote:<br class="">
>>> John,<br class="">
>>><br class="">
>>> thank you four your answer. I think you have misunderstood the<br class="">
>>> problem. It’s about a ip address change of the sip trunk, not of my<br class="">
>>> asterisk server.<br class="">
>> You would probably benefit by enabling the DNS Manager to allow for<br class="">
>> dynamic IP changes:<br class="">
>><br class="">
>> # cat dnsmgr.conf [general] enable=yes ; enable creation<br class="">
>> of managed DNS lookups ; default is 'no' refreshinterval=180 ;<br class="">
>> refresh managed DNS lookups every <n> seconds ; default is 300 (5<br class="">
>> minutes)<br class="">
><br class="">
> Hello Andres,<br class="">
><br class="">
> I read that same suggestion elsewhere in connection with Deutsche<br class="">
> Telekom, so it seems there's some benefit in it.<br class="">
><br class="">
> Daniel, did you try it out already?<br class="">
><br class="">
> Kind regards,<br class="">
> Sebastian<br class="">
><br class="">
> --<br class="">
> _____________________________________________________________________<br class="">
> -- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com/" target="_blank" class="">http://www.api-digital.com</a> --<br class="">
> New to Asterisk? Join us for a live introductory webinar every Thurs:<br class="">
> <a href="http://www.asterisk.org/hello" target="_blank" class="">http://www.asterisk.org/hello</a><br class="">
><br class="">
> asterisk-users mailing list<br class="">
> To UNSUBSCRIBE or update options visit:<br class="">
> <a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank" class="">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br class="">
<br class="">
<br class="">
--<br class="">
_____________________________________________________________________<br class="">
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com/" target="_blank" class="">http://www.api-digital.com</a> --<br class="">
New to Asterisk? Join us for a live introductory webinar every Thurs:<br class="">
<a href="http://www.asterisk.org/hello" target="_blank" class="">http://www.asterisk.org/hello</a><br class="">
<br class="">
asterisk-users mailing list<br class="">
To UNSUBSCRIBE or update options visit:<br class="">
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank" class="">http://lists.digium.com/mailman/listinfo/asterisk-users</a></div></div></blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class=""><div dir="ltr" class=""><img alt="Digium logo" src="https://my.digium.com/images/graphics/digium_RGB_signature.gif" width="288" height="50" style="font-family:Arial,Helvetica,sans-serif;font-size:12px" class=""><div class="">Scott Griepentrog<br class="">Digium, Inc · Software Developer<br class="">445 Jan Davis Drive NW · Huntsville, AL 35806 · US<br class="">direct/fax: +1 256 428 6239 · mobile: +1 256 580 6090<br class="">Check us out at: <a href="http://digium.com/" target="_blank" class="">http://digium.com</a> · <a href="http://asterisk.org/" target="_blank" class="">http://asterisk.org</a><br class=""></div></div></div>
</div>
-- <br class="">_____________________________________________________________________<br class="">-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com/" target="_blank" class="">http://www.api-digital.com</a> --<br class="">New to Asterisk? Join us for a live introductory webinar every Thurs:<br class=""> <a href="http://www.asterisk.org/hello" target="_blank" class="">http://www.asterisk.org/hello</a><br class=""><br class="">asterisk-users mailing list<br class="">To UNSUBSCRIBE or update options visit:<br class=""> <a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank" class="">http://lists.digium.com/mailman/listinfo/asterisk-users</a></div></blockquote></div><br class=""></div></div></div><br class="">--<br class="">
_____________________________________________________________________<br class="">
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com/" target="_blank" class="">http://www.api-digital.com</a> --<br class="">
New to Asterisk? Join us for a live introductory webinar every Thurs:<br class="">
<a href="http://www.asterisk.org/hello" target="_blank" class="">http://www.asterisk.org/hello</a><br class="">
<br class="">
asterisk-users mailing list<br class="">
To UNSUBSCRIBE or update options visit:<br class="">
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank" class="">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br class=""></blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class=""><div dir="ltr" class=""><img alt="Digium logo" src="https://my.digium.com/images/graphics/digium_RGB_signature.gif" width="288" height="50" style="font-family:Arial,Helvetica,sans-serif;font-size:12px" class=""><div class="">Scott Griepentrog<br class="">Digium, Inc · Software Developer<br class="">445 Jan Davis Drive NW · Huntsville, AL 35806 · US<br class="">direct/fax: +1 256 428 6239 · mobile: +1 256 580 6090<br class="">Check us out at: <a href="http://digium.com/" target="_blank" class="">http://digium.com</a> · <a href="http://asterisk.org/" target="_blank" class="">http://asterisk.org</a><br class=""></div></div></div>
</div>
-- <br class="">_____________________________________________________________________<br class="">-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com/" target="_blank" class="">http://www.api-digital.com</a> --<br class="">New to Asterisk? Join us for a live introductory webinar every Thurs:<br class=""> <a href="http://www.asterisk.org/hello" target="_blank" class="">http://www.asterisk.org/hello</a><br class=""><br class="">asterisk-users mailing list<br class="">To UNSUBSCRIBE or update options visit:<br class=""> <a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank" class="">http://lists.digium.com/mailman/listinfo/asterisk-users</a></div></blockquote></div><br class=""></div></div></div><br class="">--<br class="">
_____________________________________________________________________<br class="">
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com/" target="_blank" class="">http://www.api-digital.com</a> --<br class="">
New to Asterisk? Join us for a live introductory webinar every Thurs:<br class="">
<a href="http://www.asterisk.org/hello" target="_blank" class="">http://www.asterisk.org/hello</a><br class="">
<br class="">
asterisk-users mailing list<br class="">
To UNSUBSCRIBE or update options visit:<br class="">
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank" class="">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br class=""></blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class="gmail_signature"><div dir="ltr" class=""><img alt="Digium logo" src="https://my.digium.com/images/graphics/digium_RGB_signature.gif" width="288" height="50" style="font-family: Arial, Helvetica, sans-serif; font-size: 12px;" class=""><div class="">Scott Griepentrog<br class="">Digium, Inc · Software Developer<br class="">445 Jan Davis Drive NW · Huntsville, AL 35806 · US<br class="">direct/fax: +1 256 428 6239 · mobile: +1 256 580 6090<br class="">Check us out at: <a href="http://digium.com/" target="_blank" class="">http://digium.com</a> · <a href="http://asterisk.org/" target="_blank" class="">http://asterisk.org</a><br class=""></div></div></div>
</div>
-- <br class="">_____________________________________________________________________<br class="">-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" class="">http://www.api-digital.com</a> --<br class="">New to Asterisk? Join us for a live introductory webinar every Thurs:<br class=""> <a href="http://www.asterisk.org/hello" class="">http://www.asterisk.org/hello</a><br class=""><br class="">asterisk-users mailing list<br class="">To UNSUBSCRIBE or update options visit:<br class=""> <a href="http://lists.digium.com/mailman/listinfo/asterisk-users" class="">http://lists.digium.com/mailman/listinfo/asterisk-users</a></div></blockquote></div><br class=""></div></div></div></div></body></html>