<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
/* Page Definitions */
@page Section1
{size:595.3pt 841.9pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;
layout-grid:15.6pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=ZH-CN link=blue vlink=purple style='text-justify-trim:punctuation'>
<div class=Section1 style='layout-grid:15.6pt'>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>Hi, everybody.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>Currently I incurred some problems with asterisk
security. Initially I did not set any firewall for my server and unluckily it
has been hacked by some one. And I modified my iptables as below, and currently
I have two Ethernet cards, eth0 for net access, and eth1 for internal LAN
network. I only want to block the ports for the eth0 and allow anything for
eht1. but the current setting will block any other ports for both eth0 and
eth1. any body know how to set it? Or instead of it, anybody know how to set a
professional firewall for Asterisk server?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>Thanks in advance.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>============================================================================<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>*filter<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>:INPUT ACCEPT [60713:10783188]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'># SIP on UDP port 5060. Other SIP servers may need TCP
port 5060 as well<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>#sometimes SIP is on port 5061 or 5062<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A INPUT -p udp -m udp --dport 5060 -j ACCEPT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>#IAX2 the IAX protocol<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A INPUT -p udp -m udp --dport 4569 -j ACCEPT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'># IAX<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A INPUT -p udp -m udp --dport 5036 -j ACCEPT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'># RTP : the media stream<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A INPUT -p udp -m udp --dport 10000:20000 -j ACCEPT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'># SSH? : Secure shell sessions, open at port 22<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'># httpd open at port 80.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'># stop all other ports.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A INPUT -j DROP<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>:FORWARD DROP [0:0]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>:OUTPUT ACCEPT [53370:9153725]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A FORWARD -i eth0 -o eth1 -m state --state
RELATED,ESTABLISHED -j ACCEPT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A FORWARD -i eth1 -o eth0 -j ACCEPT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A FORWARD -j LOG<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>COMMIT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'># Completed on Thu Nov 2 17:16:22 2006<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'># Generated by iptables-save v1.2.11 on Thu Nov 2
17:16:22 2006<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>*nat<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>:PREROUTING ACCEPT [1469:101523]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>:POSTROUTING ACCEPT [284:18747]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>:OUTPUT ACCEPT [290:19275]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>-A POSTROUTING -o eth0 -j MASQUERADE<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'>COMMIT<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span lang=EN-US
style='font-size:9.0pt'># Completed on Thu Nov 2 17:16:22 2006<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'>==================================================================<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=1 face=Arial><span lang=EN-US style='font-size:
9.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><em><i><font size=2 face="Times New Roman"><span lang=EN-US
style='font-size:10.0pt'>Best Regards</span></font></i></em><span lang=EN-US><o:p></o:p></span></p>
<p class=MsoNormal><font size=2 face="Times New Roman"><span lang=EN-US
style='font-size:10.5pt'> <o:p></o:p></span></font></p>
<p class=MsoNormal><em><i><font size=2 face="Times New Roman"><span lang=EN-US
style='font-size:10.0pt'>Johnny <b><span style='font-weight:bold'> Xing</span></b>
Haipeng</span></font></i></em><span lang=EN-US><o:p></o:p></span></p>
<p class=MsoNormal><font size=2 face="Times New Roman"><span lang=EN-US><o:p> </o:p></span></font></p>
</div>
</body>
</html>