[Asterisk-Users] Asterisk iptables rules

[Steve Davies]

I would suggest that you are missing something like:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -i eth0 -j ACCEPT

This will mean that if a UDP packet is sent by * from sport:2345,
dport:5060, then the response (sport:5060, dport:2345) will be allowed
in, whereas at present that is not the case. I cannot say whether this
type of packet will ever be sent, but I always include the rule for
completeness.

Alternatively, add a "LOG" rule, just before the DROP rule, and see
what is being dropped...

Regards,
Steve

On 10/27/05, Goran Tornqvist <goran at goran.aleborg.se> wrote:
>
> One last check...won't ask again, promise :)
> Does someone know a solution to my problem below?
>
> Best Regards
> Goran
>
> ----- Original Message -----
> From: Goran Tornqvist
> To: asterisk-users at lists.digium.com
> Sent: Wednesday, October 26, 2005 10:33 AM
> Subject: Asterisk iptables rules
>
>
> Hello,
> I have trouble getting asterisk to work with my new firewall script (see
> below).
> I used this info as base:
> 'http://www.voip-info.org/wiki-Asterisk+firewall+rules
> And then modified it to suit my needs.
>
> I use only SIP and the problem is that the calls get in to asterisk when the
> firewall is activated.
> But my agents/phones cant register or receive any calls. So all calls get
> stuck in queue on asterisk.
> So I believe Im missing some rule perhaps?
>
> Can anyone help me sort this out?
>
> Thanks...
>
> Best Regards
> Goran
>
> /etc/init.d/firewall
> ======================================
>
> #IPTables firewall configuration for X
>
> export PATH=$PATH:/sbin
>
> case "$1" in
>   start)
>
>     echo "Starting iptables firewall..."
>
>     iptables --flush
>     iptables --delete-chain
>
>     iptables -A INPUT -p icmp -i eth0 -j ACCEPT
>
>     # START OPEN PORTS
>     #=================
>
>     #SSH (22)
>     iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT
>
>     #SAMBA: netbios (139) , microsoft-ds (445)
>     iptables -A INPUT -p tcp -i eth0 --dport 139 -j ACCEPT
>     iptables -A INPUT -p tcp -i eth0 --dport 445 -j ACCEPT
>
>     #ASTERISK
>
>       # SIP (UDP 5060)
>       iptables -A INPUT -p tcp -m tcp -i eth0 --dport 5060 -j ACCEPT
>       iptables -A INPUT -p udp -m udp -i eth0 --dport 5060 -j ACCEPT
>
>       # IAX2/IAX
>       iptables -A INPUT -p udp -m udp -i eth0 --dport 4569 -j ACCEPT
>       iptables -A INPUT -p udp -m udp -i eth0 --dport 5036 -j ACCEPT
>
>       # RTP - the media stream
>       iptables -A INPUT -p udp -m udp -i eth0 --dport 10000:20000 -j ACCEPT
>
>       # MGCP - if you use media gateway control protocol in your
> configuration
>       iptables -A INPUT -p udp -m udp -i eth0 --dport 2727 -j ACCEPT
>
>     #END ASTERISK
>
>     #MySQL (3306)
>     iptables -A INPUT -p tcp -i eth0 --dport 3306 -j ACCEPT
>     iptables -A INPUT -p udp -i eth0 --dport 3306 -j ACCEPT
>
>     #SNMP (161) - Allow from cacti server
>     iptables -A INPUT -p tcp -i eth0 --dport 161 --source x.x.x.x -j ACCEPT
>     iptables -A INPUT -p udp -i eth0 --dport 161 --source x.x.x.x -j ACCEPT
>
>     #Ftp / Passive ports
>     iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT
>     iptables -A INPUT -p tcp -i eth0 --dport 64785:64799 -j ACCEPT
>
>     #Http / Web
>     iptables -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
>
>     #Webmin (10000)
>     iptables -A INPUT -p tcp -i eth0 --dport 10000 -j ACCEPT
>
>     # END OPEN PORTS
>     #=================
>
>     #Deny everything else
>     iptables -A INPUT -p all -i eth0 -j DROP
>
>     exit 0;
>     ;;
>
>   stop)
>
>     echo "Stopping iptables firewall..."
>     iptables --flush
>     iptables --delete-chain
>
>     exit 0;
>     ;;
>
>   *)
>     echo "Valid switches: firewall start , firewall stop";
>
> esac;
>
> _______________________________________________
> --Bandwidth and Colocation sponsored by Easynews.com --
>
> Asterisk-Users mailing list
> Asterisk-Users at lists.digium.com
> http://lists.digium.com/mailman/listinfo/asterisk-users
> To UNSUBSCRIBE or update options visit:
>
> http://lists.digium.com/mailman/listinfo/asterisk-users
>
>