{"id":355,"date":"2012-08-16T17:29:42","date_gmt":"2012-08-16T15:29:42","guid":{"rendered":"http:\/\/rexxer.kharkov.ru\/?p=355"},"modified":"2012-08-16T17:29:42","modified_gmt":"2012-08-16T15:29:42","slug":"asterisk-rules-for-a-firewall","status":"publish","type":"post","link":"https:\/\/dety.net.ua\/?p=355","title":{"rendered":"Asterisk + rules for a firewall"},"content":{"rendered":"

IPFW:<\/p>\n

\n
    \n
  1. Firewall comand<\/li>\n<\/ol>\n

    fwcmd=”\/sbin\/ipfw -q”<\/p>\n

      \n
    1. Interface setup<\/li>\n
    2. Outside interface<\/li>\n<\/ol>\n

      oip=”<your external ip address>”<\/p>\n

        \n
      1. * pbx ip<\/li>\n<\/ol>\n

        pbxip=”<your * internal ip>”<\/p>\n

          \n
        1. VoIP Traffic – SIP & IAX<\/li>\n<\/ol>\n

          ${fwcmd} add pass tcp from ${oip} to ${pbxip} 5060 keep-state in
          \n${fwcmd} add pass tcp from ${pbxip} to any 5060 keep-state out
          \n${fwcmd} add pass udp from ${oip} to ${pbxip} 5060 keep-state in
          \n${fwcmd} add pass udp from ${oip} to ${pbxip} 4569 keep-state in
          \n${fwcmd} add pass udp from ${oip} to ${pbxip} 2727 keep-state in
          \n${fwcmd} add pass udp from ${oip} to ${pbxip} 9999-20001 keep-state in
          \n${fwcmd} add pass udp from ${pbxip} to any keep-state out<\/p><\/blockquote>\n

          PF:<\/p>\n

          \n
            \n
          1. Your inet interface<\/li>\n<\/ol>\n

            ext = rl0<\/p>\n

              \n
            1. SIP (TCP)<\/li>\n<\/ol>\n

              voip_tcp = “5060”<\/p>\n

                \n
              1. SIP, IAX2, IAX, RTP, MGCP (UDP)<\/li>\n<\/ol>\n

                voip_udp = “{5060, 4569, 5036, 9999 >< 20001, 2727}”<\/p>\n

                pf pass in on $ext inet proto tcp from any to any port $voip_tcp flags S\/SA keep state
                \npf pass out on $ext inet proto tcp all flags S\/SA keep state
                \npf pass in on $ext inet proto udp from any to any port $voip_udp keep state
                \npf pass out on $ext proto udp all keep state<\/p>\n

                pf.conf<\/em> on gateway router\/asterisk box with QoS<\/p>\n

                  \n
                1. \n
                    \n
                  1. \n
                      \n
                    1. \n
                        \n
                      1. macros ####<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                        ext_if=”xl0″ # 172.16.0.2
                        \nint_if=”xl1″ # 10.0.0.1
                        \nlan_net = “10.0.0.0\/24”
                        \ntable <blocked> persist
                        \ntable <routed> persist<\/p>\n

                          \n
                        1. \n
                            \n
                          1. machines<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                            ext_ip = “172.16.0.2”
                            \nsiphost = “172.16.0.3”
                            \nvoip = “10.0.0.4”<\/p>\n

                              \n
                            1. \n
                                \n
                              1. \n
                                  \n
                                1. \n
                                    \n
                                  1. options ####<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                                    set skip on lo0
                                    \nset optimization conservative
                                    \nset block-policy drop
                                    \nset loginterface $ext_if
                                    \nscrub in all<\/p>\n

                                      \n
                                    1. \n
                                        \n
                                      1. \n
                                          \n
                                        1. \n
                                            \n
                                          1. QoS stuff #######<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                                            altq on $ext_if priq bandwidth 520Kb queue { q_pri, q_def, q_bulk, q_crap }
                                            \nqueue q_pri priority 7
                                            \nqueue q_def priority 5 priq(default)
                                            \nqueue q_bulk priority 1
                                            \nqueue q_crap priority 0<\/p>\n

                                              \n
                                            1. \n
                                                \n
                                              1. \n
                                                  \n
                                                1. \n
                                                    \n
                                                  1. \n
                                                      \n
                                                    1. NAT ####<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                                                      nat on $ext_if from <routed> -> $ext_ip<\/p>\n

                                                        \n
                                                      1. \n
                                                          \n
                                                        1. \n
                                                            \n
                                                          1. \n
                                                              \n
                                                            1. \n
                                                                \n
                                                              1. rules ####<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                                                                block drop out quick on $ext_if proto { udp, icmp, tcp } from any to <blocked>
                                                                \nblock drop in quick on $ext_if proto { udp, icmp, tcp } from <blocked> to any
                                                                \nblock drop in on $ext_if from any to any
                                                                \npass in on $ext_if from $lan_net to any<\/p>\n

                                                                  \n
                                                                1. \n
                                                                    \n
                                                                  1. basic<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                                                                    pass out on $ext_if proto tcp all modulate state flags S\/SA
                                                                    \npass out on $ext_if proto { udp, icmp } all keep state
                                                                    \npass in on $int_if proto icmp all keep state<\/p>\n

                                                                      \n
                                                                    1. \n
                                                                        \n
                                                                      1. asterisk<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                                                                        pass in from any to $siphost
                                                                        \npass in quick proto udp from any to any port 4569
                                                                        \nkeep state queue (q_pri)
                                                                        \npass out quick proto udp from any to any port 4569
                                                                        \nkeep state queue (q_pri)<\/p>\n

                                                                          \n
                                                                        1. \n
                                                                            \n
                                                                          1. default<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

                                                                            pass out on $ext_if proto tcp from $ext_if to any flags S\/SA
                                                                            \nkeep state queue (q_def, q_pri)
                                                                            \npass in on $ext_if proto tcp from any to $ext_if flags S\/SA
                                                                            \nkeep state queue (q_def, q_pri)<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

                                                                            IPFW: Firewall comand fwcmd=”\/sbin\/ipfw -q” Interface setup Outside interface oip=”<your external ip address>” * pbx ip pbxip=”<your * internal ip>” VoIP Traffic – SIP & IAX ${fwcmd} add pass tcp from ${oip} to ${pbxip} 5060 keep-state in ${fwcmd} add pass tcp from ${pbxip} to any 5060 keep-state out ${fwcmd} add pass udp from ${oip} to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,10],"tags":[],"class_list":["post-355","post","type-post","status-publish","format-standard","hentry","category-novosti","category-unified-communications"],"_links":{"self":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=355"}],"version-history":[{"count":0,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/355\/revisions"}],"wp:attachment":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}