Jump to content

This is the support site for Andrews & Arnold Ltd, a UK Internet provider. Information on these pages is generally for our customers but may be useful to others, enjoy!

VoIP Firewall: Difference between revisions

→‎NAT: fix brackets
(Mention SIP Keep-Alives)
(→‎NAT: fix brackets)
(6 intermediate revisions by 2 users not shown)
This is what we suggest firewall-wise for VoIP customers:
 
Avoid using NAT where possible. HoweverIf using NAT, somethe options are to tell the phone what its public IP address is (either by explicit configuration, or by specifying a STUN server to use - e.g. ''stun.aa.net.uk''), or to use a SIP Application Layer Gateway to rewrite SIP packets on the fly. Some NAT gateways provide an adequate SIP ALG (e.g. Technicolor TG582), and some devices provide NAT that works with the new call server (e.g. FireBrick FB2700 and many simple NAT routers). If NAT works, then well done, but if not we cannot guarantee to be able to make it work.
 
{| class="wikitable"
!colspan="3"|Firewall Requirements on the AAISP VoIP Platform
|-
!
|
!Target Ports
!Source IPs
=Example FireBrick Config=
Allow inbound calls to your VoIP Phone, if you register it with FireBrick:
<syntaxhighlight lang="xml">
<rule name="Allow Firebrick" source-interface="self" comment="Allow all from the FireBrick to LAN"/>
</syntaxhighlight>
 
Allow inbound calls to your VoIP/Snom Phone, if you register it with Voiceless:
<syntaxhighlight lang="xml">
<rule name="SIP" source-ip="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48" target-ip="1.2.3.4" target-port="5060" action="accept"/>
<rule name="RTP" source-ip="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48" target-ip="1.2.3.4" target-port="1024-65535" protocol="17" action="accept"/>
</syntaxhighlight>
Allow inbound calls to your Snom Phone, if you register it with Voiceless:
<syntaxhighlight>
<rule name="SIP" source-ip="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48" target-ip="1.2.3.4" target-port="5060" action="accept"/>
<rule name="RTP" source-ip="81.187.30.110-119 90.155.3.0/24 90.155.103.0/24 2001:8b0:0:30::5060:0/112 2001:8b0:5060::/48" target-ip="1.2.3.4" target-port="49152-65535" protocol="17" action="accept"/>
</syntaxhighlight>
 
|IPv6
|UDP
|5000-59995099
|ACCEPT
|WAN to LAN
|IPv6
|UDP
|5000-59995099
|ACCEPT
|WAN to LAN
|IPv4
|UDP
|5000-59995099
|ACCEPT
|WAN to LAN
|IPv4
|UDP
|5000-59995099
|ACCEPT
|WAN to LAN
|IPv4
|UDP
|5000-59995099
|ACCEPT
|WAN to LAN
|IPv4
|UDP
|5000-59995099
|ACCEPT
|WAN to LAN
 
=NAT=
Avoid using NAT where possible. However, some NAT gateways provide an adequate SIP ALG (e.g. Technicolor TG582), and some devices provide NAT that works with the new call server (e.g. FireBrick 2500/2700 and many simple NAT routers). Using a STUN server (e.g. ''stun.aa.net.uk''}) is another possible solution. If NAT works, then well done, but if not we cannot guarantee to be able to make it work.
 
If you have 2 phones behind a NAT router, they cannot have the same SIP port number, nor the same RTP port range (if they both used port number for SIP of 5060 then when an incoming call came in to external port 5060, NAT wouldn't know which phone to send it to).
As an example with 2 phones, the first phone uses inbound SIP port 5060 and incoming RTP ports 5062-5068, and the second phone uses inbound SIP port 5040 and incoming RTP ports 5042-5048. Using iptables, the required rules would be like:
 
/sbin/iptables -t nat -A PREROUTING -i eth0 -m udp -p udp -s 81.187.30.0112/2429 --dport 5060:5069 -j DNAT --to-destination 192.168.1.12
/sbin/iptables -t nat -A PREROUTING -i eth0 -m udp -p udp -s 81.187.30.0112/2429 --dport 5040:5049 -j DNAT --to-destination 192.168.1.13
 
See: [[VoIP NAT]]
editor
698

edits