Firewall Blacklist/Whitelist

[wardmundy]

It's Soup!

VoIP WhiteList for IPtables is now available. It supports both SIP and IAX trunks and extensions. Thanks to everyone who tested and offered suggestions/enhancements!

 

[rossiv]

It is not working for me. I have a self-hosted (Public IP) box and to test it, I set IPTables to drop all packets from my IP address but I could still register a phone and use the system as normal. I ran the ./firewall-whitelist-gen.sh and ./firewall-whitelist.sh and Applied configuration in Webmin - but that made no difference. I am running 1.7.5.5.3 Purple.
Thanks!

 

[kh40s]

It is not working for me. I have a self-hosted (Public IP) box and to test it, I set IPTables to drop all packets from my IP address but I could still register a phone and use the system as normal. I ran the ./firewall-whitelist-gen.sh and ./firewall-whitelist.sh and Applied configuration in Webmin - but that made no difference. I am running 1.7.5.5.3 Purple.
Thanks!

Can you post the output of "iptables -vnL"? and tell us what the IP address of the blocked phone is?

 

[rossiv]

Can you post the output of "iptables -vnL"? and tell us what the IP address of the blocked phone is?

Well I would, but my server is not responding and I think I blocked myself from it... And it is 40 miles away from me..... OR it somehow turned itself off or the power went out or something. If I can get access to it again, I will post back.

 

[jroper]

Hi

I see your script opens up IP Tables for your Voice over IP providers, if I have read your script properly.

You advocate not opening an external firewall to SIP providers, simply choosing the right SIP provider, and the right router, yet the script opens these ports to the carriers IP address on IP-Tables.

I think that these should only be opened if the carrier is sending DID to you over SIP without authentication.

Can you explain further why opening the ports on IP-Tables to carriers is necessary in this scenario but not where an external hardware firewall is concerned.

Joe

 

[dad311]

Ive installed these scripts on two machines and have the same issue on both.

The scripts run, the the running firewall is updated, the iptables gets copied, but the iptables file is not updated.

Bassically, no whitelist after a reboot or iptables restart.

 

[wardmundy]

After running the two scripts,

Trying doing: service iptables save

Check to see if they're still there: iptables -nL

Reload iptables: service iptables restart

Check to see if they're still there: iptables -nL

 

[dad311]

After running the two scripts,

Trying doing: service iptables save

Check to see if they're still there: iptables -nL

Reload iptables: service iptables restart

Check to see if they're still there: iptables -nL

"Service iptables save" fixed my issue.

I checked the script, and this command is commented out at the end of the script.

 

[wardmundy]