So here's a bit more info, and a copy of our newly tidied iptables. I should say that although I just about understand what's going on here, I didn't put this together. My good friend Tim (computer scientist, coder and someone who knows far more about linux commands than is healthy for any individual) implemented this. So I certainly don't feel in a knowledgable position to post to resources
Anyone more familiar with iptables than me do point out any glaring holes in this.
The file has been given a tidy up, this isn't necessary but does make it easier to read (at least to me). So all the trusted providers are now in a chain called voips and this defines the ports allowed. I don't use them, so they're commented out. For a super tidy file all the commented entries could just be deleted.
The bit we're using to give access to our mobile user with some semblance of security is the door. Here's my understanding of what happens. On the first connection of a client the incoming udp packet to 5060 is passed to the door chain. This checks if the appropriate string is present. If it is, the IP is added to the voipclients list otherwise it's dropped. The IP then gets to pass through for 4000 seconds until the check is run again.
What we haven't checked is whether everything sent by the client contains the string (we're using the display name) and I confess we don't really know how sip registration works and how often the client talks to the server. So that 4000 seconds is probably far longer than it needs to be.
What I like about this solution is that it works... you can have a string per client just by adding another line, and you can search on any string that's specific to a client which may help get around some client config limitations. It's still security by obscurity to be honest and anyone in a position to sniff traffic twixt client and server could probably find a way in, however as I've said before I don't think that's much of a risk. Our server is still protected by a separate firewall and then have Asterisk only allowing connections from the lan for all but our mobile extensions. Then there are strong passwords on top of that.
I could narrow things down further by only allowing this to work from the mobile networks, and requiring travelin' man 3 for everything else, but that ruins the user experience and I don't really feel it's necessary.
Now if only PIAF and phones supported certificate authentication...
Code:
# Generated by iptables-save v1.3.5 on Tue Feb 8 11:35:49 2011
*filter
:INPUT DROP [636:118995]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [45625:6667023]
-N voips
#-A voips -s outbound1.vitelity.net -j ACCEPT
#-A voips -s inbound1.vitelity.net -j ACCEPT
#-A voips -s atlanta.voip.ms -j ACCEPT
#-A voips -s chicago.voip.ms -j ACCEPT
#-A voips -s dallas.voip.ms -j ACCEPT
#-A voips -s houston.voip.ms -j ACCEPT
#-A voips -s losangeles.voip.ms -j ACCEPT
#-A voips -s newyork.voip.ms -j ACCEPT
#-A voips -s seattle.voip.ms -j ACCEPT
#-A voips -s tampa.voip.ms -j ACCEPT
#-A voips -s montreal.voip.ms -j ACCEPT
#-A voips -s montreal2.voip.ms -j ACCEPT
#-A voips -s toronto.voip.ms -j ACCEPT
#-A voips -s toronto2.voip.ms -j ACCEPT
#-A voips -s london.voip.ms -j ACCEPT
# DIDforsale only has an IP address and no FQDN = 209.216.2.211
#-A voips -s 209.216.2.211 -j ACCEPT
#-A voips -s callcentric.com -j ACCEPT
#-A voips -s sipgate.com -j ACCEPT
#-A voips -s chi-out.voipstreet.com -j ACCEPT
#-A voips -s chi-in.voipstreet.com -j ACCEPT
#-A voips -s did.voip.les.net -j ACCEPT
#-A voips -s magnum.axvoice.com -j ACCEPT
#-A voips -s proxy.sipthor.net -j ACCEPT
#-A voips -s sip.voipwelcome.com -j ACCEPT
#-A voips -s incoming.future-nine.com -j ACCEPT
#-A voips -s outgoing.future-nine.com -j ACCEPT
#-A voips -s DEN.teliax.net -j ACCEPT
#-A voips -s LAX.teliax.net -j ACCEPT
#-A voips -s NYC.teliax.net -j ACCEPT
#-A voips -s ATL.teliax.net -j ACCEPT
#-A voips -s gvgw1.simonics.com -j ACCEPT
# IPkall uses two IP addresses: 66.54.140.46 and 66.54.140.47
#-A voips -s 66.54.140.46 -j ACCEPT
#-A voips -s 66.54.140.47 -j ACCEPT
-N door
# Knocks.
-A door -m string --algo bm --string "[COLOR=#ff0000]YOUR_STRING_HERE[/COLOR]" -m recent --set --name voipclients -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -m state --state RELATED -j ACCEPT
-A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT
-A INPUT -p tcp -m tcp --dport 113 -j ACCEPT
-A INPUT -p udp -m udp --dport 10000:20000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 32976 -j ACCEPT
-A INPUT -p udp -m udp --dport 123 -j ACCEPT
# Travelin Man 2 Web Interface Requires TCP Port 83 open
#-A INPUT -p tcp -m tcp --dport 83 -j ACCEPT
# End of Travelin Man 2 addition
# Google Voice requires the next two port openings
-A INPUT -p udp -m udp --dport 5222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5222 -j ACCEPT
# Port "knocking" for SIP clients
-A INPUT -p udp --dport 5060 -m recent --rcheck --seconds 4000 --name voipclients -j ACCEPT
-A INPUT -p udp --dport 5060 -j door
# Other Trusted Providers
-A INPUT -p udp -m multiport --dports 4569,5060:5069 -j voips
# End of Trusted Provider Section
-A INPUT -s 10.0.0.0/8 -j ACCEPT
-A INPUT -s 127.0.0.0/8 -j ACCEPT
#-A INPUT -s 172.16.0.0/12 -j ACCEPT
-A INPUT -s 192.168.0.0/16 -j ACCEPT
COMMIT
# Completed on Tue Feb 8 11:35:49 2011
# Generated by iptables-save v1.3.5 on Tue Feb 8 11:35:49 2011
*mangle
:PREROUTING ACCEPT [59114:43092827]
:INPUT ACCEPT [58517:43020696]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [45625:6667023]
:POSTROUTING ACCEPT [45627:666730]
COMMIT
# Completed on Tue Feb 8 11:35:49 2011
# Generated by iptables-save v1.3.5 on Tue Feb 8 11:35:49 2011
*nat
:PREROUTING ACCEPT [1620:224741]
:POSTROUTING ACCEPT [3827:274034]
:OUTPUT ACCEPT [3827:274034]
COMMIT
# Completed on Tue Feb 8 11:35:49 2011
Phone System 