<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>We are trying to have Freeswitch work for 2 LAN segments (192.168.20.0/24 and 192.168.25.0/24) We have create an ACL for Freeswitch as follows. However, the lan segment 192.168.25.0/24 cannot make calls, their calls are routed via the WAN and not internally ( the Freeswitch server is on the 192.168.20.0/24 segment). What are we missing? Not certain when to use Deny and Allow settings in ACL? Any help would be appreciated. What is the proper configuration for the ACL xml? Internal Profile is listed below if it needs to be changed please let us know.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><configuration name="acl.conf" description="Network Lists"><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <network-lists><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!-- <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> These ACL's are automatically created on startup.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> rfc1918.auto - RFC1918 Space<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> nat.auto - RFC1918 Excluding your local lan.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> localnet.auto - ACL for your local lan.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> loopback.auto - ACL for your local lan.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <list name="lan" default="deny"><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <node type="deny" cidr="192.168.20.0/24"/> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <node type="allow" cidr="192.168.25.0/24"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> </list><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <list name="localnet.auto" default="allow"><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <node type="allow" cidr="192.168.20.0/24"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <node type="allow" cidr="192.168.25.0/24"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> </list><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!--<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> This will traverse the directory adding all users <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> with the cidr= tag to this ACL, when this ACL matches<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> the users variables and params apply as if they <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> digest authenticated.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <list name="domains" default="deny"><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!-- domain= is special it scans the domain from the directory to build the ACL --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <node type="allow" domain="$${domain}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!-- use cidr= if you wish to allow ip ranges to this domains acl. --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <node type="allow" cidr="192.168.20.0/24"/> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <node type="allow" cidr="192.168.25.0/24"/> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> </list><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> </network-lists><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'></configuration><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal>Our Internal SIP Profile is configured as follows: <o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><profile name="internal"><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!-- http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files --> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!--aliases are other names that will work as a valid profile name for this profile--><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <aliases><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!--<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <alias name="default"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> </aliases><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!-- Outbound Registrations --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <gateways><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <X-PRE-PROCESS cmd="include" data="internal/*.xml"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> </gateways><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <domains><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!-- indicator to parse the directory for domains with parse="true" to get gateways--><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!--<domain name="$${domain}" parse="true"/>--><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!-- indicator to parse the directory for domains with parse="true" to get gateways and alias every domain to this profile --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <!--<domain name="all" alias="true" parse="true"/>--><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <domain name="all" alias="true" parse="false"/> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> </domains><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <settings><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="debug" value="0"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="sip-trace" value="no"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="sip-capture" value="no"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="watchdog-enabled" value="no"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="watchdog-step-timeout" value="30000"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="watchdog-event-timeout" value="30000"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="log-auth-failures" value="true"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="forward-unsolicited-mwi-notify" value="false"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="context" value="public"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="rfc2833-pt" value="101"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="sip-port" value="$${internal_sip_port}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="dialplan" value="XML"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="dtmf-duration" value="2000"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="inbound-codec-prefs" value="$${global_codec_prefs}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="outbound-codec-prefs" value="$${global_codec_prefs}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="rtp-timer-name" value="soft"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="rtp-ip" value="$${local_ip_v4}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="sip-ip" value="$${local_ip_v4}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="hold-music" value="$${hold_music}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="apply-nat-acl" value="nat.auto"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="apply-inbound-acl" value="domains"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="local-network-acl" value="localnet.auto"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="record-path" value="$${recordings_dir}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="record-template" value="${caller_id_number}.${target_domain}.${strftime(%Y-%m-%d-%H-%M-%S)}.wav"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="manage-presence" value="true"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="presence-hosts" value="$${domain},$${local_ip_v4}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="presence-privacy" value="$${presence_privacy}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="inbound-codec-negotiation" value="generous"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls" value="$${internal_ssl_enable}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-only" value="false"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-bind-params" value="transport=tls"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-sip-port" value="$${internal_tls_port}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-cert-dir" value="$${internal_ssl_dir}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-passphrase" value=""/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-verify-date" value="true"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-verify-policy" value="none"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-verify-depth" value="2"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-verify-in-subjects" value=""/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="tls-version" value="$${sip_tls_version}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="nonce-ttl" value="60"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="auth-calls" value="$${internal_auth_calls}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="inbound-reg-force-matching-username" value="true"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="auth-all-packets" value="false"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="ext-rtp-ip" value="$${external_rtp_ip}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="ext-sip-ip" value="$${external_sip_ip}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="rtp-timeout-sec" value="300"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="rtp-hold-timeout-sec" value="1800"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="force-register-domain" value="$${domain}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="force-subscription-domain" value="$${domain}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="force-register-db-domain" value="$${domain}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="challenge-realm" value="auto_from"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> <param name="aggressive-nat-detection" value="true"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'> </settings><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'></profile><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:10.0pt'><o:p> </o:p></span></p></div></body></html>