Your local network acl should be default deny, then allow the local network cidr ranges that you consider local.<br><br>On Tuesday, October 6, 2015, Charles Bujold <<a href="mailto:cjbujold@accra.ca">cjbujold@accra.ca</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="#0563C1" vlink="#954F72"><div><p class="MsoNormal">We are trying to have Freeswitch work for 2 LAN segments (<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a> and <a href="http://192.168.25.0/24" target="_blank">192.168.25.0/24</a>) We have create an ACL for Freeswitch as follows. However, the lan segment <a href="http://192.168.25.0/24" target="_blank">192.168.25.0/24</a> cannot make calls, their calls are routed via the WAN and not internally ( the Freeswitch server is on the <a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a> segment). What are we missing? Not certain when to use Deny and Allow settings in ACL? Any help would be appreciated. What is the proper configuration for the ACL xml? Internal Profile is listed below if it needs to be changed please let us know.<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Thanks<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><configuration name="acl.conf" description="Network Lists"><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <network-lists><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!-- <u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> These ACL's are automatically created on startup.<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> rfc1918.auto - RFC1918 Space<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> nat.auto - RFC1918 Excluding your local lan.<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> localnet.auto - ACL for your local lan.<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> loopback.auto - ACL for your local lan.<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> --><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <list name="lan" default="deny"><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <node type="deny" cidr="<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a>"/> <u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <node type="allow" cidr="<a href="http://192.168.25.0/24" target="_blank">192.168.25.0/24</a>"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> </list><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <list name="localnet.auto" default="allow"><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <node type="allow" cidr="<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a>"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <node type="allow" cidr="<a href="http://192.168.25.0/24" target="_blank">192.168.25.0/24</a>"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> </list><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!--<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> This will traverse the directory adding all users <u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> with the cidr= tag to this ACL, when this ACL matches<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> the users variables and params apply as if they <u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> digest authenticated.<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> --><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <list name="domains" default="deny"><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!-- domain= is special it scans the domain from the directory to build the ACL --><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <node type="allow" domain="$${domain}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!-- use cidr= if you wish to allow ip ranges to this domains acl. --><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <node type="allow" cidr="<a href="http://192.168.20.0/24" target="_blank">192.168.20.0/24</a>"/> <u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <node type="allow" cidr="<a href="http://192.168.25.0/24" target="_blank">192.168.25.0/24</a>"/> <u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> </list><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> </network-lists><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"></configuration><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal">Our Internal SIP Profile is configured as follows: <u></u><u></u></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><profile name="internal"><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!-- <a href="http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files" target="_blank">http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files</a> --> <u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!--aliases are other names that will work as a valid profile name for this profile--><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <aliases><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!--<u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <alias name="default"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> --><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> </aliases><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!-- Outbound Registrations --><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <gateways><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <X-PRE-PROCESS cmd="include" data="internal/*.xml"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> </gateways><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <domains><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!-- indicator to parse the directory for domains with parse="true" to get gateways--><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!--<domain name="$${domain}" parse="true"/>--><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!-- indicator to parse the directory for domains with parse="true" to get gateways and alias every domain to this profile --><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <!--<domain name="all" alias="true" parse="true"/>--><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <domain name="all" alias="true" parse="false"/> <u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> </domains><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <settings><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="debug" value="0"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="sip-trace" value="no"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="sip-capture" value="no"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="watchdog-enabled" value="no"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="watchdog-step-timeout" value="30000"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="watchdog-event-timeout" value="30000"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="log-auth-failures" value="true"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="forward-unsolicited-mwi-notify" value="false"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="context" value="public"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="rfc2833-pt" value="101"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="sip-port" value="$${internal_sip_port}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="dialplan" value="XML"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="dtmf-duration" value="2000"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="inbound-codec-prefs" value="$${global_codec_prefs}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="outbound-codec-prefs" value="$${global_codec_prefs}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="rtp-timer-name" value="soft"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="rtp-ip" value="$${local_ip_v4}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="sip-ip" value="$${local_ip_v4}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="hold-music" value="$${hold_music}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="apply-nat-acl" value="nat.auto"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="apply-inbound-acl" value="domains"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="local-network-acl" value="localnet.auto"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="record-path" value="$${recordings_dir}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="record-template" value="${caller_id_number}.${target_domain}.${strftime(%Y-%m-%d-%H-%M-%S)}.wav"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="manage-presence" value="true"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="presence-hosts" value="$${domain},$${local_ip_v4}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="presence-privacy" value="$${presence_privacy}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="inbound-codec-negotiation" value="generous"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls" value="$${internal_ssl_enable}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-only" value="false"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-bind-params" value="transport=tls"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-sip-port" value="$${internal_tls_port}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-cert-dir" value="$${internal_ssl_dir}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-passphrase" value=""/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-verify-date" value="true"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-verify-policy" value="none"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-verify-depth" value="2"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-verify-in-subjects" value=""/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="tls-version" value="$${sip_tls_version}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="nonce-ttl" value="60"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="auth-calls" value="$${internal_auth_calls}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="inbound-reg-force-matching-username" value="true"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="auth-all-packets" value="false"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="ext-rtp-ip" value="$${external_rtp_ip}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="ext-sip-ip" value="$${external_sip_ip}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="rtp-timeout-sec" value="300"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="rtp-hold-timeout-sec" value="1800"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="force-register-domain" value="$${domain}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="force-subscription-domain" value="$${domain}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="force-register-db-domain" value="$${domain}"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="challenge-realm" value="auto_from"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> <param name="aggressive-nat-detection" value="true"/><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"> </settings><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"></profile><u></u><u></u></span></p><p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:10.0pt"><u></u> <u></u></span></p></div></div></blockquote><br><br>-- <br><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">
<p><font face="courier new, monospace"><b><i><font size="4">Brian West</font></i></b><br><span style="font-size:x-small"><a href="mailto:brian@freeswitch.org" target="_blank">brian@freeswitch.org</a></span></font></p>
<p><font size="1" face="courier new, monospace"><img src="http://billing.freeswitch.org/templates/default/img/whmcslogo.png"><br></font></p><p><font size="2" face="monospace, monospace"><b><i>Twitter: @FreeSWITCH , @briankwest</i></b><br><a href="http://www.freeswitchbook.com" target="_blank">http://www.freeswitchbook.com</a><br><a href="http://www.freeswitchcookbook.com" target="_blank">http://www.freeswitchcookbook.com</a></font></p><p><font face="monospace, monospace">Got Bugs? Report them <a href="https://freeswitch.org/jira" target="_blank">here</a>! | Reddit: <a href="https://www.reddit.com/r/freeswitch" target="_blank">/r/freeswitch</a></font></p>
<p><font size="2" face="monospace, monospace"><b>T:</b>+19184209001 | <b>F:</b>+19184209002 | <b>M:</b>+1918424WEST (9378)<br><b>iNUM:</b>+883 5100 1420 9001 | <b>ISN:</b>410*543 | <b>Skype:</b>briankwest</font></p></div></div></div></div></div></div></div></div></div><br>