Hello I have a FreeSwitch configured as a gateway, the proxy makes the user authentication and other functions. All servers have public ip's, and I have doubts to security. I had thought to put the proxy ip's in acl. Is it safe this scenario? Can it be improved? Should we also put the sip providers? Thanks. Greetings
On 9 June 2011 00:13, Antonio <potxoka@gmail.com> wrote:
Hello
I have a FreeSwitch configured as a gateway, the proxy makes the user authentication and other functions. All servers have public ip's, and I have doubts to security. I had thought to put the proxy ip's in acl. Is it safe this scenario? Can it be improved? Should we also put the sip providers? Thanks.
ACLs definitely would not hurt. Also think about setting up a simple firewall(e.g. Shorewall or just plain IPTables) to limit the access to the ip's which MUST have access(e.g. SIP-Provider IPs), you can never be sure if a software(like FreeSWITCH) doesn't have a bug that could be exploited. Cheers, Christian
Hi, If I had thought also use iptables, but it was to know if exists something better to put the ip's (to prevent IP spoofing). Thanks. Greetings Anto El 09/06/11 16:01, Christian Benke escribió:
ACLs definitely would not hurt. Also think about setting up a simple firewall(e.g. Shorewall or just plain IPTables) to limit the access to the ip's which MUST have access(e.g. SIP-Provider IPs), you can never be sure if a software(like FreeSWITCH) doesn't have a bug that could be exploited.
Cheers, Christian
Iptables will allow you to block all but your proxies from sending. It should work (slightly) faster than the FS ACL because it'll block it earlier in the packet processing. -Steve On 10 June 2011 10:31, Antonio <potxoka@gmail.com> wrote:
Hi,
If I had thought also use iptables, but it was to know if exists something better to put the ip's (to prevent IP spoofing). Thanks.
Greetings Anto
El 09/06/11 16:01, Christian Benke escribió:
ACLs definitely would not hurt. Also think about setting up a simple firewall(e.g. Shorewall or just plain IPTables) to limit the access to the ip's which MUST have access(e.g. SIP-Provider IPs), you can never be sure if a software(like FreeSWITCH) doesn't have a bug that could be exploited.
Cheers, Christian
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks ! ;-) El 10/06/11 11:46, Steven Ayre escribió:
Iptables will allow you to block all but your proxies from sending. It should work (slightly) faster than the FS ACL because it'll block it earlier in the packet processing.
-Steve
On 10 June 2011 10:31, Antonio <potxoka@gmail.com <mailto:potxoka@gmail.com>> wrote:
Hi,
If I had thought also use iptables, but it was to know if exists something better to put the ip's (to prevent IP spoofing). Thanks.
Greetings Anto
El 09/06/11 16:01, Christian Benke escribió: > ACLs definitely would not hurt. Also think about setting up a simple > firewall(e.g. Shorewall or just plain IPTables) to limit the access to > the ip's which MUST have access(e.g. SIP-Provider IPs), you can never > be sure if a software(like FreeSWITCH) doesn't have a bug that could > be exploited. > > Cheers, > Christian
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You can create an ACL listing proxy IPs then set the proxy-acl parameter on the SIP profile.call If your proxy can add a X-AUTH-IP header to the INVITE containing the caller's IP then FS will use that IP to check against ACLs instead of the IP received from, if the IP received from is on the proxy ACL. That way you can still authenticate callers with ACLs behind a proxy, although you're trusting your proxy to set that header correctly. The proxy-acl setting means only your proxy can set the X-AUTH-IP header, it'll be ignored on calls from any other IP. -Steve On 8 June 2011 23:13, Antonio <potxoka@gmail.com> wrote:
Hello
I have a FreeSwitch configured as a gateway, the proxy makes the user authentication and other functions. All servers have public ip's, and I have doubts to security. I had thought to put the proxy ip's in acl. Is it safe this scenario? Can it be improved? Should we also put the sip providers? Thanks.
Greetings
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi, Thank you very much for the reply, I will look at this solution. Best regards Anto El 09/06/11 16:17, Steven Ayre escribió:
You can create an ACL listing proxy IPs then set the proxy-acl parameter on the SIP profile.call
If your proxy can add a X-AUTH-IP header to the INVITE containing the caller's IP then FS will use that IP to check against ACLs instead of the IP received from, if the IP received from is on the proxy ACL. That way you can still authenticate callers with ACLs behind a proxy, although you're trusting your proxy to set that header correctly. The proxy-acl setting means only your proxy can set the X-AUTH-IP header, it'll be ignored on calls from any other IP.
-Steve
participants (3)
-
Antonio
-
Christian Benke
-
Steven Ayre