Getting started wiki page & external gateway: do I understand correctly?
Hi list, More or less beginner, home situation; trying to set up fs (again).. I've got 2 questions: 1. Posting here to make sure I understand before modifying the wiki. Could you please correct me if I'm wrong? Over here http://wiki.freeswitch.org/wiki/Getting_Started_Guide#External it says "The External (formerly "outbound") profile handles outbound registrations to a SIP provider." However, earlier on it also mentions you can let external devices (i.e. user phones in their own networks) register with that profile... so I'd change this to: "The External (formerly "outbound") profile also handles outbound registrations to a SIP provider." Then this: "The external profile allows anonymous calling, which is required as your provider will never authenticate with you to send you a call." Skimmed through the bridge book p78, Receiving calls, which seems to confirm external profile does not require authentication. Ok, fine. Then this: "In order to secure your FreeSWITCH it is wise to link your outbound profile to a dialplan context other than 'default', which in the default configuration is the where authenticated users are placed." Seems this advice mixes a default situation (default dialplan being sensitive) with conditional advice (your outbound profile which would be external in a default config). I would change outbound to external in order to lessen confusion: "In order to secure your FreeSWITCH it is wise to link your exgternal profile to a dialplan context other than 'default', which in the default configuration is where authenticated users are placed." ... although what is probably really meant is something like: "As mentioned, the profile used for outbound registrations allows anonymous, unauthenticated calling. By default, this profile is the external profile. In order to secure your FreeSWITCH, don't link this profile to a dialplan that allows dialing paid numbers or dialing users (who may be bothered/harrassed) without any further checking. Summary: in a default configuration: don't link your external profile to a 'default' dialplan." ... which is a mouthful. 2. Given the above, if I want to have external users in their own network behind NAT register to me, it would be best if I define an additional profile that does require SIP authentication, right? I can then use the external profile to register with SIP trunks etc. Thanks! -- Regards, jb
Actually I'd say not to modify the wiki at all. It is valid as it stands. Typically most users who use this default diaplan will register their SIP provider's gateways on the external profile and all of their phones in the internal profile. Regarding the security part, well said over at that front. * users have been burned because of this. You can also set the default dialplan for that authenticated profile to be on public and set your users's user_context param to whatever context you want the user to be on. And the answer to your last question. Yes you sure as heck as can create a new sofia sip profile just for phones to register from the outside world. On Thu, Jul 5, 2012 at 12:42 AM, Jim <hakkie42@gmail.com> wrote:
Hi list,
More or less beginner, home situation; trying to set up fs (again)..
I've got 2 questions:
1. Posting here to make sure I understand before modifying the wiki. Could you please correct me if I'm wrong?
Over here http://wiki.freeswitch.org/wiki/Getting_Started_Guide#External
it says "The External (formerly "outbound") profile handles outbound registrations to a SIP provider." However, earlier on it also mentions you can let external devices (i.e. user phones in their own networks) register with that profile... so I'd change this to: "The External (formerly "outbound") profile also handles outbound registrations to a SIP provider."
Then this: "The external profile allows anonymous calling, which is required as your provider will never authenticate with you to send you a call."
Skimmed through the bridge book p78, Receiving calls, which seems to confirm external profile does not require authentication. Ok, fine.
Then this: "In order to secure your FreeSWITCH it is wise to link your outbound profile to a dialplan context other than 'default', which in the default configuration is the where authenticated users are placed." Seems this advice mixes a default situation (default dialplan being sensitive) with conditional advice (your outbound profile which would be external in a default config).
I would change outbound to external in order to lessen confusion: "In order to secure your FreeSWITCH it is wise to link your exgternal profile to a dialplan context other than 'default', which in the default configuration is where authenticated users are placed."
... although what is probably really meant is something like: "As mentioned, the profile used for outbound registrations allows anonymous, unauthenticated calling. By default, this profile is the external profile. In order to secure your FreeSWITCH, don't link this profile to a dialplan that allows dialing paid numbers or dialing users (who may be bothered/harrassed) without any further checking.
Summary: in a default configuration: don't link your external profile to a 'default' dialplan." ... which is a mouthful.
2. Given the above, if I want to have external users in their own network behind NAT register to me, it would be best if I define an additional profile that does require SIP authentication, right?
I can then use the external profile to register with SIP trunks etc.
Thanks! -- Regards,
jb
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks - glad I understood. Comments inline. On 5-7-2012 17:08, curriegrad2004 wrote:
Actually I'd say not to modify the wiki at all. It is valid as it stands. Well, that'll certainly take the least effort required ;)
Typically most users who use this default diaplan will register their SIP provider's gateways on the external profile and all of their phones in the internal profile. Got that.... personnally would like to see some more (even redundant) explanation of why things are done the way they are so people can understand the concepts more easily and leaving the fact that no phones are registered via the external profile more or less unspoken doesn't really help understanding IMO... but: if you're fine with it, not modifying the wiki doesn't take any effort, so I'll leave it ;)
(Yes, I'm the kind of guy that is prepared to write multiple posts about one single word... and proud of it ;)
Regarding the security part, well said over at that front. * users have been burned because of this. You can also set the default dialplan for that authenticated profile to be on public and set your users's user_context param to whatever context you want the user to be on. Ok, got it.
And the answer to your last question. Yes you sure as heck as can create a new sofia sip profile just for phones to register from the outside world. Ok, thanks ;) Did that, now going on to create users and remove some more default configs.
Next up: testing with LAN ATA, softphones and with double NAT: phone---<ATA>---<NAT>----<NAT>---<FreeSwitch>---<ATA>---phone ... thinking I'm going to need NDLB-connectile-dysfunction there... ... but I'll certainly post again if I can't find my way out of trouble. Thanks for the reply!
On Thu, Jul 5, 2012 at 12:42 AM, Jim <hakkie42@gmail.com> wrote:
Hi list,
More or less beginner, home situation; trying to set up fs (again)..
I've got 2 questions:
1. Posting here to make sure I understand before modifying the wiki. Could you please correct me if I'm wrong?
Over here http://wiki.freeswitch.org/wiki/Getting_Started_Guide#External
it says "The External (formerly "outbound") profile handles outbound registrations to a SIP provider." However, earlier on it also mentions you can let external devices (i.e. user phones in their own networks) register with that profile... so I'd change this to: "The External (formerly "outbound") profile also handles outbound registrations to a SIP provider."
Then this: "The external profile allows anonymous calling, which is required as your provider will never authenticate with you to send you a call."
Skimmed through the bridge book p78, Receiving calls, which seems to confirm external profile does not require authentication. Ok, fine.
Then this: "In order to secure your FreeSWITCH it is wise to link your outbound profile to a dialplan context other than 'default', which in the default configuration is the where authenticated users are placed." Seems this advice mixes a default situation (default dialplan being sensitive) with conditional advice (your outbound profile which would be external in a default config).
I would change outbound to external in order to lessen confusion: "In order to secure your FreeSWITCH it is wise to link your exgternal profile to a dialplan context other than 'default', which in the default configuration is where authenticated users are placed."
... although what is probably really meant is something like: "As mentioned, the profile used for outbound registrations allows anonymous, unauthenticated calling. By default, this profile is the external profile. In order to secure your FreeSWITCH, don't link this profile to a dialplan that allows dialing paid numbers or dialing users (who may be bothered/harrassed) without any further checking.
Summary: in a default configuration: don't link your external profile to a 'default' dialplan." ... which is a mouthful.
2. Given the above, if I want to have external users in their own network behind NAT register to me, it would be best if I define an additional profile that does require SIP authentication, right?
I can then use the external profile to register with SIP trunks etc.
participants (2)
-
curriegrad2004
-
Jim