What ports are really necessary?
I'm running a simple switch. No phones are connected to the system from outside of my local network. The only wan connections I have are a couple of voip providers. None of my phones on the lan call outside of the lan. All they talk to is the switch. I see a bunch of ports listed at http://wiki.freeswitch.org/wiki/Firewall but don't know if I need them all. I suspect I don't. I want to close up the firewall as much as I can. Thanks, Jim.
SIP TCP/UDP 5060 - 5090 RTP UDP 16384 - 32768 Lloyd * <http://www.sunteltech.ca/blog/>* On Wed, Jul 24, 2013 at 8:38 PM, Jim Lynch <jim@k4gvo.com> wrote:
I'm running a simple switch. No phones are connected to the system from outside of my local network. The only wan connections I have are a couple of voip providers. None of my phones on the lan call outside of the lan. All they talk to is the switch.
I see a bunch of ports listed at http://wiki.freeswitch.org/wiki/Firewall but don't know if I need them all. I suspect I don't. I want to close up the firewall as much as I can.
Thanks, Jim.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You only need the sip ports your actually using, not all of 5060-5090 (but it wouldn't make a difference as we are not listening on them if your not using them). On Jul 25, 2013, at 12:56 PM, Lloyd Aloysius <lloyd.aloysius@sunteltech.ca> wrote:
SIP TCP/UDP 5060 - 5090 RTP UDP 16384 - 32768
Lloyd
On Wed, Jul 24, 2013 at 8:38 PM, Jim Lynch <jim@k4gvo.com> wrote: I'm running a simple switch. No phones are connected to the system from outside of my local network. The only wan connections I have are a couple of voip providers. None of my phones on the lan call outside of the lan. All they talk to is the switch.
I see a bunch of ports listed at http://wiki.freeswitch.org/wiki/Firewall but don't know if I need them all. I suspect I don't. I want to close up the firewall as much as I can.
Thanks, Jim.
On 07/25/2013 01:39 PM, Michael Jerris wrote:
You only need the sip ports your actually using, not all of 5060-5090 (but it wouldn't make a difference as we are not listening on them if your not using them).
So you're saying it's safe to keep the sip ports open. Thanks, Jim.
It doesn't add anything significant. I suppose it protects against weird icmp attacks but you'll have the same issues with all the rtp ports that you need to have open but may or may not have an open port on the other side. If you have something listening on those ports but don't want outside access to them, thats a different story. Mike On Jul 29, 2013, at 6:33 AM, Jim Lynch <jim@k4gvo.com> wrote:
On 07/25/2013 01:39 PM, Michael Jerris wrote:
You only need the sip ports your actually using, not all of 5060-5090 (but it wouldn't make a difference as we are not listening on them if your not using them).
So you're saying it's safe to keep the sip ports open.
On a stateful firewall you can also choose to only open the SIP ports. That'll depend on your SIP profile settings. 5060 at least, and perhaps 5080 too. The firewall could look at the SDP, mark the RTP ports as related traffic and automatically open them for you too. That can -only- work with normal SIP though - for obvious reasons if you're using TLS it won't be able to see the ports being used. -Steve On 25 July 2013 17:56, Lloyd Aloysius <lloyd.aloysius@sunteltech.ca> wrote:
SIP TCP/UDP 5060 - 5090 RTP UDP 16384 - 32768
Lloyd * <http://www.sunteltech.ca/blog/>*
On Wed, Jul 24, 2013 at 8:38 PM, Jim Lynch <jim@k4gvo.com> wrote:
I'm running a simple switch. No phones are connected to the system from outside of my local network. The only wan connections I have are a couple of voip providers. None of my phones on the lan call outside of the lan. All they talk to is the switch.
I see a bunch of ports listed at http://wiki.freeswitch.org/wiki/Firewall but don't know if I need them all. I suspect I don't. I want to close up the firewall as much as I can.
Thanks, Jim.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
http://wiki.freeswitch.org/wiki/Firewall On 31 July 2013 08:09, Steven Ayre <steveayre@gmail.com> wrote:
On a stateful firewall you can also choose to only open the SIP ports. That'll depend on your SIP profile settings. 5060 at least, and perhaps 5080 too.
The firewall could look at the SDP, mark the RTP ports as related traffic and automatically open them for you too.
That can -only- work with normal SIP though - for obvious reasons if you're using TLS it won't be able to see the ports being used.
-Steve
On 25 July 2013 17:56, Lloyd Aloysius <lloyd.aloysius@sunteltech.ca>wrote:
SIP TCP/UDP 5060 - 5090 RTP UDP 16384 - 32768
Lloyd * <http://www.sunteltech.ca/blog/>*
On Wed, Jul 24, 2013 at 8:38 PM, Jim Lynch <jim@k4gvo.com> wrote:
I'm running a simple switch. No phones are connected to the system from outside of my local network. The only wan connections I have are a couple of voip providers. None of my phones on the lan call outside of the lan. All they talk to is the switch.
I see a bunch of ports listed at http://wiki.freeswitch.org/wiki/Firewall but don't know if I need them all. I suspect I don't. I want to close up the firewall as much as I can.
Thanks, Jim.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Keep in mind that¹s only on firewalls that are sip aware, many are not On 7/31/13 2:09 AM, "Steven Ayre" <steveayre@gmail.com> wrote:
On a stateful firewall you can also choose to only open the SIP ports. That'll depend on your SIP profile settings. 5060 at least, and perhaps 5080 too.
The firewall could look at the SDP, mark the RTP ports as related traffic and automatically open them for you too.
That can -only- work with normal SIP though - for obvious reasons if you're using TLS it won't be able to see the ports being used.
-Steve
On 25 July 2013 17:56, Lloyd Aloysius <lloyd.aloysius@sunteltech.ca> wrote:
SIP TCP/UDP 5060 - 5090 RTP UDP 16384 - 32768
Lloyd <http://www.sunteltech.ca/blog/>
On Wed, Jul 24, 2013 at 8:38 PM, Jim Lynch <jim@k4gvo.com> wrote:
I'm running a simple switch. No phones are connected to the system from outside of my local network. The only wan connections I have are a couple of voip providers. None of my phones on the lan call outside of the lan. All they talk to is the switch.
I see a bunch of ports listed at http://wiki.freeswitch.org/wiki/Firewall but don't know if I need them all. I suspect I don't. I want to close up the firewall as much as I can.
Thanks, Jim.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
+1 On 31 July 2013 08:50, Ken Rice <krice@freeswitch.org> wrote:
Keep in mind that’s only on firewalls that are sip aware, many are not
On 7/31/13 2:09 AM, "Steven Ayre" <steveayre@gmail.com> wrote:
On a stateful firewall you can also choose to only open the SIP ports. That'll depend on your SIP profile settings. 5060 at least, and perhaps 5080 too.
The firewall could look at the SDP, mark the RTP ports as related traffic and automatically open them for you too.
That can -only- work with normal SIP though - for obvious reasons if you're using TLS it won't be able to see the ports being used.
-Steve
On 25 July 2013 17:56, Lloyd Aloysius <lloyd.aloysius@sunteltech.ca> wrote:
SIP TCP/UDP 5060 - 5090 RTP UDP 16384 - 32768
Lloyd * <http://www.sunteltech.ca/blog/> *
On Wed, Jul 24, 2013 at 8:38 PM, Jim Lynch <jim@k4gvo.com> wrote:
I'm running a simple switch. No phones are connected to the system from outside of my local network. The only wan connections I have are a couple of voip providers. None of my phones on the lan call outside of the lan. All they talk to is the switch.
I see a bunch of ports listed at http://wiki.freeswitch.org/wiki/Firewall but don't know if I need them all. I suspect I don't. I want to close up the firewall as much as I can.
Thanks, Jim.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken *http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org *irc.freenode.net #freeswitch
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
TLS, Web socket, Secure web sockets... On Jul 31, 2013, at 3:50 AM, Ken Rice <krice@freeswitch.org> wrote:
Keep in mind that’s only on firewalls that are sip aware, many are not
On 7/31/13 2:09 AM, "Steven Ayre" <steveayre@gmail.com> wrote:
On a stateful firewall you can also choose to only open the SIP ports. That'll depend on your SIP profile settings. 5060 at least, and perhaps 5080 too.
The firewall could look at the SDP, mark the RTP ports as related traffic and automatically open them for you too.
That can -only- work with normal SIP though - for obvious reasons if you're using TLS it won't be able to see the ports being used.
-Steve
On 25 July 2013 17:56, Lloyd Aloysius <lloyd.aloysius@sunteltech.ca> wrote:
SIP TCP/UDP 5060 - 5090 RTP UDP 16384 - 32768
Lloyd <http://www.sunteltech.ca/blog/>
On Wed, Jul 24, 2013 at 8:38 PM, Jim Lynch <jim@k4gvo.com> wrote:
I'm running a simple switch. No phones are connected to the system from outside of my local network. The only wan connections I have are a couple of voip providers. None of my phones on the lan call outside of the lan. All they talk to is the switch.
I see a bunch of ports listed at http://wiki.freeswitch.org/wiki/Firewall but don't know if I need them all. I suspect I don't. I want to close up the firewall as much as I can.
Thanks, Jim.
On 07/31/2013 02:50 AM, Ken Rice wrote:
On a stateful firewall you can also choose to only open the SIP ports. That'll depend on your SIP profile settings. 5060 at least, and perhaps 5080 too.
The firewall could look at the SDP, mark the RTP ports as related traffic and automatically open them for you too.
This should be possible with the shorewall package - ( still a learning curve, but you will be more likely to maintain your sanity than command line scripts. shorewall helps avoid creating a miss-configured firewall). I am a week or so away from doing this myself - when I do I will write it up. I think the place to start is here: http://www.shorewall.net/Helpers.html https://home.regit.org/netfilter-en/secure-use-of-helpers/ ,.,. I probably need to understand this as well: http://www.shorewall.net/traffic_shaping.htm http://shorewall.net/manpages/shorewall-tcrules.html There are really three firewall issues - getting the right ports open - avoiding spoofing attacks - and traffic shaping.. I would also recommend a separate box for the firewall - not a virtual machine. ( I assume someone someday will find a way to crash the firewall - and I don't want any servers coming down with it. ) -------------------------------------------------------------------------------- Karl Schmidt EMail Karl@xtronics.com Transtronics, Inc. WEB http://secure.transtronics.com 3209 West 9th Street Ph (785) 841-3089 Lawrence, KS 66049 FAX (785) 841-0434 History may not repeat itself, but it does rhyme a lot. -Mark Twain --------------------------------------------------------------------------------
participants (6)
-
Jim Lynch
-
Karl Schmidt
-
Ken Rice
-
Lloyd Aloysius
-
Michael Jerris
-
Steven Ayre