Is there a way to update mod_event_socket with a new apply-inbound-acl list without restarting freeswitch?
Hi, Suppose a freeswitch configuration has the following defined in event_socket.conf.xml: <configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> <!--<param name="stop-on-bind-error" value="true"/>--> <param name="apply-inbound-acl" value="localnet.auto"/> <list name="localnet.auto" default="allow"> <node type="allow" cidr="10.47.26.28/32"/> </list> </settings> </configuration> The above configuration will allow a remote PC with an IP address of 10.47.26.28 to issue commands to freeswitch (e.g. bgapi). Now, suppose we wanted to update the apply-inbound-acl list like this: <param name="apply-inbound-acl" value="localnet.auto"/> <list name="localnet.auto" default="allow"> <node type="allow" cidr="10.47.26.28/32"/> <node type="allow" cidr="10.47.26.44/32"/> </list> The list has been updated to allow a remote PC with an IP address of 10.47.26.44 to connect to freeswitch. The only way to get this to work is to restart freeswitch. We were wondering if there is another way that would not require a stop & start of freeswitch. The following has already been tried: - Moved the apply-inbound-acl to acl.conf.xml. Invoke the "reloadxml" and "reloadacl" commands Thanks, Steve ________________________________ NOTE: This e-mail (including any attachments) is for the sole use of the intended recipient(s) and may contain information that is confidential and/or protected by legal privilege. Any unauthorized review, use, copy, disclosure or distribution of this e-mail is strictly prohibited. If you are not the intended recipient, please notify Mitel immediately and destroy all copies of this e-mail. Mitel does not accept any liability for breach of security, error or virus that may result from the transmission of this message.
Execute "reload mod_event_socket" from console. Console will be disconnected, but FS is still ruined. Then simple reconnect to FS On Thu, Nov 19, 2015 at 11:49 PM, Steven Szeto <steven.szeto@mitel.com> wrote:
Hi,
Suppose a freeswitch configuration has the following defined in event_socket.conf.xml:
<configuration name="event_socket.conf" description="Socket Client">
<settings>
<param name="nat-map" value="false"/>
* <param name="listen-ip" value="0.0.0.0"/>*
<param name="listen-port" value="8021"/>
<param name="password" value="ClueCon"/>
<!--<param name="stop-on-bind-error" value="true"/>-->
* <param name="apply-inbound-acl" value="localnet.auto"/>*
* <list name="localnet.auto" default="allow">*
* <node type="allow" cidr="10.47.26.28/32 <http://10.47.26.28/32>"/>*
* </list>*
</settings>
</configuration>
The above configuration will allow a remote PC with an IP address of 10.47.26.28 to issue commands to freeswitch (e.g. bgapi).
Now, suppose we wanted to update the apply-inbound-acl list like this:
<param name="apply-inbound-acl" value="localnet.auto"/>
<list name="localnet.auto" default="allow">
<node type="allow" cidr="10.47.26.28/32"/>
* <node type="allow" cidr="10.47.26.44/32 <http://10.47.26.44/32>"/>*
</list>
The list has been updated to allow a remote PC with an IP address of 10.47.26.44 to connect to freeswitch.
The only way to get this to work is to restart freeswitch. We were wondering if there is another way that would not require a stop & start of freeswitch.
The following has already been tried:
- Moved the apply-inbound-acl to acl.conf.xml. Invoke the “reloadxml” and “reloadacl” commands
Thanks,
Steve
------------------------------ NOTE: This e-mail (including any attachments) is for the sole use of the intended recipient(s) and may contain information that is confidential and/or protected by legal privilege. Any unauthorized review, use, copy, disclosure or distribution of this e-mail is strictly prohibited. If you are not the intended recipient, please notify Mitel immediately and destroy all copies of this e-mail. Mitel does not accept any liability for breach of security, error or virus that may result from the transmission of this message.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
If you dont reuse the name localnet.auto and make your own list name in acl.conf it will update when you do reloadacl. The only thing the mod is storing is the name and it looks it up every time. .auto lists are generated by the core once. Never manually modify any .auto list name. On Thursday, November 19, 2015, Sergey Safarov <s.safarov@gmail.com> wrote:
Execute "reload mod_event_socket" from console. Console will be disconnected, but FS is still ruined. Then simple reconnect to FS
On Thu, Nov 19, 2015 at 11:49 PM, Steven Szeto <steven.szeto@mitel.com <javascript:_e(%7B%7D,'cvml','steven.szeto@mitel.com');>> wrote:
Hi,
Suppose a freeswitch configuration has the following defined in event_socket.conf.xml:
<configuration name="event_socket.conf" description="Socket Client">
<settings>
<param name="nat-map" value="false"/>
* <param name="listen-ip" value="0.0.0.0"/>*
<param name="listen-port" value="8021"/>
<param name="password" value="ClueCon"/>
<!--<param name="stop-on-bind-error" value="true"/>-->
* <param name="apply-inbound-acl" value="localnet.auto"/>*
* <list name="localnet.auto" default="allow">*
* <node type="allow" cidr="10.47.26.28/32 <http://10.47.26.28/32>"/>*
* </list>*
</settings>
</configuration>
The above configuration will allow a remote PC with an IP address of 10.47.26.28 to issue commands to freeswitch (e.g. bgapi).
Now, suppose we wanted to update the apply-inbound-acl list like this:
<param name="apply-inbound-acl" value="localnet.auto"/>
<list name="localnet.auto" default="allow">
<node type="allow" cidr="10.47.26.28/32 "/>
* <node type="allow" cidr="10.47.26.44/32 <http://10.47.26.44/32>"/>*
</list>
The list has been updated to allow a remote PC with an IP address of 10.47.26.44 to connect to freeswitch.
The only way to get this to work is to restart freeswitch. We were wondering if there is another way that would not require a stop & start of freeswitch.
The following has already been tried:
- Moved the apply-inbound-acl to acl.conf.xml. Invoke the “reloadxml” and “reloadacl” commands
Thanks,
Steve
------------------------------ NOTE: This e-mail (including any attachments) is for the sole use of the intended recipient(s) and may contain information that is confidential and/or protected by legal privilege. Any unauthorized review, use, copy, disclosure or distribution of this e-mail is strictly prohibited. If you are not the intended recipient, please notify Mitel immediately and destroy all copies of this e-mail. Mitel does not accept any liability for breach of security, error or virus that may result from the transmission of this message.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <javascript:_e(%7B%7D,'cvml','consulting@freeswitch.org');> http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <javascript:_e(%7B%7D,'cvml','FreeSWITCH-users@lists.freeswitch.org');> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬ ☞ http://freeswitch.org/ ☞ http://cluecon.com/ ☞ http://twitter.com/FreeSWITCH ☞ irc.freenode.net #freeswitch ☞ *http://freeswitch.org/g+ <http://freeswitch.org/g+>* ClueCon Weekly Development Call ☎ sip:888@conference.freeswitch.org ☎ +19193869900 https://www.youtube.com/watch?v=9XXgW34t40s https://www.youtube.com/watch?v=NLaDpGQuZDA
Thanks, Anthony. Your comments were very helpful. Just to close off on this thread, here are the steps we used during testing: How to make an app connect to a remote freeswitch: 1- In Event_socket.conf.xml Set the listen-ip attribute to 0.0.0.0: <param name="listen-ip" value="0.0.0.0"/> Add <param name="apply-inbound-acl" value="AllowedIP"/> 2- In acl.conf.xml add the following: <list name="AllowedIP" default="deny"> <node type="allow" cidr="xx.xx.xx.xx/32"/> (Where xx.xx.xx.xx is the ip address where the app resides) </list> From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Anthony Minessale Sent: Thursday, November 19, 2015 5:12 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] Is there a way to update mod_event_socket with a new apply-inbound-acl list without restarting freeswitch? If you dont reuse the name localnet.auto and make your own list name in acl.conf it will update when you do reloadacl. The only thing the mod is storing is the name and it looks it up every time. .auto lists are generated by the core once. Never manually modify any .auto list name. On Thursday, November 19, 2015, Sergey Safarov <s.safarov@gmail.com<mailto:s.safarov@gmail.com>> wrote: Execute "reload mod_event_socket" from console. Console will be disconnected, but FS is still ruined. Then simple reconnect to FS On Thu, Nov 19, 2015 at 11:49 PM, Steven Szeto <steven.szeto@mitel.com<javascript:_e(%7B%7D,'cvml','steven.szeto@mitel.com');>> wrote: Hi, Suppose a freeswitch configuration has the following defined in event_socket.conf.xml: <configuration name="event_socket.conf" description="Socket Client"> <settings> <param name="nat-map" value="false"/> <param name="listen-ip" value="0.0.0.0"/> <param name="listen-port" value="8021"/> <param name="password" value="ClueCon"/> <!--<param name="stop-on-bind-error" value="true"/>--> <param name="apply-inbound-acl" value="localnet.auto"/> <list name="localnet.auto" default="allow"> <node type="allow" cidr="10.47.26.28/32<http://10.47.26.28/32>"/> </list> </settings> </configuration> The above configuration will allow a remote PC with an IP address of 10.47.26.28 to issue commands to freeswitch (e.g. bgapi). Now, suppose we wanted to update the apply-inbound-acl list like this: <param name="apply-inbound-acl" value="localnet.auto"/> <list name="localnet.auto" default="allow"> <node type="allow" cidr="10.47.26.28/32<http://10.47.26.28/32>"/> <node type="allow" cidr="10.47.26.44/32<http://10.47.26.44/32>"/> </list> The list has been updated to allow a remote PC with an IP address of 10.47.26.44 to connect to freeswitch. The only way to get this to work is to restart freeswitch. We were wondering if there is another way that would not require a stop & start of freeswitch. The following has already been tried: - Moved the apply-inbound-acl to acl.conf.xml. Invoke the “reloadxml” and “reloadacl” commands Thanks, Steve ________________________________ NOTE: This e-mail (including any attachments) is for the sole use of the intended recipient(s) and may contain information that is confidential and/or protected by legal privilege. Any unauthorized review, use, copy, disclosure or distribution of this e-mail is strictly prohibited. If you are not the intended recipient, please notify Mitel immediately and destroy all copies of this e-mail. Mitel does not accept any liability for breach of security, error or virus that may result from the transmission of this message. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<javascript:_e(%7B%7D,'cvml','consulting@freeswitch.org');> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<javascript:_e(%7B%7D,'cvml','FreeSWITCH-users@lists.freeswitch.org');> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Anthony Minessale II ♬ @anthmfs ♬ @FreeSWITCH ♬ ☞ http://freeswitch.org/ ☞ http://cluecon.com/ ☞ http://twitter.com/FreeSWITCH ☞ irc.freenode.net<http://irc.freenode.net> #freeswitch ☞ http://freeswitch.org/g+ ClueCon Weekly Development Call ☎ sip:888@conference.freeswitch.org<mailto:sip%3A888@conference.freeswitch.org> ☎ +19193869900 https://www.youtube.com/watch?v=9XXgW34t40s https://www.youtube.com/watch?v=NLaDpGQuZDA
participants (3)
-
Anthony Minessale
-
Sergey Safarov
-
Steven Szeto