Hey Guys, Thought the port question was asked a number of times, I couldn't find an answer to this. So please bear with me. I have a Freeswitch box that is on the Internet without any sort of NAT. I want to block as much ports as possible on this box while still allowing Freeswitch to 1) receive calls from Voip providers and 2) send calls to other VoIP providers. What port can I block and what ports do I need to let open? I know 5080 needs to be open. But can I restrict the RTP ports to, say, only 20000? Thanks so much. Max.
You can use this rule to allow media from any IP: -A INPUT -m multiport -p udp --dport 16384:32768 -j ACCEPT And this one to allow signaling: -A INPUT -s aaa.bbb.ccc.ddd -p udp --dport 5080 -j ACCEPT Where aaa.bbb.ccc.ddd is the IP address of your VoIP provider. Santiago Soares On Wed, Jan 20, 2010 at 9:23 AM, Max Bridgewater <max.bridgewater@gmail.com> wrote:
Hey Guys,
Thought the port question was asked a number of times, I couldn't find an answer to this. So please bear with me. I have a Freeswitch box that is on the Internet without any sort of NAT. I want to block as much ports as possible on this box while still allowing Freeswitch to 1) receive calls from Voip providers and 2) send calls to other VoIP providers.
What port can I block and what ports do I need to let open?
I know 5080 needs to be open. But can I restrict the RTP ports to, say, only 20000?
Thanks so much. Max.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi list, i'm a brand new freeswitch user (without previous asterisk/voip experience), after reading all wiki pages, google searchs, etc i need some help to solve a problem. configuration: Freeswitch -> Firewall (nat) -> internet -> Sip Provider In my current configuration the gateway is REGED and inbound calls (from provider to freeswitch) works ok with good audio quality. However outbound calls don't. When i call through the gateway the destination phone rings, and when is answered there is no audio. I've check with "show channels" in fs_cli and i cant see any codec in the read_codec write_codec part, they are blank. I've reviewed all sip profiles configuration, but obviously i'm missing something. I will really appreciate any comment,guidance,help,etc. (if someone is in Buenos Aires/Argentina i can also offer a free beer!) Thanks in advance. Eduardo.
Hello On Wed, Jan 20, Eduardo Casarero wrote:
Hi list, i'm a brand new freeswitch user (without previous asterisk/voip experience), after reading all wiki pages, google searchs, etc i need some help to solve a problem.
configuration:
Freeswitch -> Firewall (nat) -> internet -> Sip Provider
In my current configuration the gateway is REGED and inbound calls (from provider to freeswitch) works ok with good audio quality. However outbound calls don't. When i call through the gateway the destination phone rings, and when is answered there is no audio.
I've check with "show channels" in fs_cli and i cant see any codec in the read_codec write_codec part, they are blank. I've reviewed all sip profiles configuration, but obviously i'm missing something.
Sounds to me like your firewall is blocking outbound ports. If it's a linux machine you'll want something like -A OUTPUT -p udp --dport 16384:32768 -j ACCEPT
I will really appreciate any comment,guidance,help,etc. (if someone is in Buenos Aires/Argentina i can also offer a free beer!)
I am not but I'd sure love to try your local beer. HTH --FC
On Wed, 2010-01-20 at 12:18 -0200, Santiago Soares wrote:
You can use this rule to allow media from any IP:
-A INPUT -m multiport -p udp --dport 16384:32768 -j ACCEPT
And this one to allow signaling:
-A INPUT -s aaa.bbb.ccc.ddd -p udp --dport 5080 -j ACCEPT
No need to load multiport in that case: -A INPUT -p udp --dport 5080 -j ACCEPT -A INPUT -p udp --dport 16384:32768 -j ACCEPT Equivalent with multiport: -A INPUT -p udp -m multiport --dports 5080,16384:32768 -j ACCEPT François.
I'm going to point out that you should open up tcp on 5080 also. As we actually DO support TCP! /b On Jan 20, 2010, at 10:29 AM, François Delawarde wrote:
No need to load multiport in that case:
-A INPUT -p udp --dport 5080 -j ACCEPT -A INPUT -p udp --dport 16384:32768 -j ACCEPT
Equivalent with multiport:
-A INPUT -p udp -m multiport --dports 5080,16384:32768 -j ACCEPT
François.
participants (6)
-
Brian West
-
Eduardo Casarero
-
Frank Carmickle
-
François Delawarde
-
Max Bridgewater
-
Santiago Soares