<div dir="ltr"><div>Thanks Arsen</div><div><br></div><div>My perspective is evolving and I see we can go with two alternate scenarios<br></div><div>- we can register everything to Kamailio and then let asterisk find the clients at Kamilio as well as accept clients from Kamailio. This requires some testing for us to make sure asterisk thinks of the UAs happily but we have that kind of working ok with repro but want to step up to Kamailio <br></div><div>- Alternately we can proxy through Kamailio to asterisk which is more standard and if we implement the various security checks that will help a lot. How hard is it to also add a check that the user registration passed through is in an approved list, and then to segregate that by trusted networks and external networks? I am thinking its just another check in the registration route block that looks up a db table for the source ip and the registration details.<br></div><div>- where should I put such a check? Is it one place or many? <br></div><div><br></div><div>I think we like option 2 for now. One day we can move to option 1 and just use asterisk as a media server and have kamailio be the full front end</div><div><br></div><div>Cheers Duncan<br></div><br><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jul 29, 2021 at 9:50 PM Arsen Semenov <<a href="mailto:arsperger@gmail.com" target="_blank">arsperger@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Duncan,<br><br>There are plenty of options here. <br><br>I think here is good place to start: <a href="https://www.kamailio.org/wiki/tutorials/security/kamailio-security" target="_blank">https://www.kamailio.org/wiki/tutorials/security/kamailio-security</a><br><br>You also can check <a href="https://www.apiban.org/doc.html" target="_blank">https://www.apiban.org/doc.html</a><br><br><br>Regards,<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jul 29, 2021 at 8:37 AM Duncan Turnbull <<a href="mailto:duncan@turnbull.co.nz" target="_blank">duncan@turnbull.co.nz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi Arsen</div><div><br></div><div>Thanks very much, I am looking at that now</div><div><br></div><div>Is there an easy way to control the extensions that are proxied through to asterisk so that we restrict the ability of outside scanning of extension lists. I would like to limit the registrations for extensions passed through to asterisk that come from an unknown / external ips. <br></div><div><br></div><div>Thanks again<br></div><div><br></div><div>Cheers Duncan<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 28, 2021 at 11:11 PM Arsen Semenov <<a href="mailto:arsperger@gmail.com" target="_blank">arsperger@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">You can check how Path works, it is described in rfc3327, this is probably what you need. <br>From the Asterisk side; however, I can't tell whether it is supported by pjsip, there was some issue as I know, but at least chan_sip should support it.<div>Also docs for kamailio registrar module.<br>What do you mean by "limit the user ids that go through to asterisk"?<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 28, 2021 at 12:50 PM Duncan Turnbull <<a href="mailto:duncan@turnbull.co.nz" target="_blank">duncan@turnbull.co.nz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="ltr">Hi Arsen</div><div dir="ltr"><br></div><div dir="ltr">Thanks very much for your reply</div><div dir="ltr"><br></div><div dir="ltr">We were using repro which does that but are interested in the wider capabilities of kamailio.</div><div dir="ltr"><br></div><div dir="ltr">We are wanting to limit the user ids that go through to asterisk and eventually have two kamailio servers that provide some failover</div><div dir="ltr"><br></div><div dir="ltr">I saw a slide pack from Fred Posner talking about fronting asterisk with kamailio and I probably jumped to uac without fully understanding what it’s purpose is</div><div dir="ltr"><br></div><div dir="ltr">I also saw that shared line appearance can be simulated using kamailio, and perhaps it needs the uac module to achieve that.</div><div dir="ltr"><br></div><div dir="ltr">My general understanding is new and growing so I am grateful for all advice or questions </div><div dir="ltr"><br></div><div dir="ltr">Thanks again</div><div dir="ltr"><br></div><div dir="ltr">Cheers Duncan</div><div dir="ltr"><br><blockquote type="cite">On 28/07/2021, at 3:34 PM, Arsen Semenov <<a href="mailto:arsperger@gmail.com" target="_blank">arsperger@gmail.com</a>> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">Hi Duncan,<div><br></div><div>This scenario is quite new for me, not sure I got it right.. but why have you decided not to proxying requests to asterisks? </div><div>By leveraging Path and Record-route headers Asterisk will know how to route the response back as well as new requests. </div><div>And the proxy will know how to handle them. <br>This is how kamailio is usually set as a front-end for media servers. <br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 28, 2021 at 8:35 AM Duncan Turnbull <<a href="mailto:duncan@turnbull.co.nz" target="_blank">duncan@turnbull.co.nz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi there</div><div><br></div><div>I am a new user of Kamailio and we are trying to use it to be as a front end for our asterisk pbx. We are running on Ubuntu 18.04 and Kamailio 5.3.8 with Siremis<br></div><div><br></div><div>Rather than proxying the request through to asterisk we are trying to use uacreg to send a login to asterisk. Asterisk will think all the users are appear from the proxy but thats okay. Initially this is just for external users but eventually all phones etc will register via Kamailio and we will have the trunks there (and split them across another kamailio but thats another job)<br></div><div><br></div><div>If I add a user to the uacreg then when I register to Kamailio it sends a register request but to the realm in the uacreg table and the matching port Kamailio is running on. <br></div><div><br></div><div>Is this because somewhere we have set Kamailio to directly proxy on and we need to turn that off first? <br></div><div><br></div><div>This is our uacreg table<br></div><div><br></div><div>mysql> select * from uacreg;<br>+----+--------+------------+------------+------------+-----------+-----------+---------------+---------------+----------+--------------------+---------+-------+-----------+--------+<br>| id | l_uuid | l_username | l_domain | r_username | r_domain | realm | auth_username | auth_password | auth_ha1 | auth_proxy | expires | flags | reg_delay | socket |<br>+----+--------+------------+------------+------------+-----------+-----------+---------------+---------------+----------+--------------------+---------+-------+-----------+--------+<br>| 1 | testuser | testuser | <a href="http://ourdomain.com" target="_blank">ourdomain.com</a> | 88 | 10.8.8.20 | 10.8.8.20 | 88 | password | '' | sip:<a href="http://10.8.8.20:5060" target="_blank">10.8.8.20:5060</a> | 360 | 0 | 3 | |<br>+----+--------+------------+------------+------------+-----------+-----------+---------------+---------------+----------+--------------------+---------+-------+-----------+--------+<br>1 row in set (0.00 sec)<br></div><div><br></div><div>All pointer, guides and recommendations will be welcome<br></div><div><br></div><div></div><div>Thanks very much</div><div><br></div><div>Cheers Duncan<br></div><div><div><br></div><div><br></div><div><br></div><div><br></div></div></div>
__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions<br>
* <a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
Important: keep the mailing list in the recipients, do not reply only to the sender!<br>
Edit mailing list options or unsubscribe:<br>
* <a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" rel="noreferrer" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr"><div>Arsen Semenov<br></div><div><br></div></div></div>
<span>__________________________________________________________</span><br><span>Kamailio - Users Mailing List - Non Commercial Discussions</span><br><span> * <a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a></span><br><span>Important: keep the mailing list in the recipients, do not reply only to the sender!</span><br><span>Edit mailing list options or unsubscribe:</span><br><span> * <a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a></span><br></div></blockquote></div>__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions<br>
* <a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
Important: keep the mailing list in the recipients, do not reply only to the sender!<br>
Edit mailing list options or unsubscribe:<br>
* <a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" rel="noreferrer" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr"><div>Arsen Semenov<br></div><div><br></div></div></div>
__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions<br>
* <a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
Important: keep the mailing list in the recipients, do not reply only to the sender!<br>
Edit mailing list options or unsubscribe:<br>
* <a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" rel="noreferrer" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br>
</blockquote></div>
__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions<br>
* <a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
Important: keep the mailing list in the recipients, do not reply only to the sender!<br>
Edit mailing list options or unsubscribe:<br>
* <a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" rel="noreferrer" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr"><div>Arsen Semenov<br></div><div><br></div></div></div>
__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions<br>
* <a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
Important: keep the mailing list in the recipients, do not reply only to the sender!<br>
Edit mailing list options or unsubscribe:<br>
* <a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" rel="noreferrer" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br>
</blockquote></div>