[Serusers] Firewall

List overview All Threads
Download

newer

older

[Serusers] User Based Dialplans

Re: [Serusers] jabber module

Hans Scheffers

3 May 2003 3 May '03

4:11 p.m.

Is it possible to use ser behind a astaro firewall? Or can Iimplement it on the firewall? greetz Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

Attachments:

attachment.html (text/html — 829 bytes)

Show replies by thread

Jan Janak

4 May 4 May

5:36 p.m.

Hello Hans, hard to say, send us a description of what are you trying to achieve and some description of the firewall. Jan. On 03-05 13:11, Hans Scheffers wrote:

...

Is it possible to use ser behind a astaro firewall? Or can Iimplement it on the firewall? greetz Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

Hans Scheffers

5 May 5 May

1:17 p.m.

I have an Astaro Linux Firewall. This firewall blocks everything (what I want :)), and is based on on iptables. In my network I have a sip-phone (hardware & software) that i would like to use to make phone calles using VoIP When I use my Astaro Box, the Sip protocol isn't known on the firewall. I would like to use the SER to register my phone(s) and to place calls through the internet to other VoIP users (and if possible msn users :) Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

...

-----Oorspronkelijk bericht----- Van: Jan Janak [mailto:jan@iptel.org] Verzonden: zondag 4 mei 2003 14:36 Aan: Hans Scheffers CC: serusers(a)lists.iptel.org Onderwerp: Re: [Serusers] Firewall Hello Hans, hard to say, send us a description of what are you trying to achieve and some description of the firewall. Jan. On 03-05 13:11, Hans Scheffers wrote:

Is it possible to use ser behind a astaro firewall? Or can

Iimplement it

on the firewall? greetz Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

Jan Janak

6 May 6 May

1:04 a.m.

Hello, On 05-05 10:17, Hans Scheffers wrote:

...

Getting VoIP that blocks everything is a complex topic. There are several proposals available, none of them works in all situations, though (except Rosenberg's recent ICE draft). Basically, you can install ser in your NATed network and your SIP phones will be able to register. To make calls to the public internet your either must make your phones to put public IP address of the NAT box into SDP or you will have to use a ser module called nathelper which can mangle those IP addresses at the server. You will also probably need to set up portforwarding of port 5060 on your NAT box. So, as you see, it is not easy. It depends a lot on your phones. Do they support STUN ? Can they be preconfigured to put public IP of the NAT into SDP ? What phones do you have ? Jan.

...

Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

Is it possible to use ser behind a astaro firewall? Or can

Iimplement it

on the firewall? greetz Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

_______________________________________________ Serusers mailing list serusers(a)lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers

Juha Heinanen

9:54 a.m.

Jan Janak writes:

...

> I have an Astaro Linux Firewall. This firewall blocks everything (what I > want :)), and is based on on iptables.

if it based on iptables, then the right solution is to write a sip helper application for iptables. everything else is hackery. -- juha

Jan Janak

2:18 p.m.

On 06-05 07:54, Juha Heinanen wrote:

...

Jan Janak writes:

> I have an Astaro Linux Firewall. This firewall blocks everything (what I > want :)), and is based on on iptables.

if it based on iptables, then the right solution is to write a sip helper application for iptables. everything else is hackery.

And this is very tricky, that is the reason why there is no such helper application yet. Jan.

Hans Scheffers

2:36 p.m.

But are there developers working on it? Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

...

-----Oorspronkelijk bericht----- Van: Jan Janak [mailto:jan@iptel.org] Verzonden: dinsdag 6 mei 2003 11:18 Aan: Juha Heinanen CC: Hans Scheffers; serusers(a)lists.iptel.org Onderwerp: Re: [Serusers] Firewall On 06-05 07:54, Juha Heinanen wrote:

Jan Janak writes: > > I have an Astaro Linux Firewall. This firewall blocks

everything (what I

> want :)), and is based on on iptables.

if it based on iptables, then the right solution is to write a sip helper application for iptables. everything else is hackery.

And this is very tricky, that is the reason why there is no such helper application yet. Jan.

Juha Heinanen

2:40 p.m.

Jan Janak writes:

...

And this is very tricky, that is the reason why there is no such helper application yet.

firewall is a firewall and if someone implements one, it also means that the implementer must support all protocols its users need to get through it. are you saying that implementing sip helper for iptables is more complicated than implementing sip support in firewalls like cisco pix, firewall one, nortel shasta, intertex, etc. that already have sip support. -- juha

Jan Janak

2:40 p.m.

I am not aware of any. There was an attempt to write such an application for ipchains for 2.2.x kernels, but it was only partially implemented and never ported to 2.4.x iptables. Probably the easiest solution now is to get a phone with STUN support and set up port forwarding on the NAT box. Jan. On 06-05 11:36, Hans Scheffers wrote:

...

But are there developers working on it? Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

Jan Janak writes: > > I have an Astaro Linux Firewall. This firewall blocks

everything (what I

> want :)), and is based on on iptables.

if it based on iptables, then the right solution is to write a sip helper application for iptables. everything else is hackery.

And this is very tricky, that is the reason why there is no such helper application yet. Jan.

_______________________________________________ Serusers mailing list serusers(a)lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers

Juha Heinanen

2:43 p.m.

Hans Scheffers writes:

...

But are there developers working on it?

i don't know. ask one of the iptables mailing list: http://www.iptables.org/contact.html#list -- juha

Jan Janak

3:13 p.m.

Astaro claims that SIP support is on their roadmap: http://www.astaro.org/showflat.php?Cat=&Board=UBB2&Number=23082&… On 06-05 12:40, Juha Heinanen wrote:

...

Jan Janak writes:

And this is very tricky, that is the reason why there is no such helper application yet.

are you saying that implementing sip helper for iptables is more complicated than implementing sip support in firewalls like cisco pix, firewall one, nortel shasta, intertex, etc. that already have sip support.

No, it is not more complicated. I am saying that SIP support is generally tricky. Getting signalling thought is easy, associated media streams is the hard part. Jan.

Jan Janak

3:17 p.m.

BTW, are you behind a NAT or just a firewall ? Jan. On 06-05 11:36, Hans Scheffers wrote:

...

But are there developers working on it? Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

Jan Janak writes: > > I have an Astaro Linux Firewall. This firewall blocks

everything (what I

> want :)), and is based on on iptables.

if it based on iptables, then the right solution is to write a sip helper application for iptables. everything else is hackery.

And this is very tricky, that is the reason why there is no such helper application yet. Jan.

_______________________________________________ Serusers mailing list serusers(a)lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers

Nils Ohlmeier

4:38 p.m.

On Tuesday 06 May 2003 12:13, Jan Janak wrote:

...

On 06-05 12:40, Juha Heinanen wrote:

Jan Janak writes:

And this is very tricky, that is the reason why there is no such helper application yet.

No, it is not more complicated. I am saying that SIP support is generally tricky. Getting signalling thought is easy, associated media streams is the hard part.

I do not know the internals of pix etc. So it is hard to say for which platform it is more compilcated. AFAIK their is no SIP helper yet. And maybe it sounds hard, but i believe that their will be never one free available. The modules for ipchains was just a search and replacement of port numbers and IPs. And the netfilter team rejects to accept such a uncomplete module. They want a parser for SIP and SDP before they will accpet it as official part of netfilter. The hardest part for such a module is that it is not possible to resolve host names from the kernel space. And every UA is free to use DNS names or IPs in its SIP requests. Letting media trough the packet filter and connection tracking is also not easy but should be possible. Regards Nils Ohlmeier

Hans Scheffers

5:32 p.m.

NAT, i have one public ip The problem with iptable/ipchains is the way they filter compared to Cisco a.s.o. Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl

...

-----Oorspronkelijk bericht----- Van: Jan Janak [mailto:jan@iptel.org] Verzonden: dinsdag 6 mei 2003 12:18 Aan: Hans Scheffers CC: serusers(a)lists.iptel.org Onderwerp: Re: [Serusers] Firewall BTW, are you behind a NAT or just a firewall ? Jan. On 06-05 11:36, Hans Scheffers wrote:

But are there developers working on it? Hans Scheffers JifLin B.V. Leliestraat 7 7151 GH Eibergen http://www.jiflin.nl > -----Oorspronkelijk bericht----- > Van: Jan Janak [mailto:jan@iptel.org] > Verzonden: dinsdag 6 mei 2003 11:18 > Aan: Juha Heinanen > CC: Hans Scheffers; serusers(a)lists.iptel.org > Onderwerp: Re: [Serusers] Firewall > > > On 06-05 07:54, Juha Heinanen wrote: > > Jan Janak writes: > > > > > > I have an Astaro Linux Firewall. This firewall blocks > everything (what I > > > > want :)), and is based on on iptables. > > > > if it based on iptables, then the right solution is to

write a sip

helper application for iptables. everything else is hackery.

And this is very tricky, that is the reason why there is no such helper application yet. Jan.

_______________________________________________ Serusers mailing list serusers(a)lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers

Greg Fausak

6:29 p.m.

New subject: [Serusers] Postgres on 0.8.10 stable

I had some initial problems with postgres on the 0.8.10 platform. Core dumps after running for a few days. However, I also had another problem that Jiri pointed out was fixed by a patch in ISSUES. I applied all of the patches and my core dump went away. This email to report that postgres has been up and stable for a few weeks. No growth in program size, no core dumps. I'll take another look at the CVS code later this week. I could never get the postgres module stable with the CVS stuff before. When is the official new release? If possible I definitely want the postgres module working for that! ---greg Greg Fausak August.Net Services, LLC greg(a)august.net

Jan Janak

9:36 p.m.

New subject: [Serusers] Postgres on 0.8.10 stable

Hello Greg, we have completed all major changes and will be testing the CVS code now, so it is good time to try to make postgres module stable with the current CVS version. So we will commit mostly bug fixes now and if everything goes well then the current version + bugfixes will be the new release. Let me know if you have any problems with the CVS version. Jan. On 06-05 08:29, Greg Fausak wrote:

...

7664

days inactive

7667

days old

sr-users@lists.kamailio.org

Manage subscription

15 comments

5 participants

tags (0)

participants (5)

Greg Fausak
Hans Scheffers
Jan Janak
Juha Heinanen
Nils Ohlmeier