Hi, On Tuesday 06 January 2004 15:01, listas iPfone wrote: AFAIK not, because there is not much to document: SIP uses by default port 5060 and UDP and TCP as transport protocol. iptables -A WHATEVER_IS_YOUR_CHAIN -p tcp --dport 5060 -j ACCEPT iptables -A WHATEVER_IS_YOUR_CHAIN -p udp --dport 5060 -j ACCEPT Naturally you can add '--sport 5060' if you want to force only SIP-to-SIP communication. Note: all SIP compliant devices should support other ports then 5060, so there is no way to guarantee that the SIP devices behind your packet filter do not use e.g. port 80 for their communication. And as there is yet no SIP conntrack helper module, there is currently no way to let pass the media of the phone calls in a 'secure' way. Greets Nils