sipXecs 4.6 manages the local iptables firewall on the server it's installed on. You can control some settings, or switch to Unmanaged mode, through the web interface (System -> Firewall).
Custom Rules with cfengine
If you want to have custom rules AND have sipxecs manage your firewall then you can use a cfengine plugin to write the custom rules. This solution survives upgrades and the sending of profiles. This works for the example below but make sure you test on a non-production system.
Edit the rules under the "insert_lines:"
Add file:
| Code Block | ||
|---|---|---|
| ||
bundle agent firewall_custom { files: "/etc/sysconfig/iptables" comment => "Allow custom firewall in $(this.promiser)", create => "false", edit_line => custom_iptables_config, classes => if_repaired("iptables_edited"); commands: iptables_edited:: "/sbin/service iptables restart" comment => "Restarting iptables to load new config"; } bundle edit_line custom_iptables_config { insert_lines: "-A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -m comment --comment 'apacheHttp' -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 443 -m state --state NEW,ESTABLISHED -m comment --comment 'apacheHttps' -j ACCEPT" location => before_the_accept_established_tcp_conns_rule; } body location before_the_accept_established_tcp_conns_rule { before_after => "before"; first_last => "first"; select_line_matching => "^-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED.*"; } |
Adding Custom Rules to the Firewall Configuration
If you install third-party software onto the sipXecs server, you may need to open up additional firewall ports that sipXecs does not know about. In this case, you will either need to tell sipXecs not to manage the firewall configuration, or create a cfengine script to add the rule you need.
Here is a hint of how the latter might be accomplished- http://list.sipfoundry.org/archive/sipx-dev/msg27891.html
Here is an example of commands you can run (as root) to add a custom rule to the running config. This will not survive if/when sipXecs decides to rewrite the firewall configuration:
# allows any traffic from a certain subnet
iptables -A INPUT -s 10.1.2.3/24 -p tcp -j ACCEPT
/etc/init.d/iptables save
Disabling the Firewall (Redhat-based systems)
If you have a dedicated SIP-aware firewall is , then you may find that to be a better choice for firewall protection so there is no need to run a then the firewall on the sipXpbx host machine.
Disabling Firewall on Redhat-based systems
To disable the firewall after the installation finished either of these commands for on Redhat systems:
...
- firewall_gateway - Opens SIP ports 5060, 5070, 5080 (and optionally their TLS versions). Not sure if all these are needed for a gateway – 5070 could maybe be moved to user & admin only.
- firewall user - All of the above + provisioning ports (ftp/tftp), 5110 (status/MWI), http, and voicemail web interface.
- firewall_admin - All of the above + ports 8443 (admin web interface) and ssh.
| Code Block |
|---|
<nowiki>
#!/bin/sh
#
# Set this to YES for open a TLS hole. Anything else to close it.
secure="YES"
#
#
# First initialize the basic rules to block all with
# /usr/bin/system-config-securitylevel-tui
# Purge the old generated rules
iptables --delete INPUT --jump voip 2> /dev/null
iptables --flush voip 2> /dev/null
iptables --delete-chain voip 2> /dev/null
# Create the new ones
iptables --new-chain voip
iptables -I INPUT 1 --jump voip
# Open admin ports
cat /root/firewall_admin | while read IP;
do
iptables -A voip --source ${IP} --protocol tcp --destination-port 8443 -j ACCEPT # Admin web interface
iptables -A voip --source ${IP} --protocol tcp --destination-port 22 -j ACCEPT
done;
# Open gateway ports
cat /root/firewall_admin /root/firewall_user /root/firewall_gateway| while read IP;
do
# Allow sip over TCP
iptables -A voip --source ${IP} --protocol tcp --destination-port 5060 -j ACCEPT # Calls
iptables -A voip --source ${IP} --protocol tcp --destination-port 5070 -j ACCEPT # Reg
iptables -A voip --source ${IP} --protocol tcp --destination-port 5080 -j ACCEPT # Auth
# Allow sip over UDP
iptables -A voip --source ${IP} --protocol udp --destination-port 5060 -j ACCEPT # Calls
iptables -A voip --source ${IP} --protocol udp --destination-port 5070 -j ACCEPT # Reg
iptables -A voip --source ${IP} --protocol udp --destination-port 5080 -j ACCEPT # Auth
if [ "$secure" == "YES" ]
then
# Allow sip TLS over TCP
iptables -A voip --source ${IP} --protocol tcp --destination-port 5061 -j ACCEPT # Calls
iptables -A voip --source ${IP} --protocol tcp --destination-port 5071 -j ACCEPT # Reg
iptables -A voip --source ${IP} --protocol tcp --destination-port 5081 -j ACCEPT # Auth
fi
done;
# Open user ports
cat /root/firewall_admin /root/firewall_user | while read IP;
do
# Allow provisioning
iptables -A voip --source ${IP} --protocol udp --destination-port tftp -j ACCEPT
iptables -A voip --source ${IP} --protocol tcp --destination-port ftp -j ACCEPT
# MWI
iptables -A voip --source ${IP} --protocol tcp --destination-port 5110 -j ACCEPT # Status/MWI
iptables -A voip --source ${IP} --protocol udp --destination-port 5110 -j ACCEPT # Status/MWI
if [ "$secure" == "YES" ]
then
iptables -A voip --source ${IP} --protocol tcp --destination-port 5111 -j ACCEPT # Status/MWI
fi
# Allow Web
iptables -A voip --source ${IP} --protocol tcp --destination-port http -j ACCEPT
iptables -A voip --source ${IP} --protocol tcp --destination-port 8091 -j ACCEPT # Voicemail web interface
done;
# Save
/sbin/service iptables save
</nowiki>
|