<HTML><HEAD>
<STYLE id=eMClientCss>BLOCKQUOTE.cite {
PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
BLOCKQUOTE.cite2 {
PADDING-TOP: 0px; PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; MARGIN-TOP: 3px; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
.plain PRE {
FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal
}
.plain TT {
FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal
}
A IMG {
BORDER-TOP: 0px; BORDER-RIGHT: 0px; BORDER-BOTTOM: 0px; BORDER-LEFT: 0px
}
#x3c92e379d0084714848c4b5aee4a0532 {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
#xaa723d260ae1494eb314a0354ba018ef {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
#xe228517ccf834f03a64e0f019cd856ab {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
.plain PRE {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
.plain TT {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
BODY {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
</STYLE>
<STYLE>#xaa723d260ae1494eb314a0354ba018ef BLOCKQUOTE.cite2
{PADDING-TOP: 0px; PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; MARGIN-TOP: 3px; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px}
#xaa723d260ae1494eb314a0354ba018ef .plain PRE, #xaa723d260ae1494eb314a0354ba018ef .plain TT
{FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal}
#xaa723d260ae1494eb314a0354ba018ef A IMG
{BORDER-TOP: 0px; BORDER-RIGHT: 0px; BORDER-BOTTOM: 0px; BORDER-LEFT: 0px}
#xaa723d260ae1494eb314a0354ba018ef #x3c92e379d0084714848c4b5aee4a0532, #xaa723d260ae1494eb314a0354ba018ef .plain PRE, #xaa723d260ae1494eb314a0354ba018ef .plain TT, #xaa723d260ae1494eb314a0354ba018ef
{FONT-SIZE: 12pt; FONT-FAMILY: Tahoma}
</STYLE>
</HEAD>
<BODY scroll=auto class>
<DIV>thanks for you input, <SPAN id=xe228517ccf834f03a64e0f019cd856ab>Raúl</SPAN>. changing the default policy to DROP is good catch. It's hard to gather pieces here and there, actually there're not so many documents about spce, the handbook is brief. it'd be nice if there're detailed instructions <SPAN id=x683fcf52e2834dd9ae93a28452aa6f64>under iptables section of the handbook</SPAN>, such as what exactly policies are advised to be implemented, no more, no less, for spce to be used in production.</DIV>
<DIV> </DIV>
<DIV>my lab spce, which uses public ip, was hacked 2 days ago, so I'm picking up the task that should be done at the very beginning, a lot about iptables & spce to learn. I originally was considering to install fail2ban, but someone says fail2ban is not enough, it's better to explicitly allow necessary accesses.</DIV>
<DIV> </DIV>
<DIV>------ Original Message ------</DIV>
<DIV>From: "Raúl Alexis Betancor Santana" <<A href="mailto:rabs@dimension-virtual.com">rabs@dimension-virtual.com</A>></DIV>
<DIV>To: <A href="mailto:spce-user@lists.sipwise.com">spce-user@lists.sipwise.com</A></DIV>
<DIV>Sent: 2016-04-18 2:28:57 PM</DIV>
<DIV>Subject: Re: [Spce-user] iptables issue</DIV>
<DIV> </DIV>
<DIV id=xaa723d260ae1494eb314a0354ba018ef>
<BLOCKQUOTE class=cite2 cite=236353298.99471.1461014937324.JavaMail.zimbra@dimension-virtual.com type="cite">
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: arial, helvetica, sans-serif; COLOR: #000000">
<DIV>The proper way to setup the firewalling it's to know what you are doing.<BR></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>First, doing a -J DROP it's a non-sense ... better to change the policy of the INPUT chain.<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>iptables -P INPUT DROP<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>Second ... you MUST know what services are working on the system, so you let them go in and out and flow to the interfaces needed<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>DNS<BR data-mce-bogus="1"></DIV>
<DIV>SIP<BR data-mce-bogus="1"></DIV>
<DIV>SIPs<BR data-mce-bogus="1"></DIV>
<DIV>SIP over TCP<BR data-mce-bogus="1"></DIV>
<DIV>XMPP<BR data-mce-bogus="1"></DIV>
<DIV>RTPEngine ports<BR data-mce-bogus="1"></DIV>
<DIV>Web<BR data-mce-bogus="1"></DIV>
<DIV>WebServices<BR data-mce-bogus="1"></DIV>
<DIV>MySQL<BR data-mce-bogus="1"></DIV>
<DIV>...<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>By default, the services are setup to only reply local, so there is no need to been digging with the iptables to protect the system ... no more than a few rules when you want to HARD-DROP scammers.<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV><BR></DIV>
<DIV>
<HR id=zwchr data-marker="__DIVIDER__">
</DIV>
<DIV data-marker="__HEADERS__">
<BLOCKQUOTE style="FONT-SIZE: 12pt; TEXT-DECORATION: none; FONT-FAMILY: Helvetica,Arial,sans-serif; FONT-WEIGHT: normal; COLOR: #000; FONT-STYLE: normal; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1010ff 2px solid"><B>De: </B>"Jonathan Yue" <<A href="mailto:jonathan.yue@turboitsolutions.com">jonathan.yue@turboitsolutions.com</A>><BR><B>Para: </B><A href="mailto:spce-user@lists.sipwise.com">spce-user@lists.sipwise.com</A><BR><B>Enviados: </B>Lunes, 18 de Abril 2016 22:31:59<BR><B>Asunto: </B>[Spce-user] iptables issue<BR></BLOCKQUOTE></DIV>
<DIV data-marker="__QUOTED_TEXT__">
<BLOCKQUOTE style="FONT-SIZE: 12pt; TEXT-DECORATION: none; FONT-FAMILY: Helvetica,Arial,sans-serif; FONT-WEIGHT: normal; COLOR: #000; FONT-STYLE: normal; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1010ff 2px solid">
<DIV>Hi, all,</DIV>
<DIV> </DIV>
<DIV>I customized iptables by allowing some ip addresses in INPUT chain, and put "iptables -A INPUT -j DROP" at the bottom. Aftert that, the execution of "iptables -L" is extremely slow; more importantly phones can't register. packet captures ( i can still ssh to server) show that spce doesn't respond to sip registration. I read handbook, which mentions RTPENGINE, however it's there, untouched. </DIV>
<DIV> sudo iptables -L</DIV>
<DIV>Chain INPUT (policy ACCEPT)<BR>target prot opt source destination<BR>ACCEPT all -- 77.72.169.0/24 anywhere<BR>ACCEPT all -- 46.19.208.0/22 anywhere<BR>............ ( a few line omitted )<BR>rtpengine all -- anywhere anywhere<BR>DROP all -- anywhere anywhere<BR>LOG all -- anywhere anywhere LOG level warning</DIV>
<DIV> </DIV>
<DIV>Chain FORWARD (policy ACCEPT)<BR>target prot opt source destination</DIV>
<DIV> </DIV>
<DIV>Chain OUTPUT (policy ACCEPT)<BR>target prot opt source destination</DIV>
<DIV> </DIV>
<DIV>Chain rtpengine (1 references)<BR>target prot opt source destination<BR>RTPENGINE udp -- anywhere anywhere RTPENGINE id:0<BR></DIV>
<DIV> </DIV>
<DIV>After command <SPAN id=x3c92e379d0084714848c4b5aee4a0532>"iptables -D INPUT -j DROP", issue is gone right away. I wonder what's the proper way to configure iptables on spce?</SPAN></DIV>
<DIV><SPAN></SPAN> </DIV>
<DIV><SPAN>thanks,</SPAN></DIV>
<DIV><SPAN></SPAN> </DIV>
<DIV><SPAN>J.</SPAN></DIV><BR>_______________________________________________<BR>Spce-user mailing list<BR><A href="mailto:Spce-user@lists.sipwise.com">Spce-user@lists.sipwise.com</A><BR><A href="https://lists.sipwise.com/listinfo/spce-user">https://lists.sipwise.com/listinfo/spce-user</A><BR></BLOCKQUOTE></DIV></DIV></BLOCKQUOTE></DIV></BODY></HTML>