<HTML><HEAD>
<STYLE id=eMClientCss>blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
.plain pre, .plain tt { font-family: monospace; font-size: 100%; font-weight: normal; font-style: normal;}
a img { border: 0px; }body {font-family: Tahoma;font-size: 12pt;}
.plain pre, .plain tt {font-family: Tahoma;font-size: 12pt;}
<![CDATA[BLOCKQUOTE.cite {
PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
BLOCKQUOTE.cite2 {
PADDING-TOP: 0px; PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; MARGIN-TOP: 3px; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px
}
.plain PRE {
FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal
}
.plain TT {
FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal
}
A IMG {
BORDER-TOP: 0px; BORDER-RIGHT: 0px; BORDER-BOTTOM: 0px; BORDER-LEFT: 0px
}
#x3c92e379d0084714848c4b5aee4a0532 {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
.plain PRE {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
.plain TT {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
BODY {
FONT-SIZE: 12pt; FONT-FAMILY: Tahoma
}
]]></STYLE>
<STYLE>#x80d334b291624df089839b0c6596e08e BLOCKQUOTE.cite2
{PADDING-TOP: 0px; PADDING-LEFT: 10px; MARGIN-LEFT: 5px; BORDER-LEFT: #cccccc 1px solid; MARGIN-TOP: 3px; PADDING-RIGHT: 0px; MARGIN-RIGHT: 0px}
#x80d334b291624df089839b0c6596e08e .plain PRE, #x80d334b291624df089839b0c6596e08e .plain TT
{FONT-SIZE: 100%; FONT-FAMILY: monospace; FONT-WEIGHT: normal; FONT-STYLE: normal}
#x80d334b291624df089839b0c6596e08e A IMG
{BORDER-TOP: 0px; BORDER-RIGHT: 0px; BORDER-BOTTOM: 0px; BORDER-LEFT: 0px}
#x80d334b291624df089839b0c6596e08e #x3c92e379d0084714848c4b5aee4a0532, #x80d334b291624df089839b0c6596e08e .plain PRE, #x80d334b291624df089839b0c6596e08e .plain TT, #x80d334b291624df089839b0c6596e08e
{FONT-SIZE: 12pt; FONT-FAMILY: Tahoma}
</STYLE>
</HEAD>
<BODY scroll=auto class>
<DIV>be checking iptables log, i figured this out, adding "iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT" fixes the sip issue. </DIV>
<DIV> </DIV>
<DIV>regarding the slow output of "iptables -L", adding "iptables -A INPUT -p udp --sport 53 -j ACCEPT" fixes it. apparently iptables tries to resolve the fqdn of the ip addresses in the table, so DNS should be allowed.</DIV>
<DIV> </DIV>
<DIV>------ Original Message ------</DIV>
<DIV>From: "Raúl Alexis Betancor Santana" <<A href="mailto:rabs@dimension-virtual.com">rabs@dimension-virtual.com</A>></DIV>
<DIV>To: <A href="mailto:spce-user@lists.sipwise.com">spce-user@lists.sipwise.com</A></DIV>
<DIV>Sent: 2016-04-18 2:28:57 PM</DIV>
<DIV>Subject: Re: [Spce-user] iptables issue</DIV>
<DIV> </DIV>
<DIV id=x80d334b291624df089839b0c6596e08e>
<BLOCKQUOTE class=cite2 cite=236353298.99471.1461014937324.JavaMail.zimbra@dimension-virtual.com type="cite">
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: arial, helvetica, sans-serif; COLOR: #000000">
<DIV>The proper way to setup the firewalling it's to know what you are doing.<BR></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>First, doing a -J DROP it's a non-sense ... better to change the policy of the INPUT chain.<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>iptables -P INPUT DROP<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>Second ... you MUST know what services are working on the system, so you let them go in and out and flow to the interfaces needed<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>DNS<BR data-mce-bogus="1"></DIV>
<DIV>SIP<BR data-mce-bogus="1"></DIV>
<DIV>SIPs<BR data-mce-bogus="1"></DIV>
<DIV>SIP over TCP<BR data-mce-bogus="1"></DIV>
<DIV>XMPP<BR data-mce-bogus="1"></DIV>
<DIV>RTPEngine ports<BR data-mce-bogus="1"></DIV>
<DIV>Web<BR data-mce-bogus="1"></DIV>
<DIV>WebServices<BR data-mce-bogus="1"></DIV>
<DIV>MySQL<BR data-mce-bogus="1"></DIV>
<DIV>...<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV>By default, the services are setup to only reply local, so there is no need to been digging with the iptables to protect the system ... no more than a few rules when you want to HARD-DROP scammers.<BR data-mce-bogus="1"></DIV>
<DIV><BR data-mce-bogus="1"></DIV>
<DIV><BR></DIV>
<DIV>
<HR id=zwchr data-marker="__DIVIDER__">
</DIV>
<DIV data-marker="__HEADERS__">
<BLOCKQUOTE style="FONT-SIZE: 12pt; TEXT-DECORATION: none; FONT-FAMILY: Helvetica,Arial,sans-serif; FONT-WEIGHT: normal; COLOR: #000; FONT-STYLE: normal; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1010ff 2px solid"><B>De: </B>"Jonathan Yue" <<A href="mailto:jonathan.yue@turboitsolutions.com">jonathan.yue@turboitsolutions.com</A>><BR><B>Para: </B><A href="mailto:spce-user@lists.sipwise.com">spce-user@lists.sipwise.com</A><BR><B>Enviados: </B>Lunes, 18 de Abril 2016 22:31:59<BR><B>Asunto: </B>[Spce-user] iptables issue<BR></BLOCKQUOTE></DIV>
<DIV data-marker="__QUOTED_TEXT__">
<BLOCKQUOTE style="FONT-SIZE: 12pt; TEXT-DECORATION: none; FONT-FAMILY: Helvetica,Arial,sans-serif; FONT-WEIGHT: normal; COLOR: #000; FONT-STYLE: normal; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1010ff 2px solid">
<DIV>Hi, all,</DIV>
<DIV> </DIV>
<DIV>I customized iptables by allowing some ip addresses in INPUT chain, and put "iptables -A INPUT -j DROP" at the bottom. Aftert that, the execution of "iptables -L" is extremely slow; more importantly phones can't register. packet captures ( i can still ssh to server) show that spce doesn't respond to sip registration. I read handbook, which mentions RTPENGINE, however it's there, untouched. </DIV>
<DIV> sudo iptables -L</DIV>
<DIV>Chain INPUT (policy ACCEPT)<BR>target prot opt source destination<BR>ACCEPT all -- 77.72.169.0/24 anywhere<BR>ACCEPT all -- 46.19.208.0/22 anywhere<BR>............ ( a few line omitted )<BR>rtpengine all -- anywhere anywhere<BR>DROP all -- anywhere anywhere<BR>LOG all -- anywhere anywhere LOG level warning</DIV>
<DIV> </DIV>
<DIV>Chain FORWARD (policy ACCEPT)<BR>target prot opt source destination</DIV>
<DIV> </DIV>
<DIV>Chain OUTPUT (policy ACCEPT)<BR>target prot opt source destination</DIV>
<DIV> </DIV>
<DIV>Chain rtpengine (1 references)<BR>target prot opt source destination<BR>RTPENGINE udp -- anywhere anywhere RTPENGINE id:0<BR></DIV>
<DIV> </DIV>
<DIV>After command <SPAN id=x3c92e379d0084714848c4b5aee4a0532>"iptables -D INPUT -j DROP", issue is gone right away. I wonder what's the proper way to configure iptables on spce?</SPAN></DIV>
<DIV><SPAN></SPAN> </DIV>
<DIV><SPAN>thanks,</SPAN></DIV>
<DIV><SPAN></SPAN> </DIV>
<DIV><SPAN>J.</SPAN></DIV><BR>_______________________________________________<BR>Spce-user mailing list<BR><A href="mailto:Spce-user@lists.sipwise.com">Spce-user@lists.sipwise.com</A><BR><A href="https://lists.sipwise.com/listinfo/spce-user">https://lists.sipwise.com/listinfo/spce-user</A><BR></BLOCKQUOTE></DIV></DIV></BLOCKQUOTE></DIV></BODY></HTML>