<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="eMClientCss">
<!--
blockquote.cite
{margin-left:5px;
margin-right:0px;
padding-left:10px;
padding-right:0px;
border-left:1px solid #cccccc}
blockquote.cite2
{margin-left:5px;
margin-right:0px;
padding-left:10px;
padding-right:0px;
border-left:1px solid #cccccc;
margin-top:3px;
padding-top:0px}
.plain pre, .plain tt
{font-family:monospace;
font-size:100%;
font-weight:normal;
font-style:normal}
a img
{border:0px}
body
{font-family:Tahoma;
font-size:12pt}
.plain pre, .plain tt
{font-family:Tahoma;
font-size:12pt}
blockquote.cite2
{padding-top:0px;
padding-left:10px;
margin-left:5px;
border-left:#cccccc 1px solid;
margin-top:3px;
padding-right:0px;
margin-right:0px}
.plain pre
{font-size:100%;
font-family:monospace;
font-weight:normal;
font-style:normal}
.plain tt
{font-size:100%;
font-family:monospace;
font-weight:normal;
font-style:normal}
a img
{border-top:0px;
border-right:0px;
border-bottom:0px;
border-left:0px}
#x3c92e379d0084714848c4b5aee4a0532
{font-size:12pt;
font-family:Tahoma}
.plain pre
{font-size:12pt;
font-family:Tahoma}
.plain tt
{font-size:12pt;
font-family:Tahoma}
body
{font-size:12pt;
font-family:Tahoma}
-->
</style><style>
<!--
#x80d334b291624df089839b0c6596e08e blockquote.cite2
{padding-top:0px;
padding-left:10px;
margin-left:5px;
border-left:#cccccc 1px solid;
margin-top:3px;
padding-right:0px;
margin-right:0px}
#x80d334b291624df089839b0c6596e08e .plain pre, #x80d334b291624df089839b0c6596e08e .plain tt
{font-size:100%;
font-family:monospace;
font-weight:normal;
font-style:normal}
#x80d334b291624df089839b0c6596e08e a img
{border-top:0px;
border-right:0px;
border-bottom:0px;
border-left:0px}
#x80d334b291624df089839b0c6596e08e #x3c92e379d0084714848c4b5aee4a0532, #x80d334b291624df089839b0c6596e08e .plain pre, #x80d334b291624df089839b0c6596e08e .plain tt, #x80d334b291624df089839b0c6596e08e
{font-size:12pt;
font-family:Tahoma}
-->
</style><style type="text/css" id="owaParaStyle"></style><style type="text/css"></style>
</head>
<body class="" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 13px;">
<div style="">Hi,</div>
<div style=""><br>
</div>
<div style="">you shouldn't need to apply any firewalling for internal communication.</div>
<div style="">Apply your firewall rules to your WANside interfaces. (see -i in iptable rules)</div>
<div style="">Allow everything out & allow established connections to get replies.</div>
<div style="">Fail2ban is a good idea.</div>
<div style=""><br>
</div>
<div style="">You can implement fail2ban for sip-registrations (But I think there's already</div>
<div style="">something like that builtin. but maybe that's pro version only, if so there is a sipwise</div>
<div style="">blog entry regarding the implementation of fail2ban with regards to sip I think)</div>
<div style="">(this is the article I was thinking of: </div>
<div style="">https://www.sipwise.org/news/technical/securing-your-ngcp-against-sip-attacks/ )</div>
<div style=""><br>
</div>
<div style="">If your server was hacked you should analyse how that happened. </div>
<div style="">There might be flaws in the services you are about to open in your firewall</div>
<div style="">or maybe your passwords are of poor choice etc. </div>
<div style=""><br>
</div>
<div style="">There is plenty of documentation regarding firewalling for linux-systems.</div>
<div style="">A starting point can be: https://help.ubuntu.com/community/IptablesHowTo</div>
<div style="">But any other current documentation works as good as this one. </div>
<div style=""><br>
</div>
<div><br>
<div style="font-family:Tahoma; font-size:13px">kind regards,<br>
<br>
Julian <br>
<div style="font-family:Tahoma; font-size:13px"></div>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF649923" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>Von:</b> Spce-user [spce-user-bounces@lists.sipwise.com]" im Auftrag von "Jonathan Yue [jonathan.yue@turboitsolutions.com]<br>
<b>Gesendet:</b> Dienstag, 19. April 2016 06:26<br>
<b>An:</b> Raśl Alexis Betancor Santana; spce-user@lists.sipwise.com<br>
<b>Betreff:</b> Re: [Spce-user] iptables issue<br>
</font><br>
</div>
<div></div>
<div>
<div>be checking iptables log, i figured this out, adding "iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT" fixes the sip issue.
</div>
<div> </div>
<div>regarding the slow output of "iptables -L", adding "iptables -A INPUT -p udp --sport 53 -j ACCEPT" fixes it. apparently iptables tries to resolve the fqdn of the ip addresses in the table, so DNS should be allowed.</div>
<div> </div>
<div>------ Original Message ------</div>
<div>From: "Raśl Alexis Betancor Santana" <<a href="mailto:rabs@dimension-virtual.com" target="_blank">rabs@dimension-virtual.com</a>></div>
<div>To: <a href="mailto:spce-user@lists.sipwise.com" target="_blank">spce-user@lists.sipwise.com</a></div>
<div>Sent: 2016-04-18 2:28:57 PM</div>
<div>Subject: Re: [Spce-user] iptables issue</div>
<div> </div>
<div id="x80d334b291624df089839b0c6596e08e">
<blockquote class="cite2" type="cite">
<div style="font-size:12pt; font-family:arial,helvetica,sans-serif; color:#000000">
<div>The proper way to setup the firewalling it's to know what you are doing.<br>
</div>
<div><br>
</div>
<div>First, doing a -J DROP it's a non-sense ... better to change the policy of the INPUT chain.<br>
</div>
<div><br>
</div>
<div>iptables -P INPUT DROP<br>
</div>
<div><br>
</div>
<div>Second ... you MUST know what services are working on the system, so you let them go in and out and flow to the interfaces needed<br>
</div>
<div><br>
</div>
<div>DNS<br>
</div>
<div>SIP<br>
</div>
<div>SIPs<br>
</div>
<div>SIP over TCP<br>
</div>
<div>XMPP<br>
</div>
<div>RTPEngine ports<br>
</div>
<div>Web<br>
</div>
<div>WebServices<br>
</div>
<div>MySQL<br>
</div>
<div>...<br>
</div>
<div><br>
</div>
<div>By default, the services are setup to only reply local, so there is no need to been digging with the iptables to protect the system ... no more than a few rules when you want to HARD-DROP scammers.<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<hr id="zwchr">
</div>
<div>
<blockquote style="font-size:12pt; text-decoration:none; font-family:Helvetica,Arial,sans-serif; font-weight:normal; color:#000; font-style:normal; padding-left:5px; margin-left:5px; border-left:#1010ff 2px solid">
<b>De: </b>"Jonathan Yue" <<a href="mailto:jonathan.yue@turboitsolutions.com" target="_blank">jonathan.yue@turboitsolutions.com</a>><br>
<b>Para: </b><a href="mailto:spce-user@lists.sipwise.com" target="_blank">spce-user@lists.sipwise.com</a><br>
<b>Enviados: </b>Lunes, 18 de Abril 2016 22:31:59<br>
<b>Asunto: </b>[Spce-user] iptables issue<br>
</blockquote>
</div>
<div>
<blockquote style="font-size:12pt; text-decoration:none; font-family:Helvetica,Arial,sans-serif; font-weight:normal; color:#000; font-style:normal; padding-left:5px; margin-left:5px; border-left:#1010ff 2px solid">
<div>Hi, all,</div>
<div> </div>
<div>I customized iptables by allowing some ip addresses in INPUT chain, and put "iptables -A INPUT -j DROP" at the bottom. Aftert that, the execution of "iptables -L" is extremely slow; more importantly phones can't register. packet captures ( i can still
ssh to server) show that spce doesn't respond to sip registration. I read handbook, which mentions RTPENGINE, however it's there, untouched.
</div>
<div> sudo iptables -L</div>
<div>Chain INPUT (policy ACCEPT)<br>
target prot opt source destination<br>
ACCEPT all -- 77.72.169.0/24 anywhere<br>
ACCEPT all -- 46.19.208.0/22 anywhere<br>
............ ( a few line omitted )<br>
rtpengine all -- anywhere anywhere<br>
DROP all -- anywhere anywhere<br>
LOG all -- anywhere anywhere LOG level warning</div>
<div> </div>
<div>Chain FORWARD (policy ACCEPT)<br>
target prot opt source destination</div>
<div> </div>
<div>Chain OUTPUT (policy ACCEPT)<br>
target prot opt source destination</div>
<div> </div>
<div>Chain rtpengine (1 references)<br>
target prot opt source destination<br>
RTPENGINE udp -- anywhere anywhere RTPENGINE id:0<br>
</div>
<div> </div>
<div>After command <span id="x3c92e379d0084714848c4b5aee4a0532">"iptables -D INPUT -j DROP", issue is gone right away. I wonder what's the proper way to configure iptables on spce?</span></div>
<div><span></span> </div>
<div><span>thanks,</span></div>
<div><span></span> </div>
<div><span>J.</span></div>
<br>
_______________________________________________<br>
Spce-user mailing list<br>
<a href="mailto:Spce-user@lists.sipwise.com" target="_blank">Spce-user@lists.sipwise.com</a><br>
<a href="https://lists.sipwise.com/listinfo/spce-user" target="_blank">https://lists.sipwise.com/listinfo/spce-user</a><br>
</blockquote>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>