LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 11-13-2005, 11:02 AM   #1
metallica1973
Senior Member
 
Registered: Feb 2003
Location: Washington D.C
Posts: 2,115

Rep: Reputation: 58
IPTABLES Logging my VOIP packets?


My network is setup like this:

Cable Modem
#
#
VOIPModem(192.168.10.1)
#
#
(eth0 - 192.168.1.0)
|
|
Linux-Firewall-Router
|
|
(eth1- 192.168.2.0)
|
|
Dlink wireless router
|
|
Windows 2k wireless clients


Here is a snippet of my var/log/messages:

RoloDonPolo $tail -3 /var/log/messages|more
Nov 13 08:42:44 xx-xx-xxx-xxx kernel: fp=UDP:2 a=DROP IN=eth0 OUT= MAC=00:01:02:5f:50:06:00:90:f8:01:58:3b:08:00 SRC=192.168.1
0.1 DST=xx.xx.xxx.xxxxLEN=576 TOS=0x00 PREC=0x00 TTL=32 ID=23811 DF PROTO=UDP SPT=67 DPT=68 LEN=556
Nov 13 08:42:44 xx-xx-xxx-xxx kernel: fp=UDP:2 a=DROP IN=eth0 OUT= MAC=00:01:02:5f:50:06:00:90:f8:01:58:3b:08:00 SRC=192.168.1
0.1 DST=xx.xx.xxx.xxx LEN=576 TOS=0x00 PREC=0x00 TTL=32 ID=13574 DF PROTO=UDP SPT=67 DPT=68 LEN=556
Nov 13 08:42:54 xx-xx-xxx-xxx kernel: eth0: no IPv6 routers present

1 - why is iptables logging my VOIP traffic and could this be the reason that my voip recepetions is bad because of this logging of the packets. The VOIP company told me to put my machine in its own DMZ.

2 - I am still having trouble trying to setup in iptables my VOIP modem on it own DMZ. Can somebody please help me

Here is how I want my network setup!

Cable Modem
|
|
(eth0 - 192.168.1.0)
|
Linux-Firewall-Router-DMZ-(eth2-192.168.3.0)----(192.168.3.119-VOIPModem)
|
(eth1- 192.168.2.0)
|
|
Dlink wireless router
|
|
Windows 2k wireless clients

Last edited by metallica1973; 11-16-2005 at 04:35 PM.
 
Old 11-17-2005, 07:45 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,470
Blog Entries: 54

Rep: Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900
1. It isn't. Log entries you've shown are DHCP AFAIK. Unless you've got a combo old CPU and bad logging filters (logging too much) I wouldn't say Iptables logging would make for that much of a performance drop (and you got rate limiting on, right?). Besides that logging has no effect on how packets are filtered.
2. Ze wwules, show us ze wwules!
 
Old 11-17-2005, 10:38 PM   #3
metallica1973
Senior Member
 
Registered: Feb 2003
Location: Washington D.C
Posts: 2,115

Original Poster
Rep: Reputation: 58
Here it tis a snippett of my iptables rules for my dmz(just the important stuff) give me some feedback!



#----Special Variables-----#

# IP Mask for all IP addresses
UNIVERSE="0.0.0.0/0"

# Specification of the high unprivileged IP ports.
UNPRIVPORTS="1024:65535"

# Specification of X Window System (TCP) ports.
#XWINPORTS="6000:6063"

# Ports for IRC-Connection-Tracking
#IRCPORTS="6665,6666,6667,6668,6669,7000"

# DMZ UDP ports
#DMZUDP="1024:1030,5060:5065,10000:20000"

#-----Port-Forwarding Variables-----#

#For port-forwarding to an internal host, define a variable with the appropriate
#internal IP-Address here and take a look at the port-forwarding sections in the FORWARD +
#PREROUTING-chain:

#These are examples, uncomment to activate

#IP for forwarded Battlecom-traffic
#BATTLECOMIP="192.168.0.5"

#IP for forwarded HTTP-traffic
HTTPIP="192.168.2.1"

#IP's for DMZ to VOIP
#DMZ_NETWORK="192.168.3.0"
#DMZ_IFACE="192.168.3.1"
#DMZ_VOIP_PHONE="192.168.3.110"
43,0-1 5%
#DMZ_IFACE="192.168.3.1"
#DMZ_VOIP_PHONE="192.168.3.110"


##Public services running ON FIREWALL-BOX (comment out to activate):

# From DMZ Interface to DMZ firewall IP
# $IPTABLES -A INPUT -p ALL -i $DMZ_IFACE -d $DMZ_VOIP_PHONE -j ACCEPT



######## DMZ to VOIP PHONE SYSTEM #######

#$IPTABLES -A FORWARD -i $DMZ_IFACE -o $EXTIF -j ACCEPT
#$IPTABLES -A FORWARD -i $EXTIF -o $DMZ_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A FORWARD -i $INTIF -o $DMZ_IFACE -j ACCEPT
#$IPTABLES -A FORWARD -i $DMZ_IFACE -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT

#$IPTABLES -A FORWARD -i $DMZ_IFACE -o $EXTIF -j ACCEPT
#$IPTABLES -A FORWARD -i $EXTIF -o $DMZ_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A FORWARD -i $INTIF -o $DMZ_IFACE -j ACCEPT
#$IPTABLES -A FORWARD -i $DMZ_IFACE -o $INTIF -j ACCEPT



##Port-Forwarding from Ports < 1024 [outbound] (--> Also see chain PREROUTING)

#DMZ_VOIP_PHONE -Forwarding
# $IPTABLES -A FORWARD -p udp -i $EXTIF -o $DMZ_IFACE -d $DMZ_VOIP_PHONE --dport $UNPRIVPORTS -j ACCEPT

##Port-Forwarding [inbound] (--> Also see chain PREROUTING)

#VOIP-Forwarding
# $IPTABLES -A FORWARD -i $EXTIF -p tcp -o DMZ_IFACE -d $DMZ_VOIP_PHONE --dport $UNPRIVPORTS -j ACCEPT
# $IPTABLES -A FORWARD -i $EXTIF -p udp -o DMZ_IFACE -d $DMZ_VOIP_PHONE --dport $UNPRIVPORTS -j ACCEPT


##Catch all rule/Deny every other forwarding

$IPTABLES -A FORWARD -j LDROP




################
## PREROUTING ##
################

##Port-Forwarding (--> Also see chain FORWARD)

##HTTP
$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 80 -j REDIRECT --to-port 3128

# $IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp -d $EXTIP --dport 80 -j DNAT --to $HTTPIP

###### Enable IP Destination NAT for DMZ zone

#$IPTABLES -t nat -A PREROUTING -p UDP -i $EXTIF -d $DMZ_IFACE --dport $UNPRIVPORTS -j DNAT --to-destination $DMZ_VOIP_PHONE

#$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF -d $DMZ_IFACE --dport $UNPRIVPORTS -j DNAT --to-destination $DMZ_VOIP_PHONE
#$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF -d $DMZ_IFACE --dport $UNPRIVPORTS -j DNAT --to-destination $DMZ_VOIP_PHONE


#$IPTABLES -t nat -A PREROUTING -p TCP -i $EXTIF -d $DMZ_IFACE --dport 80 -j DNAT --to-destination $DMZ_VOIP_PHONE

Last edited by metallica1973; 11-18-2005 at 04:18 PM.
 
Old 11-20-2005, 03:38 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,470
Blog Entries: 54

Rep: Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900
OK. Some questions. Did they give you a public IP for the phone as per your other thread? Do you know which protocols this phone uses? If it uses H323, did you try h323-conntrack-nat like Fdetienn suggested?
 
Old 11-21-2005, 03:46 PM   #5
metallica1973
Senior Member
 
Registered: Feb 2003
Location: Washington D.C
Posts: 2,115

Original Poster
Rep: Reputation: 58
They did not give me a static IP they just told me to throw it behind my firewall and assign it a private IP. It is not using H323 protocol. It uses Vocoders - G.711,G.723.1,G.729.1,G729a,ab and G729 protocols. Echo Translation - G.168. They use TAS (Transparent address sharing). The name of my VOIP modem is Mediatrix 2102. IT uses SIP.

Last edited by metallica1973; 11-21-2005 at 05:03 PM.
 
Old 11-21-2005, 06:17 PM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,470
Blog Entries: 54

Rep: Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900
It's explained pretty good what a mess trying to route these protocols will be. Next to having one port (5060) as control channel and the need for a dynamic port range (10000:20000 IIRC) you will need to open up the DMZ for --state NEW traffic or else noone will be able to call you.

Anyway. If you're feeling adventurous, it's still in alpha state, there's sip-conntrack-nat, a SIP connection tracking and NAT for Netfilter. You will need both kernel source and iptables source for this to build.
 
Old 11-21-2005, 07:07 PM   #7
metallica1973
Senior Member
 
Registered: Feb 2003
Location: Washington D.C
Posts: 2,115

Original Poster
Rep: Reputation: 58
would I set this up in the same way as I would setup a web server?
 
Old 11-22-2005, 07:48 AM   #8
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,470
Blog Entries: 54

Rep: Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900Reputation: 2900
would I set this up in the same way as I would setup a web server?
AFAIK, yes, since the module is supposed to handle RTP you should only have to allow any SIP traffic on TCP+UDP/5060.
I'd recommend adding logging rules so you know if its missing something.
 
Old 11-22-2005, 05:18 PM   #9
metallica1973
Senior Member
 
Registered: Feb 2003
Location: Washington D.C
Posts: 2,115

Original Poster
Rep: Reputation: 58
Are my fiewall rules setup right? I have posted only the valid items!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VoIP Packets capturing in linux fastian Linux - Networking 1 03-25-2005 11:34 AM
why my kernel is not logging the packets ilnli Linux - General 4 01-23-2005 01:11 PM
logging incoming packets ip address b123coder Linux - Networking 1 11-18-2004 02:17 PM
Logging Packets Ampex Linux - Security 1 02-26-2004 07:02 PM
IPTABLES rules for VOIP client pembo13 Linux - Networking 4 09-24-2003 05:48 PM


All times are GMT -5. The time now is 07:58 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration