My network is setup like this:

Cable Modem
#
#
VOIPModem(192.168.10.1)
#
#
(eth0 - 192.168.1.0)
|
|
Linux-Firewall-Router
|
|
(eth1- 192.168.2.0)
|
|
Dlink wireless router
|
|
Windows 2k wireless clients


Here is a snippet of my var/log/messages:

RoloDonPolo $tail -3 /var/log/messages|more
Nov 13 08:42:44 xx-xx-xxx-xxx kernel: fp=UDP:2 a=DROP IN=eth0 OUT= MAC=00:01:02:5f:50:06:00:90:f8:01:58:3b:08:00 SRC=192.168.1
0.1 DST=xx.xx.xxx.xxxxLEN=576 TOS=0x00 PREC=0x00 TTL=32 ID=23811 DF PROTO=UDP SPT=67 DPT=68 LEN=556
Nov 13 08:42:44 xx-xx-xxx-xxx kernel: fp=UDP:2 a=DROP IN=eth0 OUT= MAC=00:01:02:5f:50:06:00:90:f8:01:58:3b:08:00 SRC=192.168.1
0.1 DST=xx.xx.xxx.xxx LEN=576 TOS=0x00 PREC=0x00 TTL=32 ID=13574 DF PROTO=UDP SPT=67 DPT=68 LEN=556
Nov 13 08:42:54 xx-xx-xxx-xxx kernel: eth0: no IPv6 routers present

1 - why is iptables logging my VOIP traffic and could this be the reason that my voip recepetions is bad because of this logging of the packets. The VOIP company told me to put my machine in its own DMZ.

2 - I am still having trouble trying to setup in iptables my VOIP modem on it own DMZ. Can somebody please help me

Here is how I want my network setup!

Cable Modem
|
|
(eth0 - 192.168.1.0)
|
Linux-Firewall-Router-DMZ-(eth2-192.168.3.0)----(192.168.3.119-VOIPModem)
|
(eth1- 192.168.2.0)
|
|
Dlink wireless router
|
|
Windows 2k wireless clients

1. It isn't. Log entries you've shown are DHCP AFAIK. Unless you've got a combo old CPU and bad logging filters (logging too much) I wouldn't say Iptables logging would make for that much of a performance drop (and you got rate limiting on, right?). Besides that logging has no effect on how packets are filtered.
2. Ze wwules, show us ze wwules!

Here it tis a snippett of my iptables rules for my dmz(just the important stuff) give me some feedback!



#----Special Variables-----#

# IP Mask for all IP addresses
UNIVERSE="0.0.0.0/0"

# Specification of the high unprivileged IP ports.
UNPRIVPORTS="1024:65535"

# Specification of X Window System (TCP) ports.
#XWINPORTS="6000:6063"

# Ports for IRC-Connection-Tracking
#IRCPORTS="6665,6666,6667,6668,6669,7000"

# DMZ UDP ports
#DMZUDP="1024:1030,5060:5065,10000:20000"

#-----Port-Forwarding Variables-----#

#For port-forwarding to an internal host, define a variable with the appropriate
#internal IP-Address here and take a look at the port-forwarding sections in the FORWARD +
#PREROUTING-chain:

#These are examples, uncomment to activate

#IP for forwarded Battlecom-traffic
#BATTLECOMIP="192.168.0.5"

#IP for forwarded HTTP-traffic
HTTPIP="192.168.2.1"

#IP's for DMZ to VOIP
#DMZ_NETWORK="192.168.3.0"
#DMZ_IFACE="192.168.3.1"
#DMZ_VOIP_PHONE="192.168.3.110"
43,0-1 5%
#DMZ_IFACE="192.168.3.1"
#DMZ_VOIP_PHONE="192.168.3.110"


##Public services running ON FIREWALL-BOX (comment out to activate):

# From DMZ Interface to DMZ firewall IP
# $IPTABLES -A INPUT -p ALL -i $DMZ_IFACE -d $DMZ_VOIP_PHONE -j ACCEPT



######## DMZ to VOIP PHONE SYSTEM #######

#$IPTABLES -A FORWARD -i $DMZ_IFACE -o $EXTIF -j ACCEPT
#$IPTABLES -A FORWARD -i $EXTIF -o $DMZ_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A FORWARD -i $INTIF -o $DMZ_IFACE -j ACCEPT
#$IPTABLES -A FORWARD -i $DMZ_IFACE -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT

#$IPTABLES -A FORWARD -i $DMZ_IFACE -o $EXTIF -j ACCEPT
#$IPTABLES -A FORWARD -i $EXTIF -o $DMZ_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A FORWARD -i $INTIF -o $DMZ_IFACE -j ACCEPT
#$IPTABLES -A FORWARD -i $DMZ_IFACE -o $INTIF -j ACCEPT



##Port-Forwarding from Ports < 1024 [outbound] (--> Also see chain PREROUTING)

#DMZ_VOIP_PHONE -Forwarding
# $IPTABLES -A FORWARD -p udp -i $EXTIF -o $DMZ_IFACE -d $DMZ_VOIP_PHONE --dport $UNPRIVPORTS -j ACCEPT

##Port-Forwarding [inbound] (--> Also see chain PREROUTING)

#VOIP-Forwarding
# $IPTABLES -A FORWARD -i $EXTIF -p tcp -o DMZ_IFACE -d $DMZ_VOIP_PHONE --dport $UNPRIVPORTS -j ACCEPT
# $IPTABLES -A FORWARD -i $EXTIF -p udp -o DMZ_IFACE -d $DMZ_VOIP_PHONE --dport $UNPRIVPORTS -j ACCEPT


##Catch all rule/Deny every other forwarding

$IPTABLES -A FORWARD -j LDROP




################
## PREROUTING ##
################

##Port-Forwarding (--> Also see chain FORWARD)

##HTTP
$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 80 -j REDIRECT --to-port 3128

# $IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp -d $EXTIP --dport 80 -j DNAT --to $HTTPIP

###### Enable IP Destination NAT for DMZ zone

#$IPTABLES -t nat -A PREROUTING -p UDP -i $EXTIF -d $DMZ_IFACE --dport $UNPRIVPORTS -j DNAT --to-destination $DMZ_VOIP_PHONE

#$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF -d $DMZ_IFACE --dport $UNPRIVPORTS -j DNAT --to-destination $DMZ_VOIP_PHONE
#$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF -d $DMZ_IFACE --dport $UNPRIVPORTS -j DNAT --to-destination $DMZ_VOIP_PHONE


#$IPTABLES -t nat -A PREROUTING -p TCP -i $EXTIF -d $DMZ_IFACE --dport 80 -j DNAT --to-destination $DMZ_VOIP_PHONE

OK. Some questions. Did they give you a public IP for the phone as per your other thread? Do you know which protocols this phone uses? If it uses H323, did you try h323-conntrack-nat like Fdetienn suggested?

They did not give me a static IP they just told me to throw it behind my firewall and assign it a private IP. It is not using H323 protocol. It uses Vocoders - G.711,G.723.1,G.729.1,G729a,ab and G729 protocols. Echo Translation - G.168. They use TAS (Transparent address sharing). The name of my VOIP modem is Mediatrix 2102. IT uses SIP.

It's explained pretty good what a mess trying to route these protocols will be. Next to having one port (5060) as control channel and the need for a dynamic port range (10000:20000 IIRC) you will need to open up the DMZ for --state NEW traffic or else noone will be able to call you.

Anyway. If you're feeling adventurous, it's still in alpha state, there's sip-conntrack-nat, a SIP connection tracking and NAT for Netfilter. You will need both kernel source and iptables source for this to build.

would I set this up in the same way as I would setup a web server?

would I set this up in the same way as I would setup a web server?
AFAIK, yes, since the module is supposed to handle RTP you should only have to allow any SIP traffic on TCP+UDP/5060.
I'd recommend adding logging rules so you know if its missing something.

Are my fiewall rules setup right? I have posted only the valid items!