I would like to know how to sniff local traffic on my 192.168.2.0 network segment. I know of ethereal but how do I physically do that along with using ethereal.I am having trouble with a device on that network and I would like to know what ports in is trying to access. Thanks

I have a spare hub, a laptop with ethereal/nmap/hping and a couple of patch cables here. Because it's usually a known host that I want to monitor, I just set up the hub between the host and the switch it connects to and start testing.

Admittedly I don't do that without notifying the network admins here first...

It actually is not a computer, it is my VOIP modem that has been giving me trouble for months now.I have it all by itself. The VOIP company that supports it have given me different anwser for the ports so I wanted to see it for myself. How would I go about do that?

As long as it's using an ethernet connection, you can use the same method I do. How does the VOIP modem connect to your network?

Right now I have 2 Voip Modem (2 lines):

VOIP Modem(1st Phone)
|
|
|
|
Linux Firewall---------DMZ----HUB-----VOIP Modem(2nd Phone)
|
|
|
|
LAN

It is driving me crazy! I had posted this issue before and I believe WINSUX32 had been helping me out but I tried his suggested rules and I still cannot get it to work! I will display my frankenstein rules:

Here is my IPTABLES rules. Dont be to hard on me!

#! /bin/sh

IPTABLES="/usr/sbin/iptables"

case "$1" in
stop)
echo "Shutting down firewall..."
$IPTABLES -F
$IPTABLES -F -t mangle
$IPTABLES -F -t nat
$IPTABLES -X
$IPTABLES -X -t mangle
$IPTABLES -X -t nat

$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
echo "...done"
;;
status)
echo $"Table: filter"
iptables --list
echo $"Table: nat"
iptables -t nat --list
echo $"Table: mangle"
iptables -t mangle --list
;;
restart|reload)
$0 stop
$0 start
;;
start)
echo "Starting Firewall..."
echo ""


##--------------------------Begin Firewall---------------------------------##

#----Default-Interfaces-----#
EXTIF="eth0"
EXTIP="192.168.3.1"
INTIF="eth3"
INTLAN="192.168.3.0/25"
#EXTGW="192.168.3.1"
INTMASK="255.255.255.128"

#----Special Variables-----#

# IP Mask for all IP addresses
UNIVERSE="0.0.0.0/0"

# Specification of the high unprivileged IP ports.
UNPRIVPORTS="1024:65535"

# Specification of X Window System (TCP) ports.
#XWINPORTS="6000:6063"

# Ports for IRC-Connection-Tracking
#IRCPORTS="6665,6666,6667,6668,6669,7000"

# DMZ UDP ports
#DMZUDP="1024:1030,5060:5065,10000:20000"
####PS2 PORTS####


#-----Port-Forwarding Variables-----#

#IP for forwarded HTTP-traffic
HTTPIP="192.168.3.1"

#IP's for DMZ to VOIP
#DMZ_NETWORK="192.168.2.0"
DMZ_IFACE="eth4"
DMZ_IP="192.168.2.1"
#DMZ_DNS_IP="xx.xx.xxx.xx"
DMZ_VOIP_PHONE="192.168.2.120"

####PS2#######
#PS2_NETWORK="192.168.2.0"
#PS2_IFACE="eth4"
#PS2_IP="192.168.2.1"
#PS2="192.168.2.120"


#----Flood Variables-----#

# Overall Limit for TCP-SYN-Flood detection
TCPSYNLIMIT="5/s"
# Burst Limit for TCP-SYN-Flood detection
TCPSYNLIMITBURST="10"

# Overall Limit for Loggging in Logging-Chains
LOGLIMIT="2/s"
# Burst Limit for Logging in Logging-Chains
LOGLIMITBURST="10"

# Overall Limit for Ping-Flood-Detection
PINGLIMIT="5/s"
# Burst Limit for Ping-Flood-Detection
PINGLIMITBURST="10"


echo "Loading IPTABLES modules"

dmesg -n 1 #Kill copyright display on module load
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe ip_conntrack_sip
/sbin/modprobe ip_nat_sip
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
#/sbin/modprobe ip_conntrack_irc ports=$IRCPORTS
#/sbin/modprobe ip_nat_irc ports=$IRCPORTS
dmesg -n 6

echo " --- "


#----Clear/Reset all chains-----#

#Clear all IPTABLES-chains

#Flush everything, start from scratch
$IPTABLES -F
$IPTABLES -F -t mangle
$IPTABLES -F -t nat
$IPTABLES -X
$IPTABLES -X -t mangle
$IPTABLES -X -t nat

#Set default policies to DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

#----Set network sysctl options-----#
echo "Setting sysctl options"
#Enable forwarding in kernel
echo 1 > /proc/sys/net/ipv4/ip_forward
#Disabling IP Spoofing attacks.
echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter
#Don't respond to broadcast pings (Smurf-Amplifier-Protection)
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#Block source routing
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
#Kill timestamps
echo 0 > /proc/sys/net/ipv4/tcp_timestamps
#Enable SYN Cookies
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
#Kill redirects
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
#Enable bad error message protection
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
#Log martians (packets with impossible addresses)
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
#Set out local port range
echo "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range
#Reduce DoS'ing ability by reducing timeouts
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 2400 > /proc/sys/net/ipv4/tcp_keepalive_time
echo 0 > /proc/sys/net/ipv4/tcp_window_scaling
echo 0 > /proc/sys/net/ipv4/tcp_sack
echo " --- "

echo "Creating user-chains"

#----Create logging chains-----#

#Invalid packets (not ESTABLISHED,RELATED or NEW)
$IPTABLES -N LINVALID
$IPTABLES -A LINVALID -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=INVALID:1 a=DROP "
$IPTABLES -A LINVALID -j DROP
#TCP-Packets with one ore more bad flags
$IPTABLES -N LBADFLAG
$IPTABLES -A LBADFLAG -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=BADFLAG:1 a=DROP "
$IPTABLES -A LBADFLAG -j DROP
#Logging of connection attempts on special ports (Trojan portscans, special services, etc.)
$IPTABLES -N LSPECIALPORT
$IPTABLES -A LSPECIALPORT -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=SPECIALPORT:1 a=DROP "
$IPTABLES -A LSPECIALPORT -j DROP

#Logging of possible TCP-SYN-Floods
$IPTABLES -N LSYNFLOOD
$IPTABLES -A LSYNFLOOD -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=SYNFLOOD:1 a=DROP "
$IPTABLES -A LSYNFLOOD -j DROP

#Logging of possible Ping-Floods
$IPTABLES -N LPINGFLOOD
$IPTABLES -A LPINGFLOOD -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=PINGFLOOD:1 a=DROP "
$IPTABLES -A LPINGFLOOD -j DROP

#All other dropped packets
$IPTABLES -N LDROP
$IPTABLES -A LDROP -p tcp -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=TCP:1 a=DROP "
$IPTABLES -A LDROP -p udp -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=UDP:2 a=DROP "
$IPTABLES -A LDROP -p icmp -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=ICMP:3 a=DROP "
$IPTABLES -A LDROP -f -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=FRAGMENT:4 a=DROP "
$IPTABLES -A LDROP -j DROP

#All other rejected packets
$IPTABLES -N LREJECT
$IPTABLES -A LREJECT -p tcp -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=TCP:1 a=REJECT "
$IPTABLES -A LREJECT -p udp -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=UDP:2 a=REJECT "
$IPTABLES -A LREJECT -p icmp -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=ICMP:3 a=REJECT "
$IPTABLES -A LREJECT -f -m limit --limit $LOGLIMIT --limit-burst $LOGLIMITBURST -j LOG --log-prefix "fp=FRAGMENT:4 a=REJECT "
$IPTABLES -A LREJECT -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A LREJECT -p udp -j REJECT --reject-with icmp-port-unreachable
$IPTABLES -A LREJECT -j REJECT

#----Create Accept-Chains-----#
#TCPACCEPT - Check for SYN-Floods before letting TCP-Packets in

$IPTABLES -N TCPACCEPT
$IPTABLES -A TCPACCEPT -p tcp --syn -m limit --limit $TCPSYNLIMIT --limit-burst $TCPSYNLIMITBURST -j ACCEPT
$IPTABLES -A TCPACCEPT -p tcp --syn -j LSYNFLOOD
$IPTABLES -A TCPACCEPT -p tcp ! --syn -j ACCEPT

#----Create special User-Chains-----#

#CHECKBADFLAG - Kill any Inbound/Outbound TCP-Packets with impossible flag-combinations (Some port-scanners use these, eg. nmap Xmas,Null,etc.-scan)

$IPTABLES -N CHECKBADFLAG
$IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags ALL FIN,URG,PSH -j LBADFLAG
$IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LBADFLAG
$IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags ALL ALL -j LBADFLAG
$IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags ALL NONE -j LBADFLAG
$IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags SYN,RST SYN,RST -j LBADFLAG
$IPTABLES -A CHECKBADFLAG -p tcp --tcp-flags SYN,FIN SYN,FIN -j LBADFLAG

#Inbound/Outbound SILENTDROPS/REJECTS (Things we don't want in our Logs)

#SMB-Traffic
$IPTABLES -N SMB
$IPTABLES -A SMB -p tcp --dport 137 -j DROP
$IPTABLES -A SMB -p tcp --dport 138 -j DROP
$IPTABLES -A SMB -p tcp --dport 139 -j DROP
$IPTABLES -A SMB -p tcp --dport 445 -j DROP
$IPTABLES -A SMB -p udp --dport 137 -j DROP
$IPTABLES -A SMB -p udp --dport 138 -j DROP
$IPTABLES -A SMB -p udp --dport 139 -j DROP
$IPTABLES -A SMB -p udp --dport 445 -j DROP
$IPTABLES -A SMB -p tcp --sport 137 -j DROP
$IPTABLES -A SMB -p tcp --sport 138 -j DROP
$IPTABLES -A SMB -p tcp --sport 139 -j DROP
$IPTABLES -A SMB -p tcp --sport 445 -j DROP
$IPTABLES -A SMB -p udp --sport 137 -j DROP
$IPTABLES -A SMB -p udp --sport 138 -j DROP
$IPTABLES -A SMB -p udp --sport 139 -j DROP
$IPTABLES -A SMB -p udp --sport 445 -j DROP

#Inbound Special Ports

$IPTABLES -N SPECIALPORTS

#Deepthroat Scan
$IPTABLES -A SPECIALPORTS -p tcp --dport 6670 -j LSPECIALPORT

#Subseven Scan
$IPTABLES -A SPECIALPORTS -p tcp --dport 1243 -j LSPECIALPORT
$IPTABLES -A SPECIALPORTS -p udp --dport 1243 -j LSPECIALPORT
$IPTABLES -A SPECIALPORTS -p tcp --dport 27374 -j LSPECIALPORT
$IPTABLES -A SPECIALPORTS -p udp --dport 27374 -j LSPECIALPORT
$IPTABLES -A SPECIALPORTS -p tcp --dport 6711:6713 -j LSPECIALPORT

#Netbus Scan
$IPTABLES -A SPECIALPORTS -p tcp --dport 12345:12346 -j LSPECIALPORT
$IPTABLES -A SPECIALPORTS -p tcp --dport 20034 -j LSPECIALPORT

#Back Orifice scan
$IPTABLES -A SPECIALPORTS -p udp --dport 31337:31338 -j LSPECIALPORT

#X-Win
#$IPTABLES -A SPECIALPORTS -p tcp --dport $XWINPORTS -j LSPECIALPORT

#Hack'a'Tack 2000
$IPTABLES -A SPECIALPORTS -p udp --dport 28431 -j LSPECIALPORT

#ICMP/TRACEROUTE FILTERING

#Inbound ICMP/Traceroute

$IPTABLES -N ICMPINBOUND

#Ping Flood protection. Accept $PINGLIMIT echo-requests/sec, rest will be logged/dropped

$IPTABLES -A ICMPINBOUND -p icmp --icmp-type echo-request -m limit --limit $PINGLIMIT --limit-burst $PINGLIMITBURST -j ACCEPT

$IPTABLES -A ICMPINBOUND -p icmp --icmp-type echo-request -j LPINGFLOOD

##Block ICMP-Redirects (Should already be catched by sysctl-options, if enabled)

$IPTABLES -A ICMPINBOUND -p icmp --icmp-type redirect -j LDROP

#Block ICMP-Timestamp (Should already be catched by sysctl-options, if enabled)

$IPTABLES -A ICMPINBOUND -p icmp --icmp-type timestamp-request -j LDROP

$IPTABLES -A ICMPINBOUND -p icmp --icmp-type timestamp-reply -j LDROP

#Block ICMP-address-mask (can help to prevent OS-fingerprinting)

$IPTABLES -A ICMPINBOUND -p icmp --icmp-type address-mask-request -j LDROP

$IPTABLES -A ICMPINBOUND -p icmp --icmp-type address-mask-reply -j LDROP

#Allow all other ICMP in
$IPTABLES -A ICMPINBOUND -p icmp -j ACCEPT

#Outbound ICMP/Traceroute

$IPTABLES -N ICMPOUTBOUND

#Block ICMP-Redirects (Should already be catched by sysctl-options, if enabled)
$IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type redirect -j LDROP

#Block ICMP-TTL-Expired
#MS Traceroute (MS uses ICMP instead of UDp for tracert)
$IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type ttl-zero-during-transit -j LDROP
$IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type ttl-zero-during-reassembly -j LDROP

#Block ICMP-Parameter-Problem
$IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type parameter-problem -j LDROP

#Block ICMP-Timestamp (Should already be catched by sysctl-options, if enabled)
$IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type timestamp-request -j LDROP
$IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type timestamp-reply -j LDROP

#Block ICMP-address-mask (can help to prevent OS-fingerprinting)
$IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type address-mask-request -j LDROP
$IPTABLES -A ICMPOUTBOUND -p icmp --icmp-type address-mask-reply -j LDROP


##Accept all other ICMP going out
$IPTABLES -A ICMPOUTBOUND -p icmp -j ACCEPT

############################### PS2 Fowarding Chains #########################################

$IPTABLES -N WAN2DMZ
#$IPTABLES -N PS22WAN
$IPTABLES -N DMZ2WAN

#----End User-Chains-----#

echo " --- "

#----Start Ruleset-----#

echo "Implementing firewall rules..."

#################
## INPUT-Chain ## (everything that is addressed to the firewall itself)
#################

##GENERAL Filtering

# Kill INVALID packets (not ESTABLISHED, RELATED or NEW)
$IPTABLES -A INPUT -m state --state INVALID -j LINVALID

# Check TCP-Packets for Bad Flags
$IPTABLES -A INPUT -p tcp -j CHECKBADFLAG


##Packets FROM FIREWALL-BOX ITSELF

#Local IF
$IPTABLES -A INPUT -i lo -j ACCEPT
#
#Kill connections to the local interface from the outside world (--> Should be already catched by kernel/rp_filter)
$IPTABLES -A INPUT -d 127.0.0.0/25 -j LREJECT
$IPTABLES -A INPUT -m tcp -p tcp -s ! 127.0.0.1 --dport 3128 -j DROP
$IPTABLES -A INPUT -m tcp -p tcp -s ! 127.0.0.1 --dport 80 -j DROP

##Packets FROM INTERNAL NET

##Allow unlimited traffic from internal network using legit addresses to firewall-box
##If protection from the internal interface is needed, alter it

$IPTABLES -A INPUT -i $INTIF -s $INTLAN -j ACCEPT

#Kill anything from outside claiming to be from internal network (Address-Spoofing --> Should be already catched by rp_filter)
$IPTABLES -A INPUT -s $INTLAN -j LREJECT

##Packets FROM EXTERNAL NET

##ICMP & Traceroute filtering

#Filter ICMP
$IPTABLES -A INPUT -i $EXTIF -p ICMP -j DROP

#$IPTABLES -A INPUT -i $EXTIF -p icmp -j LDROP

#Block UDP-Traceroute
#$IPTABLES -A INPUT -p udp --dport 33434:33523 -j LDROP


##Silent Drops/Rejects (Things we don't want in our logs)

#Drop all SMB-Traffic
$IPTABLES -A INPUT -i $EXTIF -j SMB

#Silently reject Ident (Don't DROP ident, because of possible delays when establishing an outbound connection)
$IPTABLES -A INPUT -i $EXTIF -p tcp --dport 113 -j REJECT --reject-with tcp-reset


##Public services running ON FIREWALL-BOX (comment out to activate):

###########- From DMZ Interface to DMZ firewall IP########################
##################################################################

############################### ssh ###########################################

# $IPTABLES -A INPUT -i $EXTIF -p tcp --dport 513 -j TCPACCEPT

############Separate logging of special portscans/connection attempts #######################

$IPTABLES -A INPUT -i $EXTIF -j SPECIALPORTS

##Allow ESTABLISHED/RELATED connections in

$IPTABLES -A INPUT -i $EXTIF -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -p tcp --dport $UNPRIVPORTS -m state --state RELATED,ESTABLISHED -j TCPACCEPT
$IPTABLES -A INPUT -i $EXTIF -p udp --dport $UNPRIVPORTS -m state --state RELATED,ESTABLISHED -j ACCEPT

##Catch all rule
$IPTABLES -A INPUT -j LDROP

##################
## Output-Chain ## (everything that comes directly from the Firewall-Box)
##################

##Packets TO FIREWALL-BOX ITSELF

#Local IF
$IPTABLES -A OUTPUT -o lo -j ACCEPT

##Packets TO INTERNAL NET

#Allow unlimited traffic to internal network using legit addresses

$IPTABLES -A OUTPUT -o $INTIF -d $INTLAN -j ACCEPT

##ICMP & Traceroute

$IPTABLES -A OUTPUT -o $EXTIF -p icmp -j ICMPOUTBOUND

##Silent Drops/Rejects (Things we don't want in our logs)

#SMB
#$IPTABLES -A OUTPUT -o $EXTIF -j SMB

#Ident
$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 113 -j REJECT --reject-with tcp-reset

##Public services running ON FIREWALL-BOX (comment out to activate):

# ssh
#$IPTABLES -A OUTPUT -o $EXTIF -p tcp --sport 513 -m state --state ESTABLISHED -j ACCEPT

##Accept all tcp/udp traffic on unprivileged ports going out

$IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -p tcp --sport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -p udp --sport $UNPRIVPORTS -j ACCEPT

##Catch all rule

$IPTABLES -A OUTPUT -j LDROP

####################
## FORWARD-Chain ## (everything that passes the firewall)
####################


##GENERAL Filtering

#Kill invalid packets (not ESTABLISHED, RELATED or NEW)
$IPTABLES -A FORWARD -m state --state INVALID -j LINVALID

# Check TCP-Packets for Bad Flags
$IPTABLES -A FORWARD -p tcp -j CHECKBADFLAG


##Filtering FROM INTERNAL NET


##Silent Drops/Rejects (Things we don't want in our logs)

#SMB
$IPTABLES -A FORWARD -o $EXTIF -j SMB

##Port-Forwarding from Ports < 1024 [outbound] (--> Also see chain PREROUTING)

#HTTP-Forwarding
$IPTABLES -A FORWARD -o $EXTIF -s $HTTPIP -p tcp --sport 3128 -j ACCEPT

##Allow all other forwarding (from Ports > 1024) from Internal Net to External Net
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s $INTLAN -p tcp --sport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s $INTLAN -p udp --sport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -s $INTLAN -p icmp -j ACCEPT


##Filtering FROM EXTERNAL NET


##Silent Drops/Rejects (Things we don't want in our logs)

#SMB
# $IPTABLES -A FORWARD -i $EXTIF -j SMB


##Allow replies coming in
$IPTABLES -A FORWARD -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -p tcp --dport $UNPRIVPORTS -m state --state RELATED -j TCPACCEPT
$IPTABLES -A FORWARD -i $EXTIF -p udp --dport $UNPRIVPORTS -m state --state RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -p icmp -m state --state RELATED -j ACCEPT

######################################## DMZ ################################################
$IPTABLES -A FORWARD -i $EXTIF -o $DMZ_IFACE -j WAN2DMZ
$IPTABLES -A FORWARD -i $DMZ_IFACE -o $EXTIF -j DMZ2WAN
################################## VOIP or PS2 -Forwarding #########################

#################### ################## WAN to PS2 ###########################################

#$IPTABLES -A WAN2DMZ -p tcp -d $DMZ_VOIP_PHONE --dport 80 -m state --state NEW -j ACCEPT
#$IPTABLES -A WAN2DMZ -p tcp -d $DMZ_VOIP_PHONE --dport 443 -m state --state NEW -j ACCEPT
$IPTABLES -A WAN2DMZ -p udp -d $DMZ_VOIP_PHONE --dport 1024:1030 -m state --state NEW -j ACCEPT
$IPTABLES -A WAN2DMZ -p udp -d $DMZ_VOIP_PHONE --dport 5050:5065 -m state --state NEW -j ACCEPT
$IPTABLES -A WAN2DMZ -p udp -d $DMZ_VOIP_PHONE --dport 10000:20000 -m state --state NEW -j ACCEPT
#$IPTABLES -A WAN2DMZ -p tcp -d $DMZ_VOIP_PHONE --dport 26300:26399 -m state --state NEW -j ACCEPT
#$IPTABLES -A WAN2DMZ -p tcp -d $DMZ_VOIP_PHONE --dport 30000:30099 -m state --state NEW -j ACCEPT
$IPTABLES -A WAN2DMZ -j RETURN

################################### PS2 to WAN #################################################################################################### #########################################

#$IPTABLES -A DMZ2WAN -p tcp -s $DMZ_VOIP_PHONE --dport 80 -m state --state NEW -j ACCEPT
#$IPTABLES -A DMZ2WAN -p tcp -s $DMZ_VOIP_PHONE --dport 443 -m state --state NEW -j ACCEPT
$IPTABLES -A DMZ2WAN -p udp -s $DMZ_VOIP_PHONE --dport 1024:1030 -m state --state NEW -j ACCEPT
$IPTABLES -A DMZ2WAN -p udp -s $DMZ_VOIP_PHONE --dport 5050:5065 -m state --state NEW -j ACCEPT
$IPTABLES -A DMZ2WAN -p udp -s $DMZ_VOIP_PHONE --dport 10000:20000 -m state --state NEW -j ACCEPT
#$IPTABLES -I DMZ2WAN -p tcp -s $DMZ_VOIP_PHONE --dport 26300:26399 -m state --state NEW -j ACCEPT
#$IPTABLES -I DMZ2WAN -p tcp -s $DMZ_VOIP_PHONE --dport 30000:30099 -m state --state NEW -j ACCEPT
$IPTABLES -I DMZ2WAN -j RETURN


##Catch all rule/Deny every other forwarding

$IPTABLES -A FORWARD -j LDROP

################
## PREROUTING ##
################

##Port-Forwarding (--> Also see chain FORWARD)

##HTTP
$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 3128 -j REDIRECT --to-port 192.168.3.2:8080

######################################## PS2 #################################################################################################### ###########################################


#$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 80 -j DNAT --to-destination $DMZ_VOIP_PHONE
#$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 443 -j DNAT --to-destination $DMZ_VOIP_PHONE
$IPTABLES -t nat -A PREROUTING -p udp -i $EXTIF --dport 1024:1030 -j DNAT --to-destination $DMZ_VOIP_PHONE
$IPTABLES -t nat -A PREROUTING -p udp -i $EXTIF --dport 5050:5065 -j DNAT --to-destination $DMZ_VOIP_PHONE
$IPTABLES -t nat -A PREROUTING -p udp -i $EXTIF --dport 10000:20000 -j DNAT --to-destination $DMZ_VOIP_PHONE
#IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 26300:26399 -j DNAT --to-destination $DMZ_VOIP_PHONE
#IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 30000:30099 -j DNAT --to-destination $DMZ_VOIP_PHONE

###################
## POSTROUTING ##
###################

#Masquerade from Internal Net to External Net
$IPTABLES -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE

#####DMZ VOIP PHONE step 5 #######

# $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to-source 192.168.2.120


#------End Ruleset------#

echo "...done"
echo ""


echo "--> IPTABLES firewall loaded/activated <--"


##--------------------------------End Firewall---------------------------------##

;;
*)
echo "Usage: firewall (start|stop|restart|status) EXTIF INTIF"
exit 1
esac

exit 0

I'll admit I didn't read your firewall config

But given the network diagram you're showing, ethereal can be used to track the packets going from your PC to/from the VOIP modem just by selecting the correct network interface to listen on (maybe ppp0?). However, you won't be able to monitor the traffic that your VOIP modem generates and sends to the internet. At the moment I can't think of a way to do that, except for putting another device between the VOIP modem and the internet, but I'm not sure how to configure that so it works properly.

I changed my VOIP modem back to the orginal configuration.

VOIP Modem (first modem, it has telnet and other services enable that cannot be disabled)
|
|
|
VOIP Modem (second modem,It only has http access to it)
|
|
|
Linux Firewall
|
|
|
LAN

Can I somehow sniff between the modems?

If your VOIP modems are connected via ethernet, you can do what I mentioned earlier - find a hub (not a switch), a couple of connectors and a laptop running ethereal and connect it between the modems. Sniffing the traffic only requires physical access to the packets, if you can arrange that, you can monitor the traffic.

I will place a hub between the VOIP modems and plug my laptop in and begin sniffing with ethereal. It will look like this


VOIP modem (1)
|
|
HUB--------------------Laptop(using ethereal on eth0)
|
|
VOIP modem (2)
|
|
LAN

I will give it a try thanks