sme & trixbox

ello

153
+0/-0

sme & trixbox

« on: September 05, 2008, 10:57:49 AM »

Buongiorno a tutti

ho come controller di dominio sme server 7.3 configurato come server & gateway funzionante di cui sono molto soddisfatto,
ho configurato un altro PC con trixbox e collegato alla rete lato client, installato e configurato i vari telefoni IP e da numerazione interna tutto funziona correttamente, i guai nascono quando tento di aprire le porte UDP per poter effettuare telefonate VoIP.
la domanda è come faccio a forwardare le porte da lato internet a lato client?
ho provato da pannello a creare una regola di forwarding senza riuscire nell' intento tutte le porte si fermano su sme.
grazie per le eventuali
Dario

Logged

Stefano

10,894
+3/-0

Re: sme & trixbox

« Reply #1 on: September 05, 2008, 11:32:04 AM »

ciao

intendi dire che agendo sul pannello portforward inserisci le porte e gli ip ma poi, all'atto pratico, non hai i risultati?

per cortesia posta

Code: [Select]

db portforward_udp show

e

Code: [Select]

iptables -L

ciao

Stefano

Logged

ello

153
+0/-0

Re: sme & trixbox

« Reply #2 on: September 05, 2008, 12:07:31 PM »

ciao
grazie per la risp

ecco
db portforward_udp show

10000-11000=forward
DestHost=192.168.1.7
DestPort=10000-11000
5060=forward
DestHost=192.168.1.7
DestPort=5060
60938=forward
DestHost=192.168.15.5
DestPort=60938

ed ecco iptables

Chain INPUT (policy DROP)
target prot opt source destination
state_chk all -- anywhere anywhere
local_chk all -- anywhere anywhere
PPPconn all -- anywhere anywhere
denylog all -- BASE-ADDRESS.MCAST.NET/4 anywhere
denylog all -- anywhere BASE-ADDRESS.MCAST.NET/4
InboundICMP icmp -- anywhere anywhere
denylog icmp -- anywhere anywhere
InboundTCP tcp -- anywhere anywhere tcp flags:SYN,RST, ACK/SYN
denylog tcp -- anywhere anywhere tcp flags:SYN,RST,A CK/SYN
InboundUDP udp -- anywhere anywhere
denylog udp -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp spts:bootps:boo tpc
gre-in gre -- anywhere anywhere
denylog gre -- anywhere anywhere
denylog all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
state_chk all -- anywhere anywhere
local_chk all -- anywhere anywhere
ForwardedTCP tcp -- anywhere anywhere tcp flags:SYN,RS T,ACK/SYN
ForwardedUDP udp -- anywhere anywhere
denylog all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
PPPconn all -- anywhere anywhere
denylog all -- BASE-ADDRESS.MCAST.NET/4 anywhere
denylog all -- anywhere BASE-ADDRESS.MCAST.NET/4
ACCEPT all -- anywhere anywhere

Chain ForwardedTCP (1 references)
target prot opt source destination
ForwardedTCP_27486 all -- anywhere anywhere
denylog tcp -- anywhere anywhere tcp flags:SYN,RST,A CK/SYN

Chain ForwardedTCP_27486 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere 192.168.15.5 tcp dpt:35153

Chain ForwardedUDP (1 references)
target prot opt source destination
ForwardedUDP_27486 all -- anywhere anywhere
denylog udp -- anywhere anywhere

Chain ForwardedUDP_27486 (1 references)
target prot opt source destination
ACCEPT udp -- anywhere pc-00007.formic.local udp dpts:10000:11 000
ACCEPT udp -- anywhere pc-00007.formic.local udp dpt:5060
ACCEPT udp -- anywhere 192.168.15.5 udp dpt:60938

Chain InboundICMP (1 references)
target prot opt source destination
InboundICMP_27486 all -- anywhere anywhere
denylog icmp -- anywhere anywhere

Chain InboundICMP_27486 (1 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp destination-un reachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-prob lem
denylog all -- anywhere anywhere

Chain InboundTCP (1 references)
target prot opt source destination
InboundTCP_27486 all -- anywhere anywhere
denylog tcp -- anywhere anywhere tcp flags:SYN,RST,A CK/SYN

Chain InboundTCP_27486 (1 references)
target prot opt source destination
denylog all -- anywhere !192.168.15.2
REJECT tcp -- anywhere 192.168.15.2 tcp dpt:auth reject -with tcp-reset
ACCEPT tcp -- anywhere 192.168.15.2 tcp dpt:http
ACCEPT tcp -- anywhere 192.168.15.2 tcp dpt:imaps
ACCEPT tcp -- anywhere 192.168.15.2 tcp dpt:https
ACCEPT tcp -- anywhere 192.168.15.2 tcp dpt:pop3s
ACCEPT tcp -- anywhere 192.168.15.2 tcp dpt:1723
ACCEPT tcp -- anywhere 192.168.15.2 tcp dpt:smtp
ACCEPT tcp -- anywhere 192.168.15.2 tcp dpt:ssh
ACCEPT tcp -- anywhere 192.168.15.2 tcp dpt:smtps
ACCEPT tcp -- anywhere anywhere tcp dpt:smtp

Chain InboundUDP (1 references)
target prot opt source destination
InboundUDP_27486 all -- anywhere anywhere
denylog udp -- anywhere anywhere

Chain InboundUDP_27486 (1 references)
target prot opt source destination
denylog all -- anywhere !192.168.15.2

Chain PPPconn (2 references)
target prot opt source destination
PPPconn_27486 all -- anywhere anywhere

Chain PPPconn_27486 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere

Chain denylog (19 references)
target prot opt source destination
DROP udp -- anywhere anywhere udp dpt:router
DROP udp -- anywhere anywhere udp dpts:netbios-ns :netbios-ssn
DROP tcp -- anywhere anywhere tcp dpts:netbios-ns :netbios-ssn
ULOG all -- anywhere anywhere ULOG copy_range 0 n lgroup 1 prefix `denylog:' queue_threshold 1
DROP all -- anywhere anywhere

Chain gre-in (1 references)
target prot opt source destination
denylog all -- anywhere !192.168.15.2
ACCEPT all -- anywhere anywhere

Chain local_chk (2 references)
target prot opt source destination
local_chk_27486 all -- anywhere anywhere

Chain local_chk_27486 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- 192.168.1.0/24 anywhere

Chain state_chk (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTAB LISHED

ciao e grazie

Logged

Stefano

10,894
+3/-0

Re: sme & trixbox

« Reply #3 on: September 05, 2008, 12:37:02 PM »

Quote from: ello on September 05, 2008, 12:07:31 PM

10000-11000=forward
DestHost=192.168.1.7
DestPort=10000-11000

se la sintassi è corretta.. devi fare il forward delle porte 10000 E 11000 o DA 10000 A 11000?

Quote

Chain ForwardedUDP_27486 (1 references)
target prot opt source destination
ACCEPT udp -- anywhere pc-00007.formic.local udp dpts:10000:11 000
ACCEPT udp -- anywhere pc-00007.formic.local udp dpt:5060
ACCEPT udp -- anywhere 192.168.15.5 udp dpt:60938

anche questo mi pare ok.. l'unico dubbio è la spaziatura tra 11 e 000 (forse problemi di C&P?) e quanto da me espresso sopra

Ciao
Stefano

Logged

ello

153
+0/-0

Re: sme & trixbox

« Reply #4 on: September 05, 2008, 03:42:30 PM »

ciao
le porte sono da 10000 a 11000, leggendo bene le impostazioni di trixbox dovrei da 10000 a 20000 ma il mio traffico è limitato a 5 utenti e le 10000 porte sono più che sufficenti

Dario

Logged

Stefano

10,894
+3/-0

Re: sme & trixbox

« Reply #5 on: September 15, 2008, 12:39:47 PM »

ciao

da quel che vedo qui http://wiki.contribs.org/DB_Variables_Configuration#Additional_information_on_customizing_iptables la sintassi per il range di porte è con i : e non con -

HTH
Ciao

Stefano

p.s. per la prossima volta cerca prima anche nel wiki

Logged

ello

153
+0/-0

Re: sme & trixbox

« Reply #6 on: September 18, 2008, 10:55:21 PM »

ciao
avevo già controllato nel wiki e ci avevo provato ma se configuro da server manager e metto i : mi dà errore, a meno che la variabile specificata nel wiki non la devo andare ad editare, e a questo punto non so dove.
Ciao e grazie
Dario

Logged

Stefano

10,894
+3/-0

Re: sme & trixbox

« Reply #7 on: September 19, 2008, 05:01:59 PM »

Quote from: ello on September 18, 2008, 10:55:21 PM

ciao
avevo già controllato nel wiki e ci avevo provato ma se configuro da server manager e metto i : mi dà errore, a meno che la variabile specificata nel wiki non la devo andare ad editare, e a questo punto non so dove.
Ciao e grazie
Dario

se tramite server-manager ti da errore, apri un bug nel bugzilla e riporta qui il link.. è la cosa migliore che tu possa fare

dopo di che, elimini quel port-forward tramite server-manager ed inserisci quello nuovo tramite command line

Code: [Select]

db portforward_udp set miaregola forward DestHost 192.168.1.7 DestPort 10000:11000
signal-event remoteaccess-update

ergo verifichi se funziona

HTH
ciao

Stefano

p.s. mi raccomando la segnalazione in bugzilla se è confermato quel comportamento del server-manager

Logged

ello

153
+0/-0

Re: sme & trixbox

« Reply #8 on: September 19, 2008, 11:28:50 PM »

Ciao

il comportamento in server manager è confermato.

però inserendio la regola da SM con il trattino poi ottengo quest risultato

ACCEPT udp -- anywhere pc-00007.formic.local udp dpts:10000:11000

cioè i due punti li inserisce effettivamente quindi non credo che sia un bug.

ciao Dario

Logged