TELES CellX 3G-4, Системное руководство

Страница: 46 / 64

5 Adapting the config files
Page 46 CELLX box 17.1/002
Example 5.2 shows the firewall rules activated in the ip.cfg.
With these rules, outgoing traffic is allowed, incoming traffic is only possible in the local in-
terfaces. The following protocols are allowed for incoming traffic: icmp (ping), DNS forward-
ing, NTP, H.225, SIP, and RTP (used for VoIP), and GATE Manager.
5.3 VoIP configuration
The CELLX Box supports VoIP for local and public calls. Because the circumstances are not
known, a special configuration is needed here. The configuration is divided into the following
main parts:
ƒ
configuration of the settings given by your VoIP provider (VoIP profile)
ƒ
configuration of the settings for local VoIP devices (Registrar profile)
ƒ
call routing for incoming and outgoing calls (mappings).
-s <source IP> This policy is only true for packets from the given source IP address.
This option is not used in the example but if the source is known use this op-
tion for more security.
-i <interface> This policy is only true for packages used the given IP interface. (lo – local
loop interface, eth1 – the first IP interface)
-p <protocol> This policy is only true for the given IP protocol (UDP, TCP).
--dport <portnum> This policy is only true for the given protocol number. Sometimes the defini-
tion in
/etc/protocols
will be used instead. This option can only be used
together with the -p option.
-j ACCEPT Defines the action that is carried out if the packet matches the rule.
Table 5.1 iptable options used in Example 5.2
Option Description
Example 5.2 Basic firewall settings for eth1
[iptables]
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -d 127.0.0.1 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
; iptables -A INPUT -p tcp -i eth1 --dport ftp -j ACCEPT
; iptables -A INPUT -p tcp -i eth1 --dport http -j ACCEPT
; iptables -A INPUT -p tcp -i eth1 --dport smtp -j ACCEPT
iptables -A INPUT -p udp -i eth1 --dport 53 -j ACCEPT ; DNS forward
iptables -A INPUT -p udp -i eth1 --dport ntp -j ACCEPT
; iptables -A INPUT -p udp -i eth1 --dport snmp -j ACCEPT
iptables -A INPUT -p udp -i eth1 --dport 1719 -j ACCEPT ; H.225 (UDP)
iptables -A INPUT -p tcp -i eth1 --dport 1720 -j ACCEPT ; H.225 (TCP)
iptables -A INPUT -p tcp -i eth1 --dport 4445 -j ACCEPT ; GATE Manager
iptables -A INPUT -p udp -i eth1 --dport 5060 -j ACCEPT ; SIP
iptables -A INPUT -p udp -i eth1 --dport 29000-29120 -j ACCEPT ; RTP