TELES VoIP Box BRI Series, Справочное руководство

Страница: 58 / 226

4 Configuration files
VoIPBox DSL / VoIPBox BRI – version 21.0.009 Page 58
Example 4.5
→
shows the firewall rules activated in the ip.cfg.
With these rules, outgoing traffic is allowed, incoming traffic is
only possible in the local interfaces. The following protocols
are allowed for incoming traffic: icmp (ping), DNS forwarding,
NTP, H.225, SIP, and RTP (used for VoIP), and GATE Manager.
4.1.6 PPPoE Configuration
The protocol Point-to-Point over Ethernet is used for DSL
communication. This means the system can connect directly
to the carrier network and terminate VoIP traffic directly.
Changes in this section are not needed. All necessary informa-
--dport <portnum> This policy is only true for the given protocol number. Sometimes
the definition in
/etc/protocols
will be used instead. This option
can only be used together with the -p option.
-j ACCEPT Defines the action that is carried out if the packet matches the
rule.
Table 4.4 iptable options used in Example 4.5
→
(continued)
Option Description
Example 4.5 Basic firewall settings for ppp0
[iptables]
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -d 127.0.0.1 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
; iptables -A INPUT -p tcp -i ppp0 --dport ftp -j ACCEPT
; iptables -A INPUT -p tcp -i ppp0 --dport http -j ACCEPT
; iptables -A INPUT -p tcp -i ppp0 --dport smtp -j ACCEPT
iptables -A INPUT -p udp -i ppp0 --dport 53 -j ACCEPT ; DNS forward
iptables -A INPUT -p udp -i ppp0 --dport ntp -j ACCEPT
; iptables -A INPUT -p udp -i ppp0 --dport snmp -j ACCEPT
iptables -A INPUT -p udp -i ppp0 --dport 1719 -j ACCEPT ; H.225 (UDP)
iptables -A INPUT -p tcp -i ppp0 --dport 1720 -j ACCEPT ; H.225 (TCP)
iptables -A INPUT -p tcp -i ppp0 --dport 4445 -j ACCEPT ; GATE Manager
iptables -A INPUT -p udp -i ppp0 --dport 5060 -j ACCEPT ; SIP
iptables -A INPUT -p udp -i ppp0 --dport 29000-29120 -j ACCEPT ; RTP