Simple Access Rules

This page details the basic access rules.

Iptables

VoipNow is installed on top of a Linux distribution with iptables installed by default.

With the help of these iptables, you can write your own set of firewall rules that allow only known subnets to access your server. Before anything else, you must ensure that iptables services are set to start at boot.

chkconfig iptables on

Verify default rules

To verify the default set of rules, use the following command:

#> iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

The default policy is set to ACCEPT.

The INPUT chain is used for filtering incoming connections, the OUTPUT for filtering outgoing traffic for server toward any destination. FORWARD stores the rules that filter the connection to other servers protected by the firewall; this chain is mainly used in case of a router and not for a stand alone server.

Ensure proper communication

To ensure a proper communication between your server and the registered phones or providers, you need to open some ports (5050, 5060, 5061 on TCP and UDP).

There are ports that should not be filtered, such as:

Some ports can be filtered to allow connection only from particular locations. For example, we can control SSH access towards our server and the access to the web interface.

Assuming we want to drop all connections coming towards our server on ports 443 and 80:

iptables -I INPUT -d <VoipNow server IP address> -p tcp --match multiport --dport 443,80 -j DROP

iptables -I INPUT -s <IP address of the client> -p tcp --match multiport --dport 443,80 -j ACCEPT

iptables -I INPUT -s <IP address of the client> -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -d <IP address of the VoipNow box> -p tcp --dport 22 -j DROP

iptables -I INPUT -s <subnet of the clinet>/<netmask of the 
client subnet> -p tcp --match multiport --dport 443,80 -j ACCEPT

To reapply the rule at server restart, save them using the following command:

/etc/init.d/iptables save