This page describes the network security measures that must be implemented in order to protect your VoipNow infrastructure. |
VoipNow does not manage security. While it does its best to protect on the application stack level, it cannot guess your network topology and it cannot manage firewalls.
For convenience we included a node level firewall that is designed to help you deploy a basic network firewall on the host level.
A firewall installer is available on each VoipNow node. It will automatically detect the roles running on your node roles and apply only the corresponding access rules. Furthermore, it also contains a built-in safety feature to ensure you don't lose access to your server.
You can always fully trust some networks. The installed firewall will never perform filtering for them (in/out).
Edit /etc/voipnow/local.conf
and uncomment the TRUSTED_NET variable, replacing its value with your local network IP and netmask:
# Access from these networks is always allowed (eg: TRUSTED_NET 10.10.34.12/32 10.10.33.1/24) # TRUSTED_NET NETWORK/MASK |
# Access from these networks is always allowed (eg: TRUSTED_NET 10.10.34.12/32 10.10.33.1/24) TRUSTED_NET 172.16.100.1/24 |
Execute the following command:
/usr/local/voipnow/admin/sbin/voipnow_firewall Starting VoipNow firewall configuration... Your existing firewall has been saved in /tmp/iptables. 20650 If everything is correct, please remove the cron job by running: /root/core/shell/voipnow_firewall ok |
/tmp/iptables.20650
in the above example)You can see this safety net as a line in crontab:
*/10 * * * * /sbin/iptables -P INPUT ACCEPT; /sbin/iptables -P FORWARD ACCEPT;/sbin/iptables -P OUTPUT ACCEPT;/sbin/iptables -F;/sbin/iptables -X |
Assumiing that everything is ok, run the firewall script again with the ok
parameter (this will remove the cron job and leave your newly generated firewall rules in place):
[root@localhost ~]# /usr/local/voipnow/admin/sbin/voipnow_firewall ok Script called with ok option - removing safety net |
The private network must be isolated. Only VoipNow nodes must be able to access it - it should not be shared with any other system. Furthermore, generic host level network firewalls must be configured to allow connection only on the ports that are opened on each role.
The public network must be protected with firewalls. Connections must be allowed only on the ports configured to be accessed by customers' devices.
The sections below offer several recommendations on how to set up firewalls based on the role of the node.
Requires public network access, as well as private network access for management and database traffic. Traffic is encrypted; both private and public networks are required. Supports authentication and authorization methods. Could be protected with an application level firewall.
Requires public network access, as well as private network access for management and database traffic. Traffic can be encrypted with TLS as long as involved parties support this protocol otherwise its not encrypted; both private and public networks are required. Supports authentication and authorization methods. Could be protected with an application level firewall.
Requires public network access, as well as private network access for management and database traffic. Traffic can be encrypted (SRTP) as long as involved parties support the protocol otherwise traffic not encrypted; both private and public networks are required. Supports authentication and authorization methods.
Requires public network access, as well private network access for management and database traffic. It is a good idea to implement on this service rate limitations based on source IP. Application layer firewall is available for XMPP protocol from independent vendors.
Requires private network access. Traffic is encrypted.
Task scheduler that does not listen on any port but requires private network access to connect to other roles.
Requires private network access only. Traffic is not encrypted; connection is authenticated. It is not important to secure the traffic, but for superior protection it is a good idea to allow traffic only from the relevant roles (even in the private network).
Traffic must be kept in the private network. Traffic is not encrypted; connection is made using authentication.
Traffic must be kept in the private network. Traffic is not encrypted; connection is authenticated, but some basic operations to the database are possible without credentials.
Traffic must be kept in the private network. Traffic is not encrypted; connection is authenticated.
Traffic is on the public network and is encrypted, connection is authenticated.