Menu
▾
▴
astlinux-users — AstLinux Users Mailing List
You can subscribe to this list here.
| 2006 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(1) |
Jul
(1) |
Aug
|
Sep
|
Oct
(2) |
Nov
(1) |
Dec
(20) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2007 |
Jan
(91) |
Feb
(111) |
Mar
(226) |
Apr
(65) |
May
(197) |
Jun
(202) |
Jul
(92) |
Aug
(87) |
Sep
(120) |
Oct
(133) |
Nov
(89) |
Dec
(155) |
| 2008 |
Jan
(251) |
Feb
(136) |
Mar
(174) |
Apr
(149) |
May
(56) |
Jun
(32) |
Jul
(36) |
Aug
(171) |
Sep
(245) |
Oct
(244) |
Nov
(218) |
Dec
(272) |
| 2009 |
Jan
(113) |
Feb
(119) |
Mar
(192) |
Apr
(117) |
May
(93) |
Jun
(46) |
Jul
(80) |
Aug
(54) |
Sep
(109) |
Oct
(70) |
Nov
(145) |
Dec
(110) |
| 2010 |
Jan
(137) |
Feb
(87) |
Mar
(45) |
Apr
(157) |
May
(58) |
Jun
(99) |
Jul
(188) |
Aug
(136) |
Sep
(101) |
Oct
(100) |
Nov
(61) |
Dec
(60) |
| 2011 |
Jan
(84) |
Feb
(43) |
Mar
(70) |
Apr
(17) |
May
(69) |
Jun
(28) |
Jul
(43) |
Aug
(21) |
Sep
(151) |
Oct
(120) |
Nov
(84) |
Dec
(101) |
| 2012 |
Jan
(119) |
Feb
(82) |
Mar
(70) |
Apr
(115) |
May
(66) |
Jun
(131) |
Jul
(70) |
Aug
(65) |
Sep
(66) |
Oct
(86) |
Nov
(197) |
Dec
(81) |
| 2013 |
Jan
(65) |
Feb
(48) |
Mar
(32) |
Apr
(68) |
May
(98) |
Jun
(59) |
Jul
(41) |
Aug
(52) |
Sep
(42) |
Oct
(37) |
Nov
(10) |
Dec
(27) |
| 2014 |
Jan
(61) |
Feb
(34) |
Mar
(30) |
Apr
(52) |
May
(45) |
Jun
(40) |
Jul
(28) |
Aug
(9) |
Sep
(39) |
Oct
(69) |
Nov
(55) |
Dec
(19) |
| 2015 |
Jan
(13) |
Feb
(21) |
Mar
(5) |
Apr
(14) |
May
(30) |
Jun
(51) |
Jul
(31) |
Aug
(12) |
Sep
(29) |
Oct
(15) |
Nov
(24) |
Dec
(16) |
| 2016 |
Jan
(62) |
Feb
(76) |
Mar
(30) |
Apr
(43) |
May
(46) |
Jun
(62) |
Jul
(21) |
Aug
(49) |
Sep
(67) |
Oct
(27) |
Nov
(26) |
Dec
(38) |
| 2017 |
Jan
(7) |
Feb
(12) |
Mar
(69) |
Apr
(59) |
May
(54) |
Jun
(40) |
Jul
(76) |
Aug
(82) |
Sep
(92) |
Oct
(51) |
Nov
(32) |
Dec
(30) |
| 2018 |
Jan
(22) |
Feb
(25) |
Mar
(34) |
Apr
(35) |
May
(37) |
Jun
(21) |
Jul
(69) |
Aug
(55) |
Sep
(17) |
Oct
(67) |
Nov
(9) |
Dec
(5) |
| 2019 |
Jan
(19) |
Feb
(12) |
Mar
(15) |
Apr
(19) |
May
|
Jun
(27) |
Jul
(27) |
Aug
(25) |
Sep
(25) |
Oct
(27) |
Nov
(10) |
Dec
(14) |
| 2020 |
Jan
(22) |
Feb
(20) |
Mar
(36) |
Apr
(40) |
May
(52) |
Jun
(35) |
Jul
(21) |
Aug
(32) |
Sep
(71) |
Oct
(27) |
Nov
(11) |
Dec
(16) |
| 2021 |
Jan
(16) |
Feb
(21) |
Mar
(21) |
Apr
(27) |
May
(17) |
Jun
|
Jul
(2) |
Aug
(22) |
Sep
(23) |
Oct
(7) |
Nov
(11) |
Dec
(28) |
| 2022 |
Jan
(23) |
Feb
(18) |
Mar
(9) |
Apr
(15) |
May
(15) |
Jun
(7) |
Jul
(8) |
Aug
(15) |
Sep
(1) |
Oct
|
Nov
(11) |
Dec
(10) |
| 2023 |
Jan
(14) |
Feb
(10) |
Mar
(11) |
Apr
(13) |
May
(2) |
Jun
(30) |
Jul
(1) |
Aug
(15) |
Sep
(13) |
Oct
(3) |
Nov
(25) |
Dec
(5) |
| 2024 |
Jan
(3) |
Feb
(10) |
Mar
(9) |
Apr
|
May
(1) |
Jun
(15) |
Jul
(7) |
Aug
(10) |
Sep
(3) |
Oct
(8) |
Nov
(6) |
Dec
(15) |
| 2025 |
Jan
(3) |
Feb
(1) |
Mar
(7) |
Apr
(5) |
May
(13) |
Jun
(16) |
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Lonnie A. <li...@lo...> - 2023-03-09 01:29:05
|
Announcing AstLinux Release: 1.5.0 More Info: AstLinux Project https://www.astlinux-project.org/ New 1.5.x series based on Linux Kernel 5.10: * Toolchain: glibc 2.31, binutils 2.35.1, gcc 9.4.0, using crosstool-ng-1.25.0 * Filesystem: use ext4 driver instead of ext2. Enable feature 'extra_isize' for new installs, without journal * Network Drivers: wireguard, igb, igc and e1000e drivers are now native with the 5.10 kernel * DAHDI: dahdi-linux 3.2.0 and dahdi-tools 3.2.0 AstLinux 1.5.0 Highlights: * Asterisk Versions: 13.38.3, 16.30.0, 18.16.0 * Linux Kernel 5.10.162, security and bug fixes * RUNNIX, version bump to runnix-0.6.14 * OpenSSL, version bump to 1.1.1t, security fixes: CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, CVE-2022-4304 * LibreTLS, version bump to 3.7.0 * libcurl (curl) version bump to 7.88.1, security fixes: CVE-2022-43551, CVE-2022-43552, CVE-2023-23914, CVE-2023-23915, CVE-2023-23916 * pjsip version 2.12.1, backport security fixes: CVE-2022-23537, CVE-2022-23547 * e2fsprogs, version bump to 1.46.6 * htop, version bump to 3.2.2 * libpcap, version bump to 1.10.3 * libsrtp, version bump to 2.5.0 * Monit, version bump to 5.33.0 * set-kcmd-cstate, new command to manage whether 'processor.max_cstate=1' is passed to the kernel or not (default) * sqlite, version bump to 3.40.1 * stunnel, version bump to 5.68 * sudo, version 1.8.32, add security fix: CVE-2023-22809 * tiff, version bump to 4.5.0, security fixes: many, add patch for CVE-2022-48281 * tcpdump, version 4.99.3 * unbound, version bump to 1.17.1 * Asterisk '13se' (stable edition) version 13.38.3 is the last Asterisk 13.x "Legacy" version, built --without-pjproject * Package upgrades providing important security and bug fixes Full ChangeLog: https://raw.githubusercontent.com/astlinux-project/astlinux/1.5.0/docs/ChangeLog.txt All users are encouraged to upgrade, read the ChangeLog for the details. AstLinux Team |
|
From: Gonzalo <gon...@ho...> - 2023-02-25 23:25:46
|
Thanks David for your tips, I'll take a look on your scripts and try to make my own. Regards. |
|
From: Michael K. <mic...@ip...> - 2023-02-23 03:26:48
|
Whoops that's embarrassing. Glad I asked. Thanks guys. Regards Michael Knill On 23/2/2023, 12:20 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: > On Feb 22, 2023, at 2:36 AM, Michael Keuter <li...@mk... <mailto:li...@mk...>> wrote: > > > >> Am 22.02.2023 um 02:29 schrieb Michael Knill <mic...@ip... <mailto:mic...@ip...>>: >> >> Hi Guys >> >> Everything I read mentions that mpg123 is required for this but it does not appear to be in Astlinux. >> Could I just add the binary to /mnt/kd/bin do you think? >> >> Regards >> >> Michael Knill >> Managing Director > > Hi Michael, > > you can easily use "sox" instead of "mpg123" for streaming. Like: > > ---- > wget -q -O - $URL | sox -t mp3 $FOPTS - -t raw -r 8000 -c 1 - > ---- > > Michael > http://www.mksolutions.info <http://www.mksolutions.info> Agreed, sox supports more encoding types than mpg123, IIRC. This wiki entry has some good tidbits... External Music on Hold Source https://doc.astlinux-project.org/userdoc:tt_external_moh_source <https://doc.astlinux-project.org/userdoc:tt_external_moh_source> Lonnie _______________________________________________ Astlinux-users mailing list Ast...@li... <mailto:Ast...@li...> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. |
|
From: Michael K. <li...@mk...> - 2023-02-22 13:44:31
|
> Am 22.02.2023 um 14:19 schrieb Lonnie Abelbeck <li...@lo...>: > > > >> On Feb 22, 2023, at 2:36 AM, Michael Keuter <li...@mk...> wrote: >> >> >> >>> Am 22.02.2023 um 02:29 schrieb Michael Knill <mic...@ip...>: >>> >>> Hi Guys >>> >>> Everything I read mentions that mpg123 is required for this but it does not appear to be in Astlinux. >>> Could I just add the binary to /mnt/kd/bin do you think? >>> >>> Regards >>> >>> Michael Knill >>> Managing Director >> >> Hi Michael, >> >> you can easily use "sox" instead of "mpg123" for streaming. Like: >> >> ---- >> wget -q -O - $URL | sox -t mp3 $FOPTS - -t raw -r 8000 -c 1 - >> ---- >> >> Michael >> http://www.mksolutions.info > > Agreed, sox supports more encoding types than mpg123, IIRC. > > This wiki entry has some good tidbits... > > External Music on Hold Source > https://doc.astlinux-project.org/userdoc:tt_external_moh_source > > > Lonnie Cool, complete forgot about that old Wiki entry. Michael http://www.mksolutions.info |
|
From: Lonnie A. <li...@lo...> - 2023-02-22 13:19:46
|
> On Feb 22, 2023, at 2:36 AM, Michael Keuter <li...@mk...> wrote: > > > >> Am 22.02.2023 um 02:29 schrieb Michael Knill <mic...@ip...>: >> >> Hi Guys >> >> Everything I read mentions that mpg123 is required for this but it does not appear to be in Astlinux. >> Could I just add the binary to /mnt/kd/bin do you think? >> >> Regards >> >> Michael Knill >> Managing Director > > Hi Michael, > > you can easily use "sox" instead of "mpg123" for streaming. Like: > > ---- > wget -q -O - $URL | sox -t mp3 $FOPTS - -t raw -r 8000 -c 1 - > ---- > > Michael > http://www.mksolutions.info Agreed, sox supports more encoding types than mpg123, IIRC. This wiki entry has some good tidbits... External Music on Hold Source https://doc.astlinux-project.org/userdoc:tt_external_moh_source Lonnie |
|
From: Michael K. <li...@mk...> - 2023-02-22 09:41:49
|
> Am 22.02.2023 um 02:29 schrieb Michael Knill <mic...@ip...>: > > Hi Guys > > Everything I read mentions that mpg123 is required for this but it does not appear to be in Astlinux. > Could I just add the binary to /mnt/kd/bin do you think? > > Regards > > Michael Knill > Managing Director Hi Michael, you can easily use "sox" instead of "mpg123" for streaming. Like: ---- wget -q -O - $URL | sox -t mp3 $FOPTS - -t raw -r 8000 -c 1 - ---- Michael http://www.mksolutions.info |
|
From: David K. <da...@ke...> - 2023-02-22 01:54:32
|
I wanted to do something similar a couple of years ago... in my case I wanted to send notification over Pushover service. I ended up re-writing the notification feature of AstLinux. Previously each service that needs to send a notification did it on their own. I centralized it all into a single "system-notify" script that handled email and pushover directly, but also allows for a user script... which is what you would want to use, in my case I used the user script to add SMS via a netgear LTE gateway. My system-notify script is at https://github.com/dkerr64/astlinux/blob/develop/project/astlinux/target_skeleton/usr/sbin/system-notify But there are significant ancillary changes required across many system services to use this. Every service needs to be re-written to call this script rather than handle notification itself. I have done it in my branch of AstLinux, but it has not been merged into the mainline. That is something that Lonnie would have to do if he wanted it. David. On Tue, Feb 21, 2023 at 7:29 PM Gonzalo <gon...@ho...> wrote: > Hi, > > This message is to ask if adding Telegram (or similar messaging > applications) integration to Astlinux in addition to currently available > mail ones would be something possible in the near future. > > I use them with custom scripts and with Monit which is quite easy to > achieve via Telegram API by executing a simple command line, but I'd like > to do the same from asterisk-sip-monitor script (for example) which I think > should be pretty easy with a few little modifications but as it's generated > on boot time based on GUI configuration I haven't been able to get it > working (if there's some way to customize that script please let me know). > > Also I think providing notifications via some messaging apps would add > more flexibility. > > Thanks for your incredible work. > > Regards. > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to > pa...@kr.... |
|
From: Michael K. <mic...@ip...> - 2023-02-22 01:29:51
|
Hi Guys Everything I read mentions that mpg123 is required for this but it does not appear to be in Astlinux. Could I just add the binary to /mnt/kd/bin do you think? Regards Michael Knill Managing Director D: +61 2 6189 1360 P: +61 2 6140 4656 E: mic...@ip...<mailto:mic...@ip...> W: ipcsolutions.com.au<https://ipcsolutions.com.au/> [Icon Description automatically generated] Smarter Business Communications |
|
From: Gonzalo <gon...@ho...> - 2023-02-22 00:29:43
|
Hi, This message is to ask if adding Telegram (or similar messaging applications) integration to Astlinux in addition to currently available mail ones would be something possible in the near future. I use them with custom scripts and with Monit which is quite easy to achieve via Telegram API by executing a simple command line, but I'd like to do the same from asterisk-sip-monitor script (for example) which I think should be pretty easy with a few little modifications but as it's generated on boot time based on GUI configuration I haven't been able to get it working (if there's some way to customize that script please let me know). Also I think providing notifications via some messaging apps would add more flexibility. Thanks for your incredible work. Regards. |
|
From: Michael K. <mic...@ip...> - 2023-02-20 22:35:55
|
Hi Group I'm looking to use Counterpath Bria with Astlinux and wanting to provide a system directory. It appears that this is only possible using XMPP rosters and vCard which I believe Prosody in Astlinux supports. I have absolutely no idea how to set this up and am wondering if anyone has done so before? Note this is not just creating an XMPP only roster which are added to sharedgroups.conf, but also includes telephone numbers and other contact information. Thanks all. Regards Michael Knill Managing Director D: +61 2 6189 1360 P: +61 2 6140 4656 E: mic...@ip...<mailto:mic...@ip...> W: ipcsolutions.com.au<https://ipcsolutions.com.au/> [Icon Description automatically generated] Smarter Business Communications |
|
From: Lonnie A. <li...@lo...> - 2023-02-09 15:53:39
|
Announcing AstLinux Pre-Release: astlinux-1.5-5724-2f90aa
** New 1.5.x series based on Linux Kernel 5.10
-- New toolchain: glibc 2.31, binutils 2.35.1, gcc 9.4.0, using crosstool-ng-1.25.0
** The AstLinux Team is regularly upgrading packages containing security and bug fixes as well as adding new features of our own.
-- Linux Kernel 5.10.162 (major version bump), security and bug fixes
-- filesystem, use ext4 driver instead of ext2. Enable feature 'extra_isize' for new installs, without journal.
Note: With 'extra_isize' added for new installs, disks must be mounted as ext4, but they can be mounted read-only using ext2.
-- wireguard, igb, igc and e1000e drivers are now native with the 5.10 kernel
-- OpenSSL, version bump to 1.1.1t, security fixes: CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, CVE-2022-4304
-- libcurl (curl) version bump to 7.87.0, security fixes: CVE-2022-43551, CVE-2022-43552
-- LibreTLS, version bump to 3.7.0
-- libpcap, version bump to 1.10.3
-- libsrtp, version bump to 2.5.0
-- e2fsprogs, version bump to 1.46.6
-- htop, version bump to 3.2.2
-- linux-firmware, version bump to 20210919, provide binary blobs for r8169 and tg3 NIC drivers
-- sqlite, version bump to 3.40.1
-- stunnel, version bump to 5.68
-- sudo, version 1.8.32, add security fix: CVE-2023-22809
-- tcpdump, version 4.99.3
-- tiff, version bump to 4.5.0, security fixes: many
-- unbound, version bump to 1.17.1
-- Asterisk 13.38.3 ('13se' no change)
Last Asterisk 13.x "Legacy" version, built --without-pjproject
-- Asterisk 16.30.0 (version bump) and 18.16.0 (version bump)
-- DAHDI, dahdi-linux 3.2.0 (version bump) and dahdi-tools 3.2.0 (version bump)
Note: Retain patch to support (wctdm24xxp) TDM800P/AEX800 and TDM410P/AEX410 PCI cards.
Note: Retain patch to support (wctdm) TDM400P PCI cards.
Note: Retain patch to support (wcfxo) X100P PCI cards.
-- pjsip 2.12.1 (no change)
-- Complete Pre-Release ChangeLog:
https://astlinux-project.org/beta/astlinux-changelog/ChangeLog.txt
The "AstLinux Pre-Release ChangeLog" and "Pre-Release Repository URL" entries can be found under the "Development" tab of the AstLinux Project web site ...
AstLinux Project -> Development
https://www.astlinux-project.org/dev.html
AstLinux Team
|
|
From: Michael K. <mic...@ip...> - 2023-01-26 06:16:14
|
Hi Guys I fixed it myself by adding the soundfiles directly in confbridge.conf. Obviously should not be like that but a workaround in place. Regards Michael Knill From: Michael Knill <mic...@ip...> Reply to: AstLinux List <ast...@li...> Date: Thursday, 26 January 2023 at 2:52 pm To: AstLinux List <ast...@li...> Subject: [Astlinux-users] No join or leave sounds on ConfBridge Hi Group Pretty sure this is not an Astlinux problem but I cant get the join and leave sounds to play on ConfBridge. Comes up with: [Jan 26 13:58:00] WARNING[1747][C-00000002]: app_confbridge.c:1030 sound_file_exists: File confbridge-join does not exist in any format ...... [Jan 26 13:58:53] WARNING[1747][C-00000002]: app_confbridge.c:1030 sound_file_exists: File confbridge-leave does not exist in any format All the other sounds play fine and confbridge-join and confbridge-leave files play fine when using the Playback() application. I have set the correct language in the bridge profile and it shows in confbridge show profile bridge. Any ideas? I could not find an Asterisk bug anywhere. Regards Michael Knill Managing Director D: +61 2 6189 1360 P: +61 2 6140 4656 E: mic...@ip...<mailto:mic...@ip...> W: ipcsolutions.com.au<https://ipcsolutions.com.au/> [Icon Description automatically generated] Smarter Business Communications |
|
From: Michael K. <mic...@ip...> - 2023-01-26 03:52:18
|
Hi Group Pretty sure this is not an Astlinux problem but I cant get the join and leave sounds to play on ConfBridge. Comes up with: [Jan 26 13:58:00] WARNING[1747][C-00000002]: app_confbridge.c:1030 sound_file_exists: File confbridge-join does not exist in any format ...... [Jan 26 13:58:53] WARNING[1747][C-00000002]: app_confbridge.c:1030 sound_file_exists: File confbridge-leave does not exist in any format All the other sounds play fine and confbridge-join and confbridge-leave files play fine when using the Playback() application. I have set the correct language in the bridge profile and it shows in confbridge show profile bridge. Any ideas? I could not find an Asterisk bug anywhere. Regards Michael Knill Managing Director D: +61 2 6189 1360 P: +61 2 6140 4656 E: mic...@ip...<mailto:mic...@ip...> W: ipcsolutions.com.au<https://ipcsolutions.com.au/> [Icon Description automatically generated] Smarter Business Communications |
|
From: David K. <da...@ke...> - 2023-01-09 17:24:20
|
For a while now I have been experiencing IPv6 instability with my Comcast / Xfinity internet connection. Over the weekend we identified the source of the problem and Lonnie has implemented a fix which will rollout with the next update. In the meantime if you are unable to obtain an IPv6 address from your ISP, or you obtain one at boot and then it disappears after a while, you can add this line to your firewall custom config file as an interim solution... ip6tables -I EXT_INPUT_CHAIN -d fe80::/10 -p udp -m udp --sport 547 --dport 546 -j ACCEPT Explanation: The DHCPv6 client uses link-local IPv6 addresses and broadcasts a request for an address assignment to a specially designated IPv6 address... ff02::1:2. The DHCPv6 server (or relay) responds to the client's link-local address. Typically the response is sent from the server's own link-local address and firewall rules are in place to block DHCPv6 replies that do not originate from a link-local address. Comcast / Xfinity have implemented a change to their DHCPv6 servers and are sending responses from the server's own Global Unicast Address (GUA) which is blocked by the firewall. The solution is to change the firewall rule to check for the destination address (client's address) being link-local and accepting any source address. Regards, David |
|
From: Michael K. <mic...@ip...> - 2023-01-05 04:14:33
|
Hi All
Added this script in custom-rules.conf and it seems to work well:
-----
ipset create -exist udp_sip_hosts hash:net
ipset flush udp_sip_hosts
ip_addresses=$(grep "host" /mnt/kd/asterisk/sip_peers.conf | sed "s/host=//")
echo "$ip_addresses" | sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" | ipset restore
iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
-----
Regards
Michael Knill
On 3/1/2023, 2:03 pm, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote:
Michael,
Controlling the client is not ideal.
Not sure if it is worth the trouble, but rather than removing the IP address, you could mark it with a unique prefix, like:
#block#1.2.3.4
Then add another sed one-liner for a different set-name that gets added in a new unique chain which gets added as -I to the INPUT chain, like the adaptive ban plugin does. This order will make a -j DROP for udp 5060 act before the conntrack states.
Lonnie
> On Jan 2, 2023, at 6:16 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote:
>
> Thanks Lonnie. Sorry you had to roll your sleeves up. :-)¡
>
> Yes that makes perfect sense and it did what you said when tested. I really should have known this but it caught me out. I did stop SIP traffic going out but it was the remote peer's OPTIONS pings that was holding it up.
> We will test parsing sip_peers.conf looking at host= to pick up all the IP Addresses on the system and add them to the ipset.
>
> One thing I was thinking is that if we are sending OPTIONS pings to all these peers from the softswitch then theoretically we should not need to create any firewall rules as the session will already be set up in conntrack. I tested it by turning off OPTIONS pings at both ends, waiting for conntrack to time out and then turn on OPTIONS pings at the peer end. It did not work until I turned on OPTIONS pings at the softswitch end whereby I could make and receive calls again.
>
> Is this a bit risky do you think? Can you think of any breaking scenarios?
>
> Regards
> Michael Knill
>
>
>
> On 3/1/2023, 9:07 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> wrote:
>
>
> Hi Michael,
>
>
> I rolled up my sleeves, and gave this a test in my lab:
>
>
> -- snip /etc/arno-iptables-firewall/custom-rules --
>
>
> ipset_ext_input_allow()
> {
> local proto="$1" port="$2" set="$3" file="$4"
>
>
> if [ ! -f "$file" ]; then
> echo "[CUSTOM RULE] ipset_ext_input_allow: File not found: $file"
> return
> fi
>
>
> echo "[CUSTOM RULE] IPSet Pass EXT->Local for Proto: $proto, Port: $port, Set: $set, IPsetFile: $file"
>
>
> ipset create -exist $set hash:net
> ipset flush $set
>
>
> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist ${set} \1/p" "$file" | ipset restore
>
>
> ip4tables -A EXT_INPUT_CHAIN -m set --match-set $set src -p $proto --dport $port -j ACCEPT
> }
> ipset_ext_input_allow udp 5060 udp_sip_hosts /tmp/sip-whitelist.netset
>
>
> --
>
>
> -- /tmp/sip-whitelist.netset --
> ##
> 1.2.3.4 #test
> #10.10.50.1
> 10.10.50.55
> #10.10.0.0/16
>
>
> --
>
>
> It worked as expected. Restarting the firewall "arno-iptables-firewall restart" applies the current IPv4 .netset file.
>
>
>
>
>> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
>
>
> What you are seeing is the iptables conntrack state table, eventually the UDP state will expire after 120 seconds (unless traffic resets the state)
>
>
> Source Port (#'s) Destination Port Protocol Packets Bytes TTL
> 10.10.50.1 5060 10.10.50.64 5060 UDP 24 13856 1:29
>
>
> After the TTL counts down to 0 then the conntrack state disappears. The iptables conntrack state table makes the firewall much more efficient. This behavior has always existed.
>
>
> So in your testing, if you wait 2 minutes after you remove an IP and apply the change, the IP will be blocked for UDP 5060 traffic.
>
>
> If you are getting a constant stream of UDP 5060 traffic from that IP then you would need to take additional measures to block further traffic. For example, if you allowed a remote SIP endpoint to register more often than 120 seconds, removing the IP from the "allowed" ipset would not "block" it until the conntrack state disappears.
>
>
> Make sense?
>
>
> Lonnie
>
>
>
>
>
>
>> On Jan 2, 2023, at 2:26 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> wrote:
>>
>> Hi Lonnie
>>
>> Thanks for this. Unfortunately I still need to reboot the system for it to reread the netset rules if I remove an ipset entry.
>> Here is my custom-rules.conf:
>> --------
>> ipset create -exist udp_sip_hosts hash:net
>> ipset flush udp_sip_hosts
>> ipset add -exist udp_sip_hosts <my ip address added here>
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --------
>>
>> If I add another IP Address to the list as below and restart the firewall it works fine and I see it when I do an ipset list:
>> ipset add -exist udp_sip_hosts <1st ip address>
>> ipset add -exist udp_sip_hosts <2nd ip address>
>>
>> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
>> Obviously not workable I'm afraid.
>>
>> Regards
>> Michael Knill
>>
>>
>>
>> On 3/1/2023, 3:22 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>> wrote:
>>
>>
>> Hi Michael,
>>
>>
>> Referring to the "apply_ipset_netset()" function (here [1])
>>
>>
>> Add "-exist" to the "create" and "add" (man-page [2]) commands.
>>
>>
>> Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall.
>>
>>
>> Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset.
>>
>>
>> Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted.
>>
>>
>> custom-rules script snippet
>> --
>> ipset create -exist udp_sip_hosts hash:net
>> ipset flush udp_sip_hosts
>>
>>
>> ## either a one-liner from a text file "sip-whitelist.netset"
>> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore
>>
>>
>> ## Or, loop getting IPv4s from a text file "sip-whitelist.netset"
>> ipset add -exist udp_sip_hosts <IP Address>
>> ## done-loop
>>
>>
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --
>>
>>
>> Lonnie
>>
>>
>> [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>>
>>
>>
>> [2] https://ipset.netfilter.org/ipset.man.html <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html&gt;>>
>>
>>
>>
>>
>>>> On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> wrote:
>>>
>>> Hi All
>>> Merry Christmas and Happy New Year.
>>>
>>> Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below.
>>> We have done the following:
>>>
>>> Using CLI:
>>> ipset create udp_sip_hosts hash:ip
>>> ipset add udp_sip_hosts <IP Address>
>>>
>>> In custom-rules.conf
>>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>>
>>> It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart.
>>> I'm sure there is something I need to do which will get iptables to reread the ipset?
>>>
>>> Thanks guys.
>>>
>>> Regards
>>> Michael Knill
>>>
>>>
>>>
>>>> On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>>> wrote:
>>>
>>>
>>> Michael,
>>>
>>>
>>> The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward.
>>>
>>>
>>> BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule:
>>> --
>>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>> --
>>> That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all.
>>>
>>>
>>> Example 'ipset' usage in AstLinux:
>>> https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&amp;gt;&gt;>>
>>>
>>>
>>> If you only use IPv4 a lot of the example can be simplified.
>>>
>>>
>>> Lonnie
>>>
>>>
>>>
>>>
>>>
>>>
>>>> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>> wrote:
>>>>
>>>> Thanks Lonnie.
>>>>
>>>> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's?
>>>> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply.
>>>>
>>>> Regards
>>>> Michael Knill
>>>>
>>>> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>>> wrote:
>>>>
>>>> Hi Michael,
>>>>
>>>> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these.
>>>>
>>>> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT
>>>>
>>>> Without testing, something like ...
>>>> --
>>>> pass_ext_local()
>>>> {
>>>> local proto="$1" host="$2" port="$3"
>>>>
>>>> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port"
>>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>>> }
>>>> ## uncomment to enable ##
>>>> #pass_ext_local udp 1.2.3.4 5060
>>>> #pass_ext_local tcp 1.2.3.0/24 5061
>>>> --
>>>>
>>>> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting.
>>>>
>>>> Again untested ...
>>>> --
>>>> pass_ext_local_udp_sip()
>>>> {
>>>> local host proto="udp" port="5060" IFS
>>>> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48"
>>>>
>>>> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts"
>>>> unset IFS
>>>> for host in $sip_hosts; do
>>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>>> done
>>>> }
>>>> pass_ext_local_udp_sip
>>>> --
>>>>
>>>> Alternatively, you could define the sip_hosts variable with a file if desired.
>>>>
>>>> Lonnie
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>> wrote:
>>>>>
>>>>> Hi Group
>>>>>
>>>>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites.
>>>>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab?
>>>>>
>>>>> Regards
>>>>>
>>>>> Michael Knill
>>>>> Managing Director
>>>>>
>>>>> D: +61 2 6189 1360
>>>>> P: +61 2 6140 4656
>>>>> E: mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>
>>>>> W: ipcsolutions.com.au
>>>>>
>>>>> <image001.png>
>>>>> Smarter Business Communications
>>>>>
>>>>> _______________________________________________
>>>>> Astlinux-users mailing list
>>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>>>>
>>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>>>
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>>
>>>
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>
>
>
>
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
_______________________________________________
Astlinux-users mailing list
Ast...@li... <mailto:Ast...@li...>
https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
|
|
From: Michael K. <mic...@ip...> - 2023-01-03 07:11:36
|
I decided that I will just write them all in to be on the safe side. It should still work if they are not there but should be more reliable if they are.
Regards
Michael Knill
On 3/1/2023, 2:23 pm, "Michael Knill" <mic...@ip... <mailto:mic...@ip...>> wrote:
Thanks Lonnie
Although this is handy, I'm not really worried about addresses that wont time out until the peer is stopped at the other end.
The main reason for my questions below is whether I even bother about creating the ipset and firewall rule at all and what scenarios in which it could be problematic?
I could certainly just do it and it would not hurt anything, in fact the address could be missing and it still works fine as it has opened up the conntrack session with the OPTIONS ping.
Interestingly I'm asking this question even though I have a number of Astlinux systems that already don't have a rule for UDP5060 that have been working fine for years.
Regards
Michael Knill
On 3/1/2023, 2:03 pm, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> wrote:
Michael,
Controlling the client is not ideal.
Not sure if it is worth the trouble, but rather than removing the IP address, you could mark it with a unique prefix, like:
#block#1.2.3.4
Then add another sed one-liner for a different set-name that gets added in a new unique chain which gets added as -I to the INPUT chain, like the adaptive ban plugin does. This order will make a -j DROP for udp 5060 act before the conntrack states.
Lonnie
> On Jan 2, 2023, at 6:16 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> wrote:
>
> Thanks Lonnie. Sorry you had to roll your sleeves up. :-)¡
>
> Yes that makes perfect sense and it did what you said when tested. I really should have known this but it caught me out. I did stop SIP traffic going out but it was the remote peer's OPTIONS pings that was holding it up.
> We will test parsing sip_peers.conf looking at host= to pick up all the IP Addresses on the system and add them to the ipset.
>
> One thing I was thinking is that if we are sending OPTIONS pings to all these peers from the softswitch then theoretically we should not need to create any firewall rules as the session will already be set up in conntrack. I tested it by turning off OPTIONS pings at both ends, waiting for conntrack to time out and then turn on OPTIONS pings at the peer end. It did not work until I turned on OPTIONS pings at the softswitch end whereby I could make and receive calls again.
>
> Is this a bit risky do you think? Can you think of any breaking scenarios?
>
> Regards
> Michael Knill
>
>
>
> On 3/1/2023, 9:07 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>> wrote:
>
>
> Hi Michael,
>
>
> I rolled up my sleeves, and gave this a test in my lab:
>
>
> -- snip /etc/arno-iptables-firewall/custom-rules --
>
>
> ipset_ext_input_allow()
> {
> local proto="$1" port="$2" set="$3" file="$4"
>
>
> if [ ! -f "$file" ]; then
> echo "[CUSTOM RULE] ipset_ext_input_allow: File not found: $file"
> return
> fi
>
>
> echo "[CUSTOM RULE] IPSet Pass EXT->Local for Proto: $proto, Port: $port, Set: $set, IPsetFile: $file"
>
>
> ipset create -exist $set hash:net
> ipset flush $set
>
>
> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist ${set} \1/p" "$file" | ipset restore
>
>
> ip4tables -A EXT_INPUT_CHAIN -m set --match-set $set src -p $proto --dport $port -j ACCEPT
> }
> ipset_ext_input_allow udp 5060 udp_sip_hosts /tmp/sip-whitelist.netset
>
>
> --
>
>
> -- /tmp/sip-whitelist.netset --
> ##
> 1.2.3.4 #test
> #10.10.50.1
> 10.10.50.55
> #10.10.0.0/16
>
>
> --
>
>
> It worked as expected. Restarting the firewall "arno-iptables-firewall restart" applies the current IPv4 .netset file.
>
>
>
>
>> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
>
>
> What you are seeing is the iptables conntrack state table, eventually the UDP state will expire after 120 seconds (unless traffic resets the state)
>
>
> Source Port (#'s) Destination Port Protocol Packets Bytes TTL
> 10.10.50.1 5060 10.10.50.64 5060 UDP 24 13856 1:29
>
>
> After the TTL counts down to 0 then the conntrack state disappears. The iptables conntrack state table makes the firewall much more efficient. This behavior has always existed.
>
>
> So in your testing, if you wait 2 minutes after you remove an IP and apply the change, the IP will be blocked for UDP 5060 traffic.
>
>
> If you are getting a constant stream of UDP 5060 traffic from that IP then you would need to take additional measures to block further traffic. For example, if you allowed a remote SIP endpoint to register more often than 120 seconds, removing the IP from the "allowed" ipset would not "block" it until the conntrack state disappears.
>
>
> Make sense?
>
>
> Lonnie
>
>
>
>
>
>
>> On Jan 2, 2023, at 2:26 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> wrote:
>>
>> Hi Lonnie
>>
>> Thanks for this. Unfortunately I still need to reboot the system for it to reread the netset rules if I remove an ipset entry.
>> Here is my custom-rules.conf:
>> --------
>> ipset create -exist udp_sip_hosts hash:net
>> ipset flush udp_sip_hosts
>> ipset add -exist udp_sip_hosts <my ip address added here>
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --------
>>
>> If I add another IP Address to the list as below and restart the firewall it works fine and I see it when I do an ipset list:
>> ipset add -exist udp_sip_hosts <1st ip address>
>> ipset add -exist udp_sip_hosts <2nd ip address>
>>
>> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
>> Obviously not workable I'm afraid.
>>
>> Regards
>> Michael Knill
>>
>>
>>
>> On 3/1/2023, 3:22 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>>> wrote:
>>
>>
>> Hi Michael,
>>
>>
>> Referring to the "apply_ipset_netset()" function (here [1])
>>
>>
>> Add "-exist" to the "create" and "add" (man-page [2]) commands.
>>
>>
>> Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall.
>>
>>
>> Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset.
>>
>>
>> Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted.
>>
>>
>> custom-rules script snippet
>> --
>> ipset create -exist udp_sip_hosts hash:net
>> ipset flush udp_sip_hosts
>>
>>
>> ## either a one-liner from a text file "sip-whitelist.netset"
>> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore
>>
>>
>> ## Or, loop getting IPv4s from a text file "sip-whitelist.netset"
>> ipset add -exist udp_sip_hosts <IP Address>
>> ## done-loop
>>
>>
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --
>>
>>
>> Lonnie
>>
>>
>> [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&amp;gt;&gt;>>
>>
>>
>> [2] https://ipset.netfilter.org/ipset.man.html <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html&gt;>> <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html&gt;>> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html&gt;>> <https://ipset.netfilter.org/ipset.man.html&gt;>> <https://ipset.netfilter.org/ipset.man.html&amp;gt;&gt;>>
>>
>>
>>
>>
>>>> On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>> wrote:
>>>
>>> Hi All
>>> Merry Christmas and Happy New Year.
>>>
>>> Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below.
>>> We have done the following:
>>>
>>> Using CLI:
>>> ipset create udp_sip_hosts hash:ip
>>> ipset add udp_sip_hosts <IP Address>
>>>
>>> In custom-rules.conf
>>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>>
>>> It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart.
>>> I'm sure there is something I need to do which will get iptables to reread the ipset?
>>>
>>> Thanks guys.
>>>
>>> Regards
>>> Michael Knill
>>>
>>>
>>>
>>>> On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>>>> wrote:
>>>
>>>
>>> Michael,
>>>
>>>
>>> The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward.
>>>
>>>
>>> BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule:
>>> --
>>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>> --
>>> That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all.
>>>
>>>
>>> Example 'ipset' usage in AstLinux:
>>> https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&amp;gt;&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&amp;gt;&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&amp;gt;&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&amp;gt;&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&amp;gt;&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&amp;amp;gt;&amp;gt;&gt;>>
>>>
>>>
>>> If you only use IPv4 a lot of the example can be simplified.
>>>
>>>
>>> Lonnie
>>>
>>>
>>>
>>>
>>>
>>>
>>>> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>>> wrote:
>>>>
>>>> Thanks Lonnie.
>>>>
>>>> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's?
>>>> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply.
>>>>
>>>> Regards
>>>> Michael Knill
>>>>
>>>> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>>>> wrote:
>>>>
>>>> Hi Michael,
>>>>
>>>> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these.
>>>>
>>>> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT
>>>>
>>>> Without testing, something like ...
>>>> --
>>>> pass_ext_local()
>>>> {
>>>> local proto="$1" host="$2" port="$3"
>>>>
>>>> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port"
>>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>>> }
>>>> ## uncomment to enable ##
>>>> #pass_ext_local udp 1.2.3.4 5060
>>>> #pass_ext_local tcp 1.2.3.0/24 5061
>>>> --
>>>>
>>>> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting.
>>>>
>>>> Again untested ...
>>>> --
>>>> pass_ext_local_udp_sip()
>>>> {
>>>> local host proto="udp" port="5060" IFS
>>>> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48"
>>>>
>>>> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts"
>>>> unset IFS
>>>> for host in $sip_hosts; do
>>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>>> done
>>>> }
>>>> pass_ext_local_udp_sip
>>>> --
>>>>
>>>> Alternatively, you could define the sip_hosts variable with a file if desired.
>>>>
>>>> Lonnie
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>>> wrote:
>>>>>
>>>>> Hi Group
>>>>>
>>>>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites.
>>>>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab?
>>>>>
>>>>> Regards
>>>>>
>>>>> Michael Knill
>>>>> Managing Director
>>>>>
>>>>> D: +61 2 6189 1360
>>>>> P: +61 2 6140 4656
>>>>> E: mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>>
>>>>> W: ipcsolutions.com.au
>>>>>
>>>>> <image001.png>
>>>>> Smarter Business Communications
>>>>>
>>>>> _______________________________________________
>>>>> Astlinux-users mailing list
>>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>>
>>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;amp;gt;&amp;gt;&gt;>>
>>>>>
>>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>>.
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;amp;gt;&amp;gt;&gt;>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>>.
>>>>
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;amp;gt;&amp;gt;&gt;>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>>.
>>>
>>>
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;amp;gt;&amp;gt;&gt;>>
>>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>>.
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>
>
>
>
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
_______________________________________________
Astlinux-users mailing list
Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
_______________________________________________
Astlinux-users mailing list
Ast...@li... <mailto:Ast...@li...>
https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
|
|
From: Michael K. <mic...@ip...> - 2023-01-03 03:23:18
|
Thanks Lonnie
Although this is handy, I'm not really worried about addresses that wont time out until the peer is stopped at the other end.
The main reason for my questions below is whether I even bother about creating the ipset and firewall rule at all and what scenarios in which it could be problematic?
I could certainly just do it and it would not hurt anything, in fact the address could be missing and it still works fine as it has opened up the conntrack session with the OPTIONS ping.
Interestingly I'm asking this question even though I have a number of Astlinux systems that already don't have a rule for UDP5060 that have been working fine for years.
Regards
Michael Knill
On 3/1/2023, 2:03 pm, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote:
Michael,
Controlling the client is not ideal.
Not sure if it is worth the trouble, but rather than removing the IP address, you could mark it with a unique prefix, like:
#block#1.2.3.4
Then add another sed one-liner for a different set-name that gets added in a new unique chain which gets added as -I to the INPUT chain, like the adaptive ban plugin does. This order will make a -j DROP for udp 5060 act before the conntrack states.
Lonnie
> On Jan 2, 2023, at 6:16 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote:
>
> Thanks Lonnie. Sorry you had to roll your sleeves up. :-)¡
>
> Yes that makes perfect sense and it did what you said when tested. I really should have known this but it caught me out. I did stop SIP traffic going out but it was the remote peer's OPTIONS pings that was holding it up.
> We will test parsing sip_peers.conf looking at host= to pick up all the IP Addresses on the system and add them to the ipset.
>
> One thing I was thinking is that if we are sending OPTIONS pings to all these peers from the softswitch then theoretically we should not need to create any firewall rules as the session will already be set up in conntrack. I tested it by turning off OPTIONS pings at both ends, waiting for conntrack to time out and then turn on OPTIONS pings at the peer end. It did not work until I turned on OPTIONS pings at the softswitch end whereby I could make and receive calls again.
>
> Is this a bit risky do you think? Can you think of any breaking scenarios?
>
> Regards
> Michael Knill
>
>
>
> On 3/1/2023, 9:07 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> wrote:
>
>
> Hi Michael,
>
>
> I rolled up my sleeves, and gave this a test in my lab:
>
>
> -- snip /etc/arno-iptables-firewall/custom-rules --
>
>
> ipset_ext_input_allow()
> {
> local proto="$1" port="$2" set="$3" file="$4"
>
>
> if [ ! -f "$file" ]; then
> echo "[CUSTOM RULE] ipset_ext_input_allow: File not found: $file"
> return
> fi
>
>
> echo "[CUSTOM RULE] IPSet Pass EXT->Local for Proto: $proto, Port: $port, Set: $set, IPsetFile: $file"
>
>
> ipset create -exist $set hash:net
> ipset flush $set
>
>
> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist ${set} \1/p" "$file" | ipset restore
>
>
> ip4tables -A EXT_INPUT_CHAIN -m set --match-set $set src -p $proto --dport $port -j ACCEPT
> }
> ipset_ext_input_allow udp 5060 udp_sip_hosts /tmp/sip-whitelist.netset
>
>
> --
>
>
> -- /tmp/sip-whitelist.netset --
> ##
> 1.2.3.4 #test
> #10.10.50.1
> 10.10.50.55
> #10.10.0.0/16
>
>
> --
>
>
> It worked as expected. Restarting the firewall "arno-iptables-firewall restart" applies the current IPv4 .netset file.
>
>
>
>
>> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
>
>
> What you are seeing is the iptables conntrack state table, eventually the UDP state will expire after 120 seconds (unless traffic resets the state)
>
>
> Source Port (#'s) Destination Port Protocol Packets Bytes TTL
> 10.10.50.1 5060 10.10.50.64 5060 UDP 24 13856 1:29
>
>
> After the TTL counts down to 0 then the conntrack state disappears. The iptables conntrack state table makes the firewall much more efficient. This behavior has always existed.
>
>
> So in your testing, if you wait 2 minutes after you remove an IP and apply the change, the IP will be blocked for UDP 5060 traffic.
>
>
> If you are getting a constant stream of UDP 5060 traffic from that IP then you would need to take additional measures to block further traffic. For example, if you allowed a remote SIP endpoint to register more often than 120 seconds, removing the IP from the "allowed" ipset would not "block" it until the conntrack state disappears.
>
>
> Make sense?
>
>
> Lonnie
>
>
>
>
>
>
>> On Jan 2, 2023, at 2:26 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> wrote:
>>
>> Hi Lonnie
>>
>> Thanks for this. Unfortunately I still need to reboot the system for it to reread the netset rules if I remove an ipset entry.
>> Here is my custom-rules.conf:
>> --------
>> ipset create -exist udp_sip_hosts hash:net
>> ipset flush udp_sip_hosts
>> ipset add -exist udp_sip_hosts <my ip address added here>
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --------
>>
>> If I add another IP Address to the list as below and restart the firewall it works fine and I see it when I do an ipset list:
>> ipset add -exist udp_sip_hosts <1st ip address>
>> ipset add -exist udp_sip_hosts <2nd ip address>
>>
>> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
>> Obviously not workable I'm afraid.
>>
>> Regards
>> Michael Knill
>>
>>
>>
>> On 3/1/2023, 3:22 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>> wrote:
>>
>>
>> Hi Michael,
>>
>>
>> Referring to the "apply_ipset_netset()" function (here [1])
>>
>>
>> Add "-exist" to the "create" and "add" (man-page [2]) commands.
>>
>>
>> Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall.
>>
>>
>> Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset.
>>
>>
>> Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted.
>>
>>
>> custom-rules script snippet
>> --
>> ipset create -exist udp_sip_hosts hash:net
>> ipset flush udp_sip_hosts
>>
>>
>> ## either a one-liner from a text file "sip-whitelist.netset"
>> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore
>>
>>
>> ## Or, loop getting IPv4s from a text file "sip-whitelist.netset"
>> ipset add -exist udp_sip_hosts <IP Address>
>> ## done-loop
>>
>>
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --
>>
>>
>> Lonnie
>>
>>
>> [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>>
>>
>>
>> [2] https://ipset.netfilter.org/ipset.man.html <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html>> <https://ipset.netfilter.org/ipset.man.html&gt;>>
>>
>>
>>
>>
>>>> On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> wrote:
>>>
>>> Hi All
>>> Merry Christmas and Happy New Year.
>>>
>>> Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below.
>>> We have done the following:
>>>
>>> Using CLI:
>>> ipset create udp_sip_hosts hash:ip
>>> ipset add udp_sip_hosts <IP Address>
>>>
>>> In custom-rules.conf
>>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>>
>>> It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart.
>>> I'm sure there is something I need to do which will get iptables to reread the ipset?
>>>
>>> Thanks guys.
>>>
>>> Regards
>>> Michael Knill
>>>
>>>
>>>
>>>> On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>>> wrote:
>>>
>>>
>>> Michael,
>>>
>>>
>>> The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward.
>>>
>>>
>>> BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule:
>>> --
>>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>> --
>>> That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all.
>>>
>>>
>>> Example 'ipset' usage in AstLinux:
>>> https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&amp;gt;&gt;>>
>>>
>>>
>>> If you only use IPv4 a lot of the example can be simplified.
>>>
>>>
>>> Lonnie
>>>
>>>
>>>
>>>
>>>
>>>
>>>> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>> wrote:
>>>>
>>>> Thanks Lonnie.
>>>>
>>>> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's?
>>>> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply.
>>>>
>>>> Regards
>>>> Michael Knill
>>>>
>>>> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>>> wrote:
>>>>
>>>> Hi Michael,
>>>>
>>>> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these.
>>>>
>>>> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT
>>>>
>>>> Without testing, something like ...
>>>> --
>>>> pass_ext_local()
>>>> {
>>>> local proto="$1" host="$2" port="$3"
>>>>
>>>> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port"
>>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>>> }
>>>> ## uncomment to enable ##
>>>> #pass_ext_local udp 1.2.3.4 5060
>>>> #pass_ext_local tcp 1.2.3.0/24 5061
>>>> --
>>>>
>>>> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting.
>>>>
>>>> Again untested ...
>>>> --
>>>> pass_ext_local_udp_sip()
>>>> {
>>>> local host proto="udp" port="5060" IFS
>>>> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48"
>>>>
>>>> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts"
>>>> unset IFS
>>>> for host in $sip_hosts; do
>>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>>> done
>>>> }
>>>> pass_ext_local_udp_sip
>>>> --
>>>>
>>>> Alternatively, you could define the sip_hosts variable with a file if desired.
>>>>
>>>> Lonnie
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>> wrote:
>>>>>
>>>>> Hi Group
>>>>>
>>>>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites.
>>>>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab?
>>>>>
>>>>> Regards
>>>>>
>>>>> Michael Knill
>>>>> Managing Director
>>>>>
>>>>> D: +61 2 6189 1360
>>>>> P: +61 2 6140 4656
>>>>> E: mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>>
>>>>> W: ipcsolutions.com.au
>>>>>
>>>>> <image001.png>
>>>>> Smarter Business Communications
>>>>>
>>>>> _______________________________________________
>>>>> Astlinux-users mailing list
>>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>>>>
>>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>>>
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>>
>>>
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&amp;gt;&gt;>>
>>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>>.
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>
>
>
>
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
_______________________________________________
Astlinux-users mailing list
Ast...@li... <mailto:Ast...@li...>
https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
|
|
From: Lonnie A. <li...@lo...> - 2023-01-03 03:03:18
|
Michael,
Controlling the client is not ideal.
Not sure if it is worth the trouble, but rather than removing the IP address, you could mark it with a unique prefix, like:
#block#1.2.3.4
Then add another sed one-liner for a different set-name that gets added in a new unique chain which gets added as -I to the INPUT chain, like the adaptive ban plugin does. This order will make a -j DROP for udp 5060 act before the conntrack states.
Lonnie
> On Jan 2, 2023, at 6:16 PM, Michael Knill <mic...@ip...> wrote:
>
> Thanks Lonnie. Sorry you had to roll your sleeves up. :-)¡
>
> Yes that makes perfect sense and it did what you said when tested. I really should have known this but it caught me out. I did stop SIP traffic going out but it was the remote peer's OPTIONS pings that was holding it up.
> We will test parsing sip_peers.conf looking at host= to pick up all the IP Addresses on the system and add them to the ipset.
>
> One thing I was thinking is that if we are sending OPTIONS pings to all these peers from the softswitch then theoretically we should not need to create any firewall rules as the session will already be set up in conntrack. I tested it by turning off OPTIONS pings at both ends, waiting for conntrack to time out and then turn on OPTIONS pings at the peer end. It did not work until I turned on OPTIONS pings at the softswitch end whereby I could make and receive calls again.
>
> Is this a bit risky do you think? Can you think of any breaking scenarios?
>
> Regards
> Michael Knill
>
>
>
> On 3/1/2023, 9:07 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote:
>
>
> Hi Michael,
>
>
> I rolled up my sleeves, and gave this a test in my lab:
>
>
> -- snip /etc/arno-iptables-firewall/custom-rules --
>
>
> ipset_ext_input_allow()
> {
> local proto="$1" port="$2" set="$3" file="$4"
>
>
> if [ ! -f "$file" ]; then
> echo "[CUSTOM RULE] ipset_ext_input_allow: File not found: $file"
> return
> fi
>
>
> echo "[CUSTOM RULE] IPSet Pass EXT->Local for Proto: $proto, Port: $port, Set: $set, IPsetFile: $file"
>
>
> ipset create -exist $set hash:net
> ipset flush $set
>
>
> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist ${set} \1/p" "$file" | ipset restore
>
>
> ip4tables -A EXT_INPUT_CHAIN -m set --match-set $set src -p $proto --dport $port -j ACCEPT
> }
> ipset_ext_input_allow udp 5060 udp_sip_hosts /tmp/sip-whitelist.netset
>
>
> --
>
>
> -- /tmp/sip-whitelist.netset --
> ##
> 1.2.3.4 #test
> #10.10.50.1
> 10.10.50.55
> #10.10.0.0/16
>
>
> --
>
>
> It worked as expected. Restarting the firewall "arno-iptables-firewall restart" applies the current IPv4 .netset file.
>
>
>
>
>> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
>
>
> What you are seeing is the iptables conntrack state table, eventually the UDP state will expire after 120 seconds (unless traffic resets the state)
>
>
> Source Port (#'s) Destination Port Protocol Packets Bytes TTL
> 10.10.50.1 5060 10.10.50.64 5060 UDP 24 13856 1:29
>
>
> After the TTL counts down to 0 then the conntrack state disappears. The iptables conntrack state table makes the firewall much more efficient. This behavior has always existed.
>
>
> So in your testing, if you wait 2 minutes after you remove an IP and apply the change, the IP will be blocked for UDP 5060 traffic.
>
>
> If you are getting a constant stream of UDP 5060 traffic from that IP then you would need to take additional measures to block further traffic. For example, if you allowed a remote SIP endpoint to register more often than 120 seconds, removing the IP from the "allowed" ipset would not "block" it until the conntrack state disappears.
>
>
> Make sense?
>
>
> Lonnie
>
>
>
>
>
>
>> On Jan 2, 2023, at 2:26 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote:
>>
>> Hi Lonnie
>>
>> Thanks for this. Unfortunately I still need to reboot the system for it to reread the netset rules if I remove an ipset entry.
>> Here is my custom-rules.conf:
>> --------
>> ipset create -exist udp_sip_hosts hash:net
>> ipset flush udp_sip_hosts
>> ipset add -exist udp_sip_hosts <my ip address added here>
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --------
>>
>> If I add another IP Address to the list as below and restart the firewall it works fine and I see it when I do an ipset list:
>> ipset add -exist udp_sip_hosts <1st ip address>
>> ipset add -exist udp_sip_hosts <2nd ip address>
>>
>> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
>> Obviously not workable I'm afraid.
>>
>> Regards
>> Michael Knill
>>
>>
>>
>> On 3/1/2023, 3:22 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> wrote:
>>
>>
>> Hi Michael,
>>
>>
>> Referring to the "apply_ipset_netset()" function (here [1])
>>
>>
>> Add "-exist" to the "create" and "add" (man-page [2]) commands.
>>
>>
>> Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall.
>>
>>
>> Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset.
>>
>>
>> Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted.
>>
>>
>> custom-rules script snippet
>> --
>> ipset create -exist udp_sip_hosts hash:net
>> ipset flush udp_sip_hosts
>>
>>
>> ## either a one-liner from a text file "sip-whitelist.netset"
>> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore
>>
>>
>> ## Or, loop getting IPv4s from a text file "sip-whitelist.netset"
>> ipset add -exist udp_sip_hosts <IP Address>
>> ## done-loop
>>
>>
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --
>>
>>
>> Lonnie
>>
>>
>> [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>>
>>
>>
>> [2] https://ipset.netfilter.org/ipset.man.html <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html>>
>>
>>
>>
>>
>>>> On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> wrote:
>>>
>>> Hi All
>>> Merry Christmas and Happy New Year.
>>>
>>> Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below.
>>> We have done the following:
>>>
>>> Using CLI:
>>> ipset create udp_sip_hosts hash:ip
>>> ipset add udp_sip_hosts <IP Address>
>>>
>>> In custom-rules.conf
>>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>>
>>> It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart.
>>> I'm sure there is something I need to do which will get iptables to reread the ipset?
>>>
>>> Thanks guys.
>>>
>>> Regards
>>> Michael Knill
>>>
>>>
>>>
>>>> On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>> wrote:
>>>
>>>
>>> Michael,
>>>
>>>
>>> The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward.
>>>
>>>
>>> BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule:
>>> --
>>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>> --
>>> That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all.
>>>
>>>
>>> Example 'ipset' usage in AstLinux:
>>> https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>>
>>>
>>>
>>> If you only use IPv4 a lot of the example can be simplified.
>>>
>>>
>>> Lonnie
>>>
>>>
>>>
>>>
>>>
>>>
>>>> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> wrote:
>>>>
>>>> Thanks Lonnie.
>>>>
>>>> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's?
>>>> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply.
>>>>
>>>> Regards
>>>> Michael Knill
>>>>
>>>> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>> wrote:
>>>>
>>>> Hi Michael,
>>>>
>>>> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these.
>>>>
>>>> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT
>>>>
>>>> Without testing, something like ...
>>>> --
>>>> pass_ext_local()
>>>> {
>>>> local proto="$1" host="$2" port="$3"
>>>>
>>>> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port"
>>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>>> }
>>>> ## uncomment to enable ##
>>>> #pass_ext_local udp 1.2.3.4 5060
>>>> #pass_ext_local tcp 1.2.3.0/24 5061
>>>> --
>>>>
>>>> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting.
>>>>
>>>> Again untested ...
>>>> --
>>>> pass_ext_local_udp_sip()
>>>> {
>>>> local host proto="udp" port="5060" IFS
>>>> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48"
>>>>
>>>> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts"
>>>> unset IFS
>>>> for host in $sip_hosts; do
>>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>>> done
>>>> }
>>>> pass_ext_local_udp_sip
>>>> --
>>>>
>>>> Alternatively, you could define the sip_hosts variable with a file if desired.
>>>>
>>>> Lonnie
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> wrote:
>>>>>
>>>>> Hi Group
>>>>>
>>>>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites.
>>>>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab?
>>>>>
>>>>> Regards
>>>>>
>>>>> Michael Knill
>>>>> Managing Director
>>>>>
>>>>> D: +61 2 6189 1360
>>>>> P: +61 2 6140 4656
>>>>> E: mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>
>>>>> W: ipcsolutions.com.au
>>>>>
>>>>> <image001.png>
>>>>> Smarter Business Communications
>>>>>
>>>>> _______________________________________________
>>>>> Astlinux-users mailing list
>>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>>>>
>>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>>>
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>>
>>>
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
>
>
>
>
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Michael K. <mic...@ip...> - 2023-01-03 00:16:26
|
Thanks Lonnie. Sorry you had to roll your sleeves up.
Yes that makes perfect sense and it did what you said when tested. I really should have known this but it caught me out. I did stop SIP traffic going out but it was the remote peer's OPTIONS pings that was holding it up.
We will test parsing sip_peers.conf looking at host= to pick up all the IP Addresses on the system and add them to the ipset.
One thing I was thinking is that if we are sending OPTIONS pings to all these peers from the softswitch then theoretically we should not need to create any firewall rules as the session will already be set up in conntrack. I tested it by turning off OPTIONS pings at both ends, waiting for conntrack to time out and then turn on OPTIONS pings at the peer end. It did not work until I turned on OPTIONS pings at the softswitch end whereby I could make and receive calls again.
Is this a bit risky do you think? Can you think of any breaking scenarios?
Regards
Michael Knill
On 3/1/2023, 9:07 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote:
Hi Michael,
I rolled up my sleeves, and gave this a test in my lab:
-- snip /etc/arno-iptables-firewall/custom-rules --
ipset_ext_input_allow()
{
local proto="$1" port="$2" set="$3" file="$4"
if [ ! -f "$file" ]; then
echo "[CUSTOM RULE] ipset_ext_input_allow: File not found: $file"
return
fi
echo "[CUSTOM RULE] IPSet Pass EXT->Local for Proto: $proto, Port: $port, Set: $set, IPsetFile: $file"
ipset create -exist $set hash:net
ipset flush $set
sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist ${set} \1/p" "$file" | ipset restore
ip4tables -A EXT_INPUT_CHAIN -m set --match-set $set src -p $proto --dport $port -j ACCEPT
}
ipset_ext_input_allow udp 5060 udp_sip_hosts /tmp/sip-whitelist.netset
--
-- /tmp/sip-whitelist.netset --
##
1.2.3.4 #test
#10.10.50.1
10.10.50.55
#10.10.0.0/16
--
It worked as expected. Restarting the firewall "arno-iptables-firewall restart" applies the current IPv4 .netset file.
> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
What you are seeing is the iptables conntrack state table, eventually the UDP state will expire after 120 seconds (unless traffic resets the state)
Source Port (#'s) Destination Port Protocol Packets Bytes TTL
10.10.50.1 5060 10.10.50.64 5060 UDP 24 13856 1:29
After the TTL counts down to 0 then the conntrack state disappears. The iptables conntrack state table makes the firewall much more efficient. This behavior has always existed.
So in your testing, if you wait 2 minutes after you remove an IP and apply the change, the IP will be blocked for UDP 5060 traffic.
If you are getting a constant stream of UDP 5060 traffic from that IP then you would need to take additional measures to block further traffic. For example, if you allowed a remote SIP endpoint to register more often than 120 seconds, removing the IP from the "allowed" ipset would not "block" it until the conntrack state disappears.
Make sense?
Lonnie
> On Jan 2, 2023, at 2:26 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote:
>
> Hi Lonnie
>
> Thanks for this. Unfortunately I still need to reboot the system for it to reread the netset rules if I remove an ipset entry.
> Here is my custom-rules.conf:
> --------
> ipset create -exist udp_sip_hosts hash:net
> ipset flush udp_sip_hosts
> ipset add -exist udp_sip_hosts <my ip address added here>
> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
> --------
>
> If I add another IP Address to the list as below and restart the firewall it works fine and I see it when I do an ipset list:
> ipset add -exist udp_sip_hosts <1st ip address>
> ipset add -exist udp_sip_hosts <2nd ip address>
>
> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
> Obviously not workable I'm afraid.
>
> Regards
> Michael Knill
>
>
>
> On 3/1/2023, 3:22 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> wrote:
>
>
> Hi Michael,
>
>
> Referring to the "apply_ipset_netset()" function (here [1])
>
>
> Add "-exist" to the "create" and "add" (man-page [2]) commands.
>
>
> Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall.
>
>
> Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset.
>
>
> Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted.
>
>
> custom-rules script snippet
> --
> ipset create -exist udp_sip_hosts hash:net
> ipset flush udp_sip_hosts
>
>
> ## either a one-liner from a text file "sip-whitelist.netset"
> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore
>
>
> ## Or, loop getting IPv4s from a text file "sip-whitelist.netset"
> ipset add -exist udp_sip_hosts <IP Address>
> ## done-loop
>
>
> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
> --
>
>
> Lonnie
>
>
> [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>>
>
>
> [2] https://ipset.netfilter.org/ipset.man.html <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html> <https://ipset.netfilter.org/ipset.man.html>>
>
>
>
>
>> On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> wrote:
>>
>> Hi All
>> Merry Christmas and Happy New Year.
>>
>> Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below.
>> We have done the following:
>>
>> Using CLI:
>> ipset create udp_sip_hosts hash:ip
>> ipset add udp_sip_hosts <IP Address>
>>
>> In custom-rules.conf
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>
>> It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart.
>> I'm sure there is something I need to do which will get iptables to reread the ipset?
>>
>> Thanks guys.
>>
>> Regards
>> Michael Knill
>>
>>
>>
>> On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>> wrote:
>>
>>
>> Michael,
>>
>>
>> The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward.
>>
>>
>> BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule:
>> --
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --
>> That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all.
>>
>>
>> Example 'ipset' usage in AstLinux:
>> https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275&gt;>>
>>
>>
>> If you only use IPv4 a lot of the example can be simplified.
>>
>>
>> Lonnie
>>
>>
>>
>>
>>
>>
>>> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> wrote:
>>>
>>> Thanks Lonnie.
>>>
>>> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's?
>>> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply.
>>>
>>> Regards
>>> Michael Knill
>>>
>>> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>> <mailto:li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>>> wrote:
>>>
>>> Hi Michael,
>>>
>>> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these.
>>>
>>> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT
>>>
>>> Without testing, something like ...
>>> --
>>> pass_ext_local()
>>> {
>>> local proto="$1" host="$2" port="$3"
>>>
>>> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port"
>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>> }
>>> ## uncomment to enable ##
>>> #pass_ext_local udp 1.2.3.4 5060
>>> #pass_ext_local tcp 1.2.3.0/24 5061
>>> --
>>>
>>> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting.
>>>
>>> Again untested ...
>>> --
>>> pass_ext_local_udp_sip()
>>> {
>>> local host proto="udp" port="5060" IFS
>>> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48"
>>>
>>> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts"
>>> unset IFS
>>> for host in $sip_hosts; do
>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>> done
>>> }
>>> pass_ext_local_udp_sip
>>> --
>>>
>>> Alternatively, you could define the sip_hosts variable with a file if desired.
>>>
>>> Lonnie
>>>
>>>
>>>
>>>
>>>
>>>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>> wrote:
>>>>
>>>> Hi Group
>>>>
>>>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites.
>>>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab?
>>>>
>>>> Regards
>>>>
>>>> Michael Knill
>>>> Managing Director
>>>>
>>>> D: +61 2 6189 1360
>>>> P: +61 2 6140 4656
>>>> E: mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> <mailto:mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>>
>>>> W: ipcsolutions.com.au
>>>>
>>>> <image001.png>
>>>> Smarter Business Communications
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>>
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> <mailto:Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> <https://lists.sourceforge.net/lists/listinfo/astlinux-users&gt;>>
>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>> <mailto:pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>>.
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>
>
>
>
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
_______________________________________________
Astlinux-users mailing list
Ast...@li... <mailto:Ast...@li...>
https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
|
|
From: Lonnie A. <li...@lo...> - 2023-01-02 22:07:31
|
Hi Michael,
I rolled up my sleeves, and gave this a test in my lab:
-- snip /etc/arno-iptables-firewall/custom-rules --
ipset_ext_input_allow()
{
local proto="$1" port="$2" set="$3" file="$4"
if [ ! -f "$file" ]; then
echo "[CUSTOM RULE] ipset_ext_input_allow: File not found: $file"
return
fi
echo "[CUSTOM RULE] IPSet Pass EXT->Local for Proto: $proto, Port: $port, Set: $set, IPsetFile: $file"
ipset create -exist $set hash:net
ipset flush $set
sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist ${set} \1/p" "$file" | ipset restore
ip4tables -A EXT_INPUT_CHAIN -m set --match-set $set src -p $proto --dport $port -j ACCEPT
}
ipset_ext_input_allow udp 5060 udp_sip_hosts /tmp/sip-whitelist.netset
--
-- /tmp/sip-whitelist.netset --
##
1.2.3.4 #test
#10.10.50.1
10.10.50.55
#10.10.0.0/16
--
It worked as expected. Restarting the firewall "arno-iptables-firewall restart" applies the current IPv4 .netset file.
> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
What you are seeing is the iptables conntrack state table, eventually the UDP state will expire after 120 seconds (unless traffic resets the state)
Source Port (#'s) Destination Port Protocol Packets Bytes TTL
10.10.50.1 5060 10.10.50.64 5060 UDP 24 13856 1:29
After the TTL counts down to 0 then the conntrack state disappears. The iptables conntrack state table makes the firewall much more efficient. This behavior has always existed.
So in your testing, if you wait 2 minutes after you remove an IP and apply the change, the IP will be blocked for UDP 5060 traffic.
If you are getting a constant stream of UDP 5060 traffic from that IP then you would need to take additional measures to block further traffic. For example, if you allowed a remote SIP endpoint to register more often than 120 seconds, removing the IP from the "allowed" ipset would not "block" it until the conntrack state disappears.
Make sense?
Lonnie
> On Jan 2, 2023, at 2:26 PM, Michael Knill <mic...@ip...> wrote:
>
> Hi Lonnie
>
> Thanks for this. Unfortunately I still need to reboot the system for it to reread the netset rules if I remove an ipset entry.
> Here is my custom-rules.conf:
> --------
> ipset create -exist udp_sip_hosts hash:net
> ipset flush udp_sip_hosts
> ipset add -exist udp_sip_hosts <my ip address added here>
> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
> --------
>
> If I add another IP Address to the list as below and restart the firewall it works fine and I see it when I do an ipset list:
> ipset add -exist udp_sip_hosts <1st ip address>
> ipset add -exist udp_sip_hosts <2nd ip address>
>
> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system.
> Obviously not workable I'm afraid.
>
> Regards
> Michael Knill
>
>
>
> On 3/1/2023, 3:22 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote:
>
>
> Hi Michael,
>
>
> Referring to the "apply_ipset_netset()" function (here [1])
>
>
> Add "-exist" to the "create" and "add" (man-page [2]) commands.
>
>
> Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall.
>
>
> Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset.
>
>
> Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted.
>
>
> custom-rules script snippet
> --
> ipset create -exist udp_sip_hosts hash:net
> ipset flush udp_sip_hosts
>
>
> ## either a one-liner from a text file "sip-whitelist.netset"
> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore
>
>
> ## Or, loop getting IPv4s from a text file "sip-whitelist.netset"
> ipset add -exist udp_sip_hosts <IP Address>
> ## done-loop
>
>
> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
> --
>
>
> Lonnie
>
>
> [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>
>
>
> [2] https://ipset.netfilter.org/ipset.man.html <https://ipset.netfilter.org/ipset.man.html>
>
>
>
>
>> On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote:
>>
>> Hi All
>> Merry Christmas and Happy New Year.
>>
>> Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below.
>> We have done the following:
>>
>> Using CLI:
>> ipset create udp_sip_hosts hash:ip
>> ipset add udp_sip_hosts <IP Address>
>>
>> In custom-rules.conf
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>>
>> It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart.
>> I'm sure there is something I need to do which will get iptables to reread the ipset?
>>
>> Thanks guys.
>>
>> Regards
>> Michael Knill
>>
>>
>>
>> On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> wrote:
>>
>>
>> Michael,
>>
>>
>> The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward.
>>
>>
>> BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule:
>> --
>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
>> --
>> That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all.
>>
>>
>> Example 'ipset' usage in AstLinux:
>> https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>>
>>
>>
>> If you only use IPv4 a lot of the example can be simplified.
>>
>>
>> Lonnie
>>
>>
>>
>>
>>
>>
>>> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> wrote:
>>>
>>> Thanks Lonnie.
>>>
>>> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's?
>>> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply.
>>>
>>> Regards
>>> Michael Knill
>>>
>>> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> wrote:
>>>
>>> Hi Michael,
>>>
>>> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these.
>>>
>>> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT
>>>
>>> Without testing, something like ...
>>> --
>>> pass_ext_local()
>>> {
>>> local proto="$1" host="$2" port="$3"
>>>
>>> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port"
>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>> }
>>> ## uncomment to enable ##
>>> #pass_ext_local udp 1.2.3.4 5060
>>> #pass_ext_local tcp 1.2.3.0/24 5061
>>> --
>>>
>>> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting.
>>>
>>> Again untested ...
>>> --
>>> pass_ext_local_udp_sip()
>>> {
>>> local host proto="udp" port="5060" IFS
>>> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48"
>>>
>>> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts"
>>> unset IFS
>>> for host in $sip_hosts; do
>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
>>> done
>>> }
>>> pass_ext_local_udp_sip
>>> --
>>>
>>> Alternatively, you could define the sip_hosts variable with a file if desired.
>>>
>>> Lonnie
>>>
>>>
>>>
>>>
>>>
>>>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> wrote:
>>>>
>>>> Hi Group
>>>>
>>>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites.
>>>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab?
>>>>
>>>> Regards
>>>>
>>>> Michael Knill
>>>> Managing Director
>>>>
>>>> D: +61 2 6189 1360
>>>> P: +61 2 6140 4656
>>>> E: mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>
>>>> W: ipcsolutions.com.au
>>>>
>>>> <image001.png>
>>>> Smarter Business Communications
>>>>
>>>> _______________________________________________
>>>> Astlinux-users mailing list
>>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
>>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>>>>
>>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>>>
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>>>
>>>
>>> _______________________________________________
>>> Astlinux-users mailing list
>>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
>>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>>>
>>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>>
>>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>.
>>
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li... <mailto:Ast...@li...>
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
>
>
>
>
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li... <mailto:Ast...@li...>
> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users>
>
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>.
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Michael K. <mic...@ip...> - 2023-01-02 20:26:47
|
Hi Lonnie Thanks for this. Unfortunately I still need to reboot the system for it to reread the netset rules if I remove an ipset entry. Here is my custom-rules.conf: -------- ipset create -exist udp_sip_hosts hash:net ipset flush udp_sip_hosts ipset add -exist udp_sip_hosts <my ip address added here> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT -------- If I add another IP Address to the list as below and restart the firewall it works fine and I see it when I do an ipset list: ipset add -exist udp_sip_hosts <1st ip address> ipset add -exist udp_sip_hosts <2nd ip address> If I then remove the address and restart the firewall, the address is removed from the list (ipset list confirms this) but the address is still open in the firewall. I cannot remove it unless I reboot the system. Obviously not workable I'm afraid. Regards Michael Knill On 3/1/2023, 3:22 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: Hi Michael, Referring to the "apply_ipset_netset()" function (here [1]) Add "-exist" to the "create" and "add" (man-page [2]) commands. Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall. Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset. Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted. custom-rules script snippet -- ipset create -exist udp_sip_hosts hash:net ipset flush udp_sip_hosts ## either a one-liner from a text file "sip-whitelist.netset" sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore ## Or, loop getting IPv4s from a text file "sip-whitelist.netset" ipset add -exist udp_sip_hosts <IP Address> ## done-loop iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT -- Lonnie [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> [2] https://ipset.netfilter.org/ipset.man.html <https://ipset.netfilter.org/ipset.man.html> > On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote: > > Hi All > Merry Christmas and Happy New Year. > > Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below. > We have done the following: > > Using CLI: > ipset create udp_sip_hosts hash:ip > ipset add udp_sip_hosts <IP Address> > > In custom-rules.conf > iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT > > It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart. > I'm sure there is something I need to do which will get iptables to reread the ipset? > > Thanks guys. > > Regards > Michael Knill > > > > On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> wrote: > > > Michael, > > > The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward. > > > BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule: > -- > iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT > -- > That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all. > > > Example 'ipset' usage in AstLinux: > https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275>> > > > If you only use IPv4 a lot of the example can be simplified. > > > Lonnie > > > > > > >> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> wrote: >> >> Thanks Lonnie. >> >> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's? >> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply. >> >> Regards >> Michael Knill >> >> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...> <mailto:li...@lo... <mailto:li...@lo...>>> wrote: >> >> Hi Michael, >> >> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these. >> >> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT >> >> Without testing, something like ... >> -- >> pass_ext_local() >> { >> local proto="$1" host="$2" port="$3" >> >> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port" >> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >> } >> ## uncomment to enable ## >> #pass_ext_local udp 1.2.3.4 5060 >> #pass_ext_local tcp 1.2.3.0/24 5061 >> -- >> >> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting. >> >> Again untested ... >> -- >> pass_ext_local_udp_sip() >> { >> local host proto="udp" port="5060" IFS >> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48" >> >> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts" >> unset IFS >> for host in $sip_hosts; do >> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >> done >> } >> pass_ext_local_udp_sip >> -- >> >> Alternatively, you could define the sip_hosts variable with a file if desired. >> >> Lonnie >> >> >> >> >> >>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>>> wrote: >>> >>> Hi Group >>> >>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites. >>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab? >>> >>> Regards >>> >>> Michael Knill >>> Managing Director >>> >>> D: +61 2 6189 1360 >>> P: +61 2 6140 4656 >>> E: mic...@ip... <mailto:mic...@ip...> <mailto:mic...@ip... <mailto:mic...@ip...>> >>> W: ipcsolutions.com.au >>> >>> <image001.png> >>> Smarter Business Communications >>> >>> _______________________________________________ >>> Astlinux-users mailing list >>> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> >>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> >>> >>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>. >> >> >> >> _______________________________________________ >> Astlinux-users mailing list >> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> >> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> >> >> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>. >> >> >> _______________________________________________ >> Astlinux-users mailing list >> Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> >> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> >> >> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>. > > > > > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... <mailto:Ast...@li...> <mailto:Ast...@li... <mailto:Ast...@li...>> > https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users> <https://lists.sourceforge.net/lists/listinfo/astlinux-users>> > > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...> <mailto:pa...@kr... <mailto:pa...@kr...>>. > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... <mailto:Ast...@li...> > https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. _______________________________________________ Astlinux-users mailing list Ast...@li... <mailto:Ast...@li...> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. |
|
From: Lonnie A. <li...@lo...> - 2023-01-02 16:54:50
|
> On Jan 2, 2023, at 10:35 AM, Michael Keuter <li...@mk...> wrote: > > > >> Am 02.01.2023 um 17:21 schrieb Lonnie Abelbeck <li...@lo...>: >> >> Hi Michael, >> >> Referring to the "apply_ipset_netset()" function (here [1]) >> >> Add "-exist" to the "create" and "add" (man-page [2]) commands. >> >> Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall. >> >> Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset. >> >> Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted. >> >> custom-rules script snippet >> -- >> ipset create -exist udp_sip_hosts hash:net >> ipset flush udp_sip_hosts >> >> ## either a one-liner from a text file "sip-whitelist.netset" >> sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore >> >> ## Or, loop getting IPv4s from a text file "sip-whitelist.netset" >> ipset add -exist udp_sip_hosts <IP Address> >> ## done-loop >> >> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT >> -- >> >> Lonnie >> >> [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 >> >> [2] https://ipset.netfilter.org/ipset.man.html >> >> >>>> On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip...> wrote: >>> >>> Hi All >>> Merry Christmas and Happy New Year. >>> >>> Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below. >>> We have done the following: >>> >>> Using CLI: >>> ipset create udp_sip_hosts hash:ip >>> ipset add udp_sip_hosts <IP Address> >>> >>> In custom-rules.conf >>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT >>> >>> It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart. >>> I'm sure there is something I need to do which will get iptables to reread the ipset? >>> >>> Thanks guys. >>> >>> Regards >>> Michael Knill >>> >>> >>> >>> On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: >>> >>> >>> Michael, >>> >>> >>> The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward. >>> >>> >>> BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule: >>> -- >>> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT >>> -- >>> That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all. >>> >>> >>> Example 'ipset' usage in AstLinux: >>> https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> >>> >>> >>> If you only use IPv4 a lot of the example can be simplified. >>> >>> >>> Lonnie >>> >>> >>> >>> >>> >>> >>>> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote: >>>> >>>> Thanks Lonnie. >>>> >>>> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's? >>>> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply. >>>> >>>> Regards >>>> Michael Knill >>>> >>>> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: >>>> >>>> Hi Michael, >>>> >>>> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these. >>>> >>>> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT >>>> >>>> Without testing, something like ... >>>> -- >>>> pass_ext_local() >>>> { >>>> local proto="$1" host="$2" port="$3" >>>> >>>> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port" >>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >>>> } >>>> ## uncomment to enable ## >>>> #pass_ext_local udp 1.2.3.4 5060 >>>> #pass_ext_local tcp 1.2.3.0/24 5061 >>>> -- >>>> >>>> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting. >>>> >>>> Again untested ... >>>> -- >>>> pass_ext_local_udp_sip() >>>> { >>>> local host proto="udp" port="5060" IFS >>>> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48" >>>> >>>> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts" >>>> unset IFS >>>> for host in $sip_hosts; do >>>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >>>> done >>>> } >>>> pass_ext_local_udp_sip >>>> -- >>>> >>>> Alternatively, you could define the sip_hosts variable with a file if desired. >>>> >>>> Lonnie >>>> >>>> >>>> >>>> >>>> >>>>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote: >>>>> >>>>> Hi Group >>>>> >>>>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites. >>>>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab? >>>>> >>>>> Regards >>>>> >>>>> Michael Knill >>>>> Managing Director >>>>> > > You can also easily use Custom Blocklists in your "user.conf": > > BLOCKLIST_CUSTOM_URLS=" > https://feodotracker.abuse.ch/downloads/ipblocklist.txt > https://sslbl.abuse.ch/blacklist/sslipblacklist.txt > " > > Michael Yes, but he wants a SIP specific inbound whitelist. Lonnie |
|
From: Michael K. <li...@mk...> - 2023-01-02 16:35:16
|
> Am 02.01.2023 um 17:21 schrieb Lonnie Abelbeck <li...@lo...>: > > Hi Michael, > > Referring to the "apply_ipset_netset()" function (here [1]) > > Add "-exist" to the "create" and "add" (man-page [2]) commands. > > Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall. > > Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset. > > Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted. > > custom-rules script snippet > -- > ipset create -exist udp_sip_hosts hash:net > ipset flush udp_sip_hosts > > ## either a one-liner from a text file "sip-whitelist.netset" > sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore > > ## Or, loop getting IPv4s from a text file "sip-whitelist.netset" > ipset add -exist udp_sip_hosts <IP Address> > ## done-loop > > iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT > -- > > Lonnie > > [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 > > [2] https://ipset.netfilter.org/ipset.man.html > > >> On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip...> wrote: >> >> Hi All >> Merry Christmas and Happy New Year. >> >> Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below. >> We have done the following: >> >> Using CLI: >> ipset create udp_sip_hosts hash:ip >> ipset add udp_sip_hosts <IP Address> >> >> In custom-rules.conf >> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT >> >> It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart. >> I'm sure there is something I need to do which will get iptables to reread the ipset? >> >> Thanks guys. >> >> Regards >> Michael Knill >> >> >> >> On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: >> >> >> Michael, >> >> >> The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward. >> >> >> BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule: >> -- >> iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT >> -- >> That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all. >> >> >> Example 'ipset' usage in AstLinux: >> https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> >> >> >> If you only use IPv4 a lot of the example can be simplified. >> >> >> Lonnie >> >> >> >> >> >> >>> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote: >>> >>> Thanks Lonnie. >>> >>> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's? >>> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply. >>> >>> Regards >>> Michael Knill >>> >>> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: >>> >>> Hi Michael, >>> >>> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these. >>> >>> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT >>> >>> Without testing, something like ... >>> -- >>> pass_ext_local() >>> { >>> local proto="$1" host="$2" port="$3" >>> >>> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port" >>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >>> } >>> ## uncomment to enable ## >>> #pass_ext_local udp 1.2.3.4 5060 >>> #pass_ext_local tcp 1.2.3.0/24 5061 >>> -- >>> >>> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting. >>> >>> Again untested ... >>> -- >>> pass_ext_local_udp_sip() >>> { >>> local host proto="udp" port="5060" IFS >>> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48" >>> >>> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts" >>> unset IFS >>> for host in $sip_hosts; do >>> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >>> done >>> } >>> pass_ext_local_udp_sip >>> -- >>> >>> Alternatively, you could define the sip_hosts variable with a file if desired. >>> >>> Lonnie >>> >>> >>> >>> >>> >>>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote: >>>> >>>> Hi Group >>>> >>>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites. >>>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab? >>>> >>>> Regards >>>> >>>> Michael Knill >>>> Managing Director >>>> You can also easily use Custom Blocklists in your "user.conf": BLOCKLIST_CUSTOM_URLS=" https://feodotracker.abuse.ch/downloads/ipblocklist.txt https://sslbl.abuse.ch/blacklist/sslipblacklist.txt " Michael http://www.mksolutions.info |
|
From: Lonnie A. <li...@lo...> - 2023-01-02 16:21:39
|
Hi Michael, Referring to the "apply_ipset_netset()" function (here [1]) Add "-exist" to the "create" and "add" (man-page [2]) commands. Note that you can create the ipset from a text file within the /etc/arno-iptables-firewall/custom-rules script. Edit your text file and reload the firewall. Using "ipset create -exist ..." will not fail if the ipset already exists. "ipset flush ..." will clear any pre-existing ipset. Tip -> I would probably use "hash:net" instead of "hash:ip" so you could use CIDRs if you wanted. custom-rules script snippet -- ipset create -exist udp_sip_hosts hash:net ipset flush udp_sip_hosts ## either a one-liner from a text file "sip-whitelist.netset" sed -n -r -e "s/^([0-9][0-9./]+)([[:space:]].*|)$/add -exist udp_sip_hosts \1/p" sip-whitelist.netset | ipset restore ## Or, loop getting IPv4s from a text file "sip-whitelist.netset" ipset add -exist udp_sip_hosts <IP Address> ## done-loop iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT -- Lonnie [1] https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 [2] https://ipset.netfilter.org/ipset.man.html > On Jan 1, 2023, at 11:44 PM, Michael Knill <mic...@ip...> wrote: > > Hi All > Merry Christmas and Happy New Year. > > Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below. > We have done the following: > > Using CLI: > ipset create udp_sip_hosts hash:ip > ipset add udp_sip_hosts <IP Address> > > In custom-rules.conf > iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT > > It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart. > I'm sure there is something I need to do which will get iptables to reread the ipset? > > Thanks guys. > > Regards > Michael Knill > > > > On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: > > > Michael, > > > The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward. > > > BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule: > -- > iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT > -- > That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all. > > > Example 'ipset' usage in AstLinux: > https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> > > > If you only use IPv4 a lot of the example can be simplified. > > > Lonnie > > > > > > >> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote: >> >> Thanks Lonnie. >> >> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's? >> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply. >> >> Regards >> Michael Knill >> >> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: >> >> Hi Michael, >> >> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these. >> >> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT >> >> Without testing, something like ... >> -- >> pass_ext_local() >> { >> local proto="$1" host="$2" port="$3" >> >> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port" >> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >> } >> ## uncomment to enable ## >> #pass_ext_local udp 1.2.3.4 5060 >> #pass_ext_local tcp 1.2.3.0/24 5061 >> -- >> >> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting. >> >> Again untested ... >> -- >> pass_ext_local_udp_sip() >> { >> local host proto="udp" port="5060" IFS >> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48" >> >> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts" >> unset IFS >> for host in $sip_hosts; do >> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >> done >> } >> pass_ext_local_udp_sip >> -- >> >> Alternatively, you could define the sip_hosts variable with a file if desired. >> >> Lonnie >> >> >> >> >> >>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote: >>> >>> Hi Group >>> >>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites. >>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab? >>> >>> Regards >>> >>> Michael Knill >>> Managing Director >>> >>> D: +61 2 6189 1360 >>> P: +61 2 6140 4656 >>> E: mic...@ip... <mailto:mic...@ip...> >>> W: ipcsolutions.com.au >>> >>> <image001.png> >>> Smarter Business Communications >>> >>> _______________________________________________ >>> Astlinux-users mailing list >>> Ast...@li... <mailto:Ast...@li...> >>> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> >>> >>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. >> >> >> >> _______________________________________________ >> Astlinux-users mailing list >> Ast...@li... <mailto:Ast...@li...> >> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> >> >> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. >> >> >> _______________________________________________ >> Astlinux-users mailing list >> Ast...@li... <mailto:Ast...@li...> >> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> >> >> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. > > > > > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... <mailto:Ast...@li...> > https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> > > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Michael K. <mic...@ip...> - 2023-01-02 05:59:58
|
Hi All Merry Christmas and Happy New Year. Just rejuvenating this thread as I am building our new softswitch and playing with ipset as you offered below. We have done the following: Using CLI: ipset create udp_sip_hosts hash:ip ipset add udp_sip_hosts <IP Address> In custom-rules.conf iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT It all seems to work fine but I obviously am an iptables noob as I have no idea what to do when I make changes to the ipset as it does not change even after a firewall restart. I'm sure there is something I need to do which will get iptables to reread the ipset? Thanks guys. Regards Michael Knill On 27/9/2021, 10:54 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: Michael, The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward. BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule: -- iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT -- That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all. Example 'ipset' usage in AstLinux: https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 <https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275> If you only use IPv4 a lot of the example can be simplified. Lonnie > On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote: > > Thanks Lonnie. > > Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's? > It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply. > > Regards > Michael Knill > > On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo... <mailto:li...@lo...>> wrote: > > Hi Michael, > > With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these. > > Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT > > Without testing, something like ... > -- > pass_ext_local() > { > local proto="$1" host="$2" port="$3" > > echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port" > iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT > } > ## uncomment to enable ## > #pass_ext_local udp 1.2.3.4 5060 > #pass_ext_local tcp 1.2.3.0/24 5061 > -- > > If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting. > > Again untested ... > -- > pass_ext_local_udp_sip() > { > local host proto="udp" port="5060" IFS > local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48" > > echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts" > unset IFS > for host in $sip_hosts; do > iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT > done > } > pass_ext_local_udp_sip > -- > > Alternatively, you could define the sip_hosts variable with a file if desired. > > Lonnie > > > > > >> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip... <mailto:mic...@ip...>> wrote: >> >> Hi Group >> >> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites. >> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab? >> >> Regards >> >> Michael Knill >> Managing Director >> >> D: +61 2 6189 1360 >> P: +61 2 6140 4656 >> E: mic...@ip... <mailto:mic...@ip...> >> W: ipcsolutions.com.au >> >> <image001.png> >> Smarter Business Communications >> >> _______________________________________________ >> Astlinux-users mailing list >> Ast...@li... <mailto:Ast...@li...> >> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> >> >> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. > > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... <mailto:Ast...@li...> > https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... <mailto:Ast...@li...> > https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. _______________________________________________ Astlinux-users mailing list Ast...@li... <mailto:Ast...@li...> https://lists.sourceforge.net/lists/listinfo/astlinux-users <https://lists.sourceforge.net/lists/listinfo/astlinux-users> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr... <mailto:pa...@kr...>. |
63 messages has been excluded from this view by a project administrator.
