Menu
▾
▴
astlinux-users — AstLinux Users Mailing List
You can subscribe to this list here.
| 2006 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(1) |
Jul
(1) |
Aug
|
Sep
|
Oct
(2) |
Nov
(1) |
Dec
(20) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2007 |
Jan
(91) |
Feb
(111) |
Mar
(226) |
Apr
(65) |
May
(197) |
Jun
(202) |
Jul
(92) |
Aug
(87) |
Sep
(120) |
Oct
(133) |
Nov
(89) |
Dec
(155) |
| 2008 |
Jan
(251) |
Feb
(136) |
Mar
(174) |
Apr
(149) |
May
(56) |
Jun
(32) |
Jul
(36) |
Aug
(171) |
Sep
(245) |
Oct
(244) |
Nov
(218) |
Dec
(272) |
| 2009 |
Jan
(113) |
Feb
(119) |
Mar
(192) |
Apr
(117) |
May
(93) |
Jun
(46) |
Jul
(80) |
Aug
(54) |
Sep
(109) |
Oct
(70) |
Nov
(145) |
Dec
(110) |
| 2010 |
Jan
(137) |
Feb
(87) |
Mar
(45) |
Apr
(157) |
May
(58) |
Jun
(99) |
Jul
(188) |
Aug
(136) |
Sep
(101) |
Oct
(100) |
Nov
(61) |
Dec
(60) |
| 2011 |
Jan
(84) |
Feb
(43) |
Mar
(70) |
Apr
(17) |
May
(69) |
Jun
(28) |
Jul
(43) |
Aug
(21) |
Sep
(151) |
Oct
(120) |
Nov
(84) |
Dec
(101) |
| 2012 |
Jan
(119) |
Feb
(82) |
Mar
(70) |
Apr
(115) |
May
(66) |
Jun
(131) |
Jul
(70) |
Aug
(65) |
Sep
(66) |
Oct
(86) |
Nov
(197) |
Dec
(81) |
| 2013 |
Jan
(65) |
Feb
(48) |
Mar
(32) |
Apr
(68) |
May
(98) |
Jun
(59) |
Jul
(41) |
Aug
(52) |
Sep
(42) |
Oct
(37) |
Nov
(10) |
Dec
(27) |
| 2014 |
Jan
(61) |
Feb
(34) |
Mar
(30) |
Apr
(52) |
May
(45) |
Jun
(40) |
Jul
(28) |
Aug
(9) |
Sep
(39) |
Oct
(69) |
Nov
(55) |
Dec
(19) |
| 2015 |
Jan
(13) |
Feb
(21) |
Mar
(5) |
Apr
(14) |
May
(30) |
Jun
(51) |
Jul
(31) |
Aug
(12) |
Sep
(29) |
Oct
(15) |
Nov
(24) |
Dec
(16) |
| 2016 |
Jan
(62) |
Feb
(76) |
Mar
(30) |
Apr
(43) |
May
(46) |
Jun
(62) |
Jul
(21) |
Aug
(49) |
Sep
(67) |
Oct
(27) |
Nov
(26) |
Dec
(38) |
| 2017 |
Jan
(7) |
Feb
(12) |
Mar
(69) |
Apr
(59) |
May
(54) |
Jun
(40) |
Jul
(76) |
Aug
(82) |
Sep
(92) |
Oct
(51) |
Nov
(32) |
Dec
(30) |
| 2018 |
Jan
(22) |
Feb
(25) |
Mar
(34) |
Apr
(35) |
May
(37) |
Jun
(21) |
Jul
(69) |
Aug
(55) |
Sep
(17) |
Oct
(67) |
Nov
(9) |
Dec
(5) |
| 2019 |
Jan
(19) |
Feb
(12) |
Mar
(15) |
Apr
(19) |
May
|
Jun
(27) |
Jul
(27) |
Aug
(25) |
Sep
(25) |
Oct
(27) |
Nov
(10) |
Dec
(14) |
| 2020 |
Jan
(22) |
Feb
(20) |
Mar
(36) |
Apr
(40) |
May
(52) |
Jun
(35) |
Jul
(21) |
Aug
(32) |
Sep
(71) |
Oct
(27) |
Nov
(11) |
Dec
(16) |
| 2021 |
Jan
(16) |
Feb
(21) |
Mar
(21) |
Apr
(27) |
May
(17) |
Jun
|
Jul
(2) |
Aug
(22) |
Sep
(23) |
Oct
(7) |
Nov
(11) |
Dec
(28) |
| 2022 |
Jan
(23) |
Feb
(18) |
Mar
(9) |
Apr
(15) |
May
(15) |
Jun
(7) |
Jul
(8) |
Aug
(15) |
Sep
(1) |
Oct
|
Nov
(11) |
Dec
(10) |
| 2023 |
Jan
(14) |
Feb
(10) |
Mar
(11) |
Apr
(13) |
May
(2) |
Jun
(30) |
Jul
(1) |
Aug
(15) |
Sep
(13) |
Oct
(3) |
Nov
(25) |
Dec
(5) |
| 2024 |
Jan
(3) |
Feb
(10) |
Mar
(9) |
Apr
|
May
(1) |
Jun
(15) |
Jul
(7) |
Aug
(10) |
Sep
(3) |
Oct
(8) |
Nov
(6) |
Dec
(15) |
| 2025 |
Jan
(3) |
Feb
(1) |
Mar
(7) |
Apr
(5) |
May
(13) |
Jun
(16) |
Jul
(1) |
Aug
(6) |
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Lonnie A. <li...@lo...> - 2021-11-02 15:57:55
|
Announcing AstLinux Release: 1.4.4 More Info: AstLinux Project https://www.astlinux-project.org/ AstLinux 1.4.4 Highlights: * Asterisk Versions: 13.38.3, 16.21.1 * Added SIP threats blocklist 'apiban', requires an API Key in /mnt/kd/apiban.conf via https://apiban.org/ * Traffic Shaping, add CAKE support, both "Network -> Firewall -> Traffic Shaping" and "Network -> WAN Failover" * 2.5G ethernet support for Intel i225 (igc) and Realtek RTL8125 (r8125) NICs * '13se' version now uses Asterisk 13.38.3, "Security Fixes Only" version for Asterisk 13 * Linux Kernel 4.19.208, security and bug fixes * RUNNIX, version bump to runnix-0.6.5 * OpenSSL, version bump to 1.1.1l, security fixes * LibreTLS, version bump to 3.4.1 * WireGuard VPN, module 1.0.20210606 (no change), tools 1.0.20210914 (version bump) * libcurl (curl) version bump to 7.79.1 * arnofw (AIF), reload-blocklist-netset script, add support for 'apiban' * acme-client, version bump to 2.9.0 * Monit, version bump to 5.29.0 * prosody, version bump to 0.11.10 * vnStat, version bump to 2.8 * zabbix, version bump to 4.0.35 * Asterisk '13se' (stable edition) version 13.38.3 is the latest Asterisk 13.x "Security Fixes Only" version, built --without-pjproject * Package upgrades providing important security and bug fixes Full ChangeLog: https://raw.githubusercontent.com/astlinux-project/astlinux/1.4.4/docs/ChangeLog.txt All users are encouraged to upgrade, read the ChangeLog for the details. AstLinux Team |
|
From: Lonnie A. <li...@lo...> - 2021-11-02 15:38:24
|
Announcing AstLinux Release: 1.4.4 More Info: AstLinux Project https://www.astlinux-project.org/ AstLinux 1.4.3 Highlights: * Asterisk Versions: 13.38.3, 16.21.1 * Added SIP threats blocklist 'apiban', requires an API Key in /mnt/kd/apiban.conf via https://apiban.org/ * Traffic Shaping, add CAKE support, both "Network -> Firewall -> Traffic Shaping" and "Network -> WAN Failover" * 2.5G ethernet support for Intel i225 (igc) and Realtek RTL8125 (r8125) NICs * '13se' version now uses Asterisk 13.38.3, "Security Fixes Only" version for Asterisk 13 * Linux Kernel 4.19.208, security and bug fixes * RUNNIX, version bump to runnix-0.6.5 * OpenSSL, version bump to 1.1.1l, security fixes * LibreTLS, version bump to 3.4.1 * WireGuard VPN, module 1.0.20210606 (no change), tools 1.0.20210914 (version bump) * libcurl (curl) version bump to 7.79.1 * arnofw (AIF), reload-blocklist-netset script, add support for 'apiban' * acme-client, version bump to 2.9.0 * Monit, version bump to 5.29.0 * prosody, version bump to 0.11.10 * vnStat, version bump to 2.8 * zabbix, version bump to 4.0.35 * Asterisk '13se' (stable edition) version 13.38.3 is the latest Asterisk 13.x "Security Fixes Only" version, built --without-pjproject * Package upgrades providing important security and bug fixes Full ChangeLog: https://raw.githubusercontent.com/astlinux-project/astlinux/1.4.4/docs/ChangeLog.txt All users are encouraged to upgrade, read the ChangeLog for the details. AstLinux Team |
|
From: Lonnie A. <li...@lo...> - 2021-10-23 13:19:34
|
Announcing AstLinux Pre-Release: astlinux-1.4-5283-f45591 Release Candidate1 pre-1.4.4, please report any issues, ASAP. Key new features: -- Added SIP threats blocklist 'apiban', requires an API Key in /mnt/kd/apiban.conf via https://apiban.org/ -- Traffic Shaping, add CAKE support, both "Network -> Firewall -> Traffic Shaping" and "Network -> WAN Failover" -- 2.5G ethernet support for Intel i225 (igc) and Realtek RTL8125 (r8125) NICs -- '13se' version now uses Asterisk 13.38.3, "Security Fixes Only" version for Asterisk 13 ** The AstLinux Team is regularly upgrading packages containing security and bug fixes as well as adding new features of our own. -- Linux Kernel 4.19.208 (version bump), security and bug fixes -- ixgbe, enable the Intel 10-Gigabit Ethernet Network Driver -- igc, backport from linux-5.4.148, Intel i225 2.5-Gigabit Ethernet Network Driver -- r8125, version 9.006.04, Realtek RTL8125 2.5-Gigabit Ethernet Network Driver -- igb, version bump to 5.8.5, Intel 1.0-Gigabit Ethernet Network Driver -- OpenSSL, version bump to 1.1.1l, security fixes: CVE-2021-3711, CVE-2021-3712 -- libcurl (curl) version bump to 7.79.1, several security fixes -- prosody, version bump to 0.11.10, security fix: CVE-2021-37601 -- arnofw (AIF), reload-blocklist-netset script, add support for 'apiban' Note: 'apiban' requires an API Key in /mnt/kd/apiban.conf via https://apiban.org/ More info: https://doc.astlinux-project.org/userdoc:tt_firewall_external_block_list#updating_netset_blocklists -- acme-client, version bump to 2.9.0 -- Monit, version bump to 5.29.0 -- zabbix, version bump to 4.0.35 -- vnStat, version bump to 2.8 -- Asterisk 13.38.3 ('13se' version bump) Latest Asterisk 13.x "Security Fixes Only" version, built --without-pjproject -- Asterisk 13.38.3 (version bump) and 16.21.1 (version bump) New Asterisk 16 applications: WaitForCondition, Reload, StoreDTMF, SendMF New Asterisk 16 functions: FRAME_DROP, SAYFILES, SCRAMBLE -- Complete Pre-Release ChangeLog: https://s3.amazonaws.com/beta.astlinux-project/astlinux-changelog/ChangeLog.txt The "AstLinux Pre-Release ChangeLog" and "Pre-Release Repository URL" entries can be found under the "Development" tab of the AstLinux Project web site ... AstLinux Project -> Development https://www.astlinux-project.org/dev.html AstLinux Team |
|
From: Lonnie A. <li...@lo...> - 2021-10-16 19:30:11
|
Hi Craig,
To test, in /etc/asterisk/rtp.conf try setting "strictrtp=no" instead of the default "yes". Read the comments why this is enabled by default. Restart Asterisk and see if it helps. If not return it back.
I have seen occasions where "strictrtp=yes" has caused issues.
Lonnie
> On Oct 16, 2021, at 2:13 PM, Craig Law <cra...@gm...> wrote:
>
> Hi folks,
>
> I'm looking for some basic troubleshooting help. I have a fairly basic home setup running astlinux-1.4.3 x86_64 - Asterisk 13.38.2. I have a couple of Cisco CP-7811 phones and a couple Avaya J129s. I use Voip.ms as my provider.
>
> At some point recently, I noticed that when making an outgoing call, my Cisco phones were dropping their outgoing audio within a half-second of making a connection. My incoming audio is fine. Everything is fine with incoming calls.
>
> I then tried out my Avaya phones and they have no issues under any circumstances. So it seems like I need to make a change to my Cisco phones, but I just have no idea what.
>
> These logs probably aren't detailed enough, but I'll start with them for now. There are only 2 differences which I've highlighted, otherwise the logs are the same:
>
> More info to help reading below:
> My 'home' number aka Asterisk: 6137778888
> Internal extensions: 200 Cisco - 192.168.2.147
> Internal extensions: 400 Avaya - 192.168.2.157
> My external cell number for testing: 3439998888
> Voip.ms server: 208.100.60.50
>
> Here is the Cisco phone (ext 200) calling my cell phone
>
> == Using SIP RTP CoS mark 5
> > 0x152658048950 -- Strict RTP learning after remote address set to: 192.168.2.147:16412
> -- Executing [3439998888@default:1] Set("SIP/200-000000d9", "CALLERID(all)=LAW <6137778888>") in new stack
> -- Executing [3439998888@default:2] Dial("SIP/200-000000d9", "SIP/3439998888@voipms") in new stack
> == Using SIP RTP CoS mark 5
> -- Called SIP/3439998888@voipms
> > 0x152664007350 -- Strict RTP learning after remote address set to: 208.100.60.50:17166
> -- SIP/voipms-000000da is making progress passing it to SIP/200-000000d9
> > 0x152658048950 -- Strict RTP switching to RTP target address 192.168.2.147:16412 as source
> > 0x152664007350 -- Strict RTP switching to RTP target address 208.100.60.50:17166 as source
> ****** This line not in the other log ******* > 0x152658048950 -- Strict RTP learning complete - Locking on source address 192.168.2.147:16412
> -- SIP/voipms-000000da answered SIP/200-000000d9
> -- Channel SIP/voipms-000000da joined 'simple_bridge' basic-bridge <7dfd9292-27b5-4c07-92a8-33d435191096>
> -- Channel SIP/200-000000d9 joined 'simple_bridge' basic-bridge <7dfd9292-27b5-4c07-92a8-33d435191096>
> > Bridge 7dfd9292-27b5-4c07-92a8-33d435191096: switching from simple_bridge technology to native_rtp
> > Remotely bridged 'SIP/200-000000d9' and 'SIP/voipms-000000da' - media will flow directly between them
> > 0x152664007350 -- Strict RTP learning complete - Locking on source address 208.100.60.50:17166
> -- Channel SIP/200-000000d9 left 'native_rtp' basic-bridge <7dfd9292-27b5-4c07-92a8-33d435191096>
> -- Channel SIP/voipms-000000da left 'native_rtp' basic-bridge <7dfd9292-27b5-4c07-92a8-33d435191096>
> == Spawn extension (default, 3439998888, 2) exited non-zero on 'SIP/200-000000d9'
>
>
> Here's the Avaya (400) doing the same call:
>
> == Using SIP RTP CoS mark 5
> > 0x1526800401c0 -- Strict RTP learning after remote address set to: 192.168.2.157:5004
> -- Executing [3439998888@default:1] Set("SIP/400-000000db", "CALLERID(all)=LAW <6137778888>") in new stack
> -- Executing [3439998888@default:2] Dial("SIP/400-000000db", "SIP/3439998888@voipms") in new stack
> == Using SIP RTP CoS mark 5
> -- Called SIP/3439998888@voipms
> > 0x152674006650 -- Strict RTP learning after remote address set to: 208.100.60.50:15962
> -- SIP/voipms-000000dc is making progress passing it to SIP/400-000000db
> > 0x1526800401c0 -- Strict RTP switching to RTP target address 192.168.2.157:5004 as source
> > 0x152674006650 -- Strict RTP switching to RTP target address 208.100.60.50:15962 as source
> > 0x1526800401c0 -- Strict RTP learning complete - Locking on source address 192.168.2.157:5004
> ****** This line not in the other log ******* -- SIP/voipms-000000dc requested media update control 26, passing it to SIP/400-000000db
> -- SIP/voipms-000000dc answered SIP/400-000000db
> -- Channel SIP/voipms-000000dc joined 'simple_bridge' basic-bridge <4516067d-beca-43e1-b92f-78def4c48c4e>
> -- Channel SIP/400-000000db joined 'simple_bridge' basic-bridge <4516067d-beca-43e1-b92f-78def4c48c4e>
> > Bridge 4516067d-beca-43e1-b92f-78def4c48c4e: switching from simple_bridge technology to native_rtp
> > Remotely bridged 'SIP/400-000000db' and 'SIP/voipms-000000dc' - media will flow directly between them
> -- Channel SIP/voipms-000000dc left 'native_rtp' basic-bridge <4516067d-beca-43e1-b92f-78def4c48c4e>
> -- Channel SIP/400-000000db left 'native_rtp' basic-bridge <4516067d-beca-43e1-b92f-78def4c48c4e>
> == Spawn extension (default, 3439998888, 2) exited non-zero on 'SIP/400-000000db'
>
> I appreciate any and all help!
> Craig
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Craig L. <cra...@gm...> - 2021-10-16 19:14:13
|
Hi folks,
I'm looking for some basic troubleshooting help. I have a fairly basic home
setup running astlinux-1.4.3 x86_64 - Asterisk 13.38.2. I have a couple of
Cisco CP-7811 phones and a couple Avaya J129s. I use Voip.ms as my provider.
At some point recently, I noticed that when making an outgoing call, my
Cisco phones were dropping their outgoing audio within a half-second of
making a connection. My incoming audio is fine. Everything is fine with
incoming calls.
I then tried out my Avaya phones and they have no issues under
any circumstances. So it seems like I need to make a change to my Cisco
phones, but I just have no idea what.
These logs probably aren't detailed enough, but I'll start with them for
now. There are only 2 differences which I've highlighted, otherwise the
logs are the same:
More info to help reading below:
My 'home' number aka Asterisk: 6137778888
Internal extensions: 200 Cisco - 192.168.2.147
Internal extensions: 400 Avaya - 192.168.2.157
My external cell number for testing: 3439998888
Voip.ms server: 208.100.60.50
Here is the Cisco phone (ext 200) calling my cell phone
== Using SIP RTP CoS mark 5
> 0x152658048950 -- Strict RTP learning after remote address set to:
192.168.2.147:16412
-- Executing [3439998888@default:1] Set("SIP/200-000000d9",
"CALLERID(all)=LAW <6137778888>") in new stack
-- Executing [3439998888@default:2] Dial("SIP/200-000000d9",
"SIP/3439998888@voipms") in new stack
== Using SIP RTP CoS mark 5
-- Called SIP/3439998888@voipms
> 0x152664007350 -- Strict RTP learning after remote address set to:
208.100.60.50:17166
-- SIP/voipms-000000da is making progress passing it to SIP/200-000000d9
> 0x152658048950 -- Strict RTP switching to RTP target address
192.168.2.147:16412 as source
> 0x152664007350 -- Strict RTP switching to RTP target address
208.100.60.50:17166 as source
****** This line not in the other log ******* > 0x152658048950 --
Strict RTP learning complete - Locking on source address 192.168.2.147:16412
-- SIP/voipms-000000da answered SIP/200-000000d9
-- Channel SIP/voipms-000000da joined 'simple_bridge' basic-bridge
<7dfd9292-27b5-4c07-92a8-33d435191096>
-- Channel SIP/200-000000d9 joined 'simple_bridge' basic-bridge
<7dfd9292-27b5-4c07-92a8-33d435191096>
> Bridge 7dfd9292-27b5-4c07-92a8-33d435191096: switching from
simple_bridge technology to native_rtp
> Remotely bridged 'SIP/200-000000d9' and 'SIP/voipms-000000da' -
media will flow directly between them
> 0x152664007350 -- Strict RTP learning complete - Locking on source
address 208.100.60.50:17166
-- Channel SIP/200-000000d9 left 'native_rtp' basic-bridge
<7dfd9292-27b5-4c07-92a8-33d435191096>
-- Channel SIP/voipms-000000da left 'native_rtp' basic-bridge
<7dfd9292-27b5-4c07-92a8-33d435191096>
== Spawn extension (default, 3439998888, 2) exited non-zero on
'SIP/200-000000d9'
Here's the Avaya (400) doing the same call:
== Using SIP RTP CoS mark 5
> 0x1526800401c0 -- Strict RTP learning after remote address set to:
192.168.2.157:5004
-- Executing [3439998888@default:1] Set("SIP/400-000000db",
"CALLERID(all)=LAW <6137778888>") in new stack
-- Executing [3439998888@default:2] Dial("SIP/400-000000db",
"SIP/3439998888@voipms") in new stack
== Using SIP RTP CoS mark 5
-- Called SIP/3439998888@voipms
> 0x152674006650 -- Strict RTP learning after remote address set to:
208.100.60.50:15962
-- SIP/voipms-000000dc is making progress passing it to SIP/400-000000db
> 0x1526800401c0 -- Strict RTP switching to RTP target address
192.168.2.157:5004 as source
> 0x152674006650 -- Strict RTP switching to RTP target address
208.100.60.50:15962 as source
> 0x1526800401c0 -- Strict RTP learning complete - Locking on source
address 192.168.2.157:5004
****** This line not in the other log ******* -- SIP/voipms-000000dc
requested media update control 26, passing it to SIP/400-000000db
-- SIP/voipms-000000dc answered SIP/400-000000db
-- Channel SIP/voipms-000000dc joined 'simple_bridge' basic-bridge
<4516067d-beca-43e1-b92f-78def4c48c4e>
-- Channel SIP/400-000000db joined 'simple_bridge' basic-bridge
<4516067d-beca-43e1-b92f-78def4c48c4e>
> Bridge 4516067d-beca-43e1-b92f-78def4c48c4e: switching from
simple_bridge technology to native_rtp
> Remotely bridged 'SIP/400-000000db' and 'SIP/voipms-000000dc' -
media will flow directly between them
-- Channel SIP/voipms-000000dc left 'native_rtp' basic-bridge
<4516067d-beca-43e1-b92f-78def4c48c4e>
-- Channel SIP/400-000000db left 'native_rtp' basic-bridge
<4516067d-beca-43e1-b92f-78def4c48c4e>
== Spawn extension (default, 3439998888, 2) exited non-zero on
'SIP/400-000000db'
I appreciate any and all help!
Craig
|
|
From: Michael K. <mic...@ip...> - 2021-10-15 02:22:16
|
Hi Group I think I have asked this before but I need an elegant solution for ‘Unbanning’ an IP Address rather than Whitelisting it or deleting the log file it is in. For instance I have a likely dynamic home IP Address that I want to just remove from being banned but could be banned in the future. I'm thinking I could replace all instances of the IP Address in the log with something like <Previously Banned IP Address> and then restart the firewall. Would this work? Any other options? Regards Michael Knill Managing Director D: +61 2 6189 1360 P: +61 2 6140 4656 E: mic...@ip...<mailto:mic...@ip...> W: ipcsolutions.com.au<https://ipcsolutions.com.au/> [IPC Solutions] Smarter Business Communications |
|
From: The C. K. <eld...@ya...> - 2021-10-04 23:39:57
|
I use MT routers for site routers all the time, really bug sites I go to a 2000 or 3000 series.
For remote workers each one gets a little MT hex poe for their phone .. it just uses an L2TP connection back to our NOC for hosted customers or to their own site if the customer has an on prem phone system.
I disable the sip ALG in it and also most other services which gives the CPU a chance. I don’t do any fancy stuff with monitoring or such and they work good
My mobile Bus lab has an MT in it running in dual sims and the voice works even over LTE. The L2TP tunnels re establish quickly if they die off for some reason. The one in the bus is an LTAP mini and even with 4 VLANs it doesn’t seems to slow down. (It maintains 3 tunnels to 3 different phone systems ) the VLANs go to a little managed net gear POE switch off of a single ether port on the MT ..
They are robust little devices if you ask me. I been using them since 2004 or so .. used to run the MT software in soekris boards
On Monday, October 4, 2021, 06:27:09 PM EDT, Lonnie Abelbeck <li...@lo...> wrote:
Hi Michael,
Thanks for the update. Much appreciated.
With WireGuard in the kernel, a 800 MHz 1x CPU can probably handle ~100 Mbps.
Lonnie
> On Oct 4, 2021, at 2:31 PM, Michael Knill <mic...@ip...> wrote:
>
> Hi All
>
> Responding to my post here.
> I can confirm that my Mikrotik hAPac3 has been running fine on 7.1b6 which I will be upgrading soon to 7.1rc4 in my home office. It uses a Wireguard VPN to connect to a hosted Astlinux system for our office and it has been quite stable for months now.
>
> We intend on using it for production systems moving forward and will be building a plug and play telephony gateway solution using these devices:
> https://mikrotik.com/product/RB960PGS
> https://mikrotik.com/product/crs112_8p_4s_in
> https://mikrotik.com/product/crs328_24p_4s_rm
>
> Not enough grunt to be a site router but fine to route voice traffic over a Wireguard tunnel. Just plug it in anywhere on the network and plug your phones in. We now have full visibility inside the customers network which will allow us to better manage the solution.
>
> Regards
> Michael Knill
>
> On 13/12/20, 1:26 am, "Lonnie Abelbeck" <li...@lo...> wrote:
>
> Hi Michael,
>
> Thanks for the info, keep us updated. Mikrotik WireGuard support is a great development.
>
> Lonnie
>
>
>> On Dec 11, 2020, at 11:08 PM, Michael Knill <mic...@ip...> wrote:
>>
>> Hmm I would probably wait for a little while though as I have found a couple of annoying bugs ☹
>>
>> Regards
>> Michael Knill
>>
>> From: Michael Knill <mic...@ip...>
>> Reply to: AstLinux List <ast...@li...>
>> Date: Saturday, 12 December 2020 at 3:49 pm
>> To: AstLinux List <ast...@li...>
>> Subject: [Astlinux-users] Mikrotik Wireguard VPN Endpoint
>>
>> Thought I would let the group that I have been testing Wireguard on Mikrotik (supported 7.1beta3) to Astlinux.
>> Working very well so far on a powerful and cost effective router out of the box.
>>
>> Regards
>> Michael Knill
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li...
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
>
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Lonnie A. <li...@lo...> - 2021-10-04 22:26:46
|
Hi Michael, Thanks for the update. Much appreciated. With WireGuard in the kernel, a 800 MHz 1x CPU can probably handle ~100 Mbps. Lonnie > On Oct 4, 2021, at 2:31 PM, Michael Knill <mic...@ip...> wrote: > > Hi All > > Responding to my post here. > I can confirm that my Mikrotik hAPac3 has been running fine on 7.1b6 which I will be upgrading soon to 7.1rc4 in my home office. It uses a Wireguard VPN to connect to a hosted Astlinux system for our office and it has been quite stable for months now. > > We intend on using it for production systems moving forward and will be building a plug and play telephony gateway solution using these devices: > https://mikrotik.com/product/RB960PGS > https://mikrotik.com/product/crs112_8p_4s_in > https://mikrotik.com/product/crs328_24p_4s_rm > > Not enough grunt to be a site router but fine to route voice traffic over a Wireguard tunnel. Just plug it in anywhere on the network and plug your phones in. We now have full visibility inside the customers network which will allow us to better manage the solution. > > Regards > Michael Knill > > On 13/12/20, 1:26 am, "Lonnie Abelbeck" <li...@lo...> wrote: > > Hi Michael, > > Thanks for the info, keep us updated. Mikrotik WireGuard support is a great development. > > Lonnie > > >> On Dec 11, 2020, at 11:08 PM, Michael Knill <mic...@ip...> wrote: >> >> Hmm I would probably wait for a little while though as I have found a couple of annoying bugs ☹ >> >> Regards >> Michael Knill >> >> From: Michael Knill <mic...@ip...> >> Reply to: AstLinux List <ast...@li...> >> Date: Saturday, 12 December 2020 at 3:49 pm >> To: AstLinux List <ast...@li...> >> Subject: [Astlinux-users] Mikrotik Wireguard VPN Endpoint >> >> Thought I would let the group that I have been testing Wireguard on Mikrotik (supported 7.1beta3) to Astlinux. >> Working very well so far on a powerful and cost effective router out of the box. >> >> Regards >> Michael Knill >> _______________________________________________ >> Astlinux-users mailing list >> Ast...@li... >> https://lists.sourceforge.net/lists/listinfo/astlinux-users >> >> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... > > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Michael K. <mic...@ip...> - 2021-10-04 19:31:18
|
Hi All Responding to my post here. I can confirm that my Mikrotik hAPac3 has been running fine on 7.1b6 which I will be upgrading soon to 7.1rc4 in my home office. It uses a Wireguard VPN to connect to a hosted Astlinux system for our office and it has been quite stable for months now. We intend on using it for production systems moving forward and will be building a plug and play telephony gateway solution using these devices: https://mikrotik.com/product/RB960PGS https://mikrotik.com/product/crs112_8p_4s_in https://mikrotik.com/product/crs328_24p_4s_rm Not enough grunt to be a site router but fine to route voice traffic over a Wireguard tunnel. Just plug it in anywhere on the network and plug your phones in. We now have full visibility inside the customers network which will allow us to better manage the solution. Regards Michael Knill On 13/12/20, 1:26 am, "Lonnie Abelbeck" <li...@lo...> wrote: Hi Michael, Thanks for the info, keep us updated. Mikrotik WireGuard support is a great development. Lonnie > On Dec 11, 2020, at 11:08 PM, Michael Knill <mic...@ip...> wrote: > > Hmm I would probably wait for a little while though as I have found a couple of annoying bugs ☹ > > Regards > Michael Knill > > From: Michael Knill <mic...@ip...> > Reply to: AstLinux List <ast...@li...> > Date: Saturday, 12 December 2020 at 3:49 pm > To: AstLinux List <ast...@li...> > Subject: [Astlinux-users] Mikrotik Wireguard VPN Endpoint > > Thought I would let the group that I have been testing Wireguard on Mikrotik (supported 7.1beta3) to Astlinux. > Working very well so far on a powerful and cost effective router out of the box. > > Regards > Michael Knill > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... _______________________________________________ Astlinux-users mailing list Ast...@li... https://lists.sourceforge.net/lists/listinfo/astlinux-users Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Michael K. <mic...@ip...> - 2021-09-27 21:08:21
|
Actually thinking I will use SSTP for VPN to the management and monitoring environment as it appears to be much better suited for the task. Regards Michael Knill From: Michael Knill <mic...@ip...> Reply to: AstLinux List <ast...@li...> Date: Tuesday, 28 September 2021 at 6:56 am To: AstLinux List <ast...@li...> Subject: Re: [Astlinux-users] L2TP on Astlinux Hi thanks Christopher Interesting you mention this as I am currently developing a solution whereby I'm going to put all my Astlinux systems in the cloud and connect remotely to it via Mikrotik switches in router mode, essentially creating a telephony gateway appliance. These are the products I will be using: https://mikrotik.com/product/crs112_8p_4s_in https://mikrotik.com/product/crs328_24p_4s_rm https://mikrotik.com/product/crs354_48p_4s_2q_rm From the gateway, I will have a management VPN terminating into our management and monitoring environment (Unimus and Zabbix) and a VPN directly to the Astlinux VM. I want to use Wireguard and I think 7.1b6 is getting very close to production ready and it has worked well for months in my home office. If L2TP works well I may use this in the interim while testing Wireguard or maybe just to the management and monitoring environment. I'm assuming you use Mikrotik CHR in the NOC? Have you ever connected L2TP directly to an Astlinux system? Thanks all. Regards Michael Knill From: AstLinux List <ast...@li...> Reply to: AstLinux List <ast...@li...> Date: Monday, 27 September 2021 at 11:27 pm To: AstLinux List <ast...@li...> Cc: The Cadillac Kid <eld...@ya...> Subject: Re: [Astlinux-users] L2TP on Astlinux for my remote workers I use a little Mikrotik POE router, establishes an L2TP tunnel to a Mikrotik in my NOC which then talks to my Asterisk Server.. phones work perfectly in this manner and voice is encrypted, no SIP ports open to the public side.. handles NAT situations in people's homes pretty well (as long as they dont have junk like EERO) On Monday, September 27, 2021, 06:15:23 AM EDT, Michael Keuter <li...@mk...> wrote: > Am 27.09.2021 um 10:37 schrieb Michael Knill <mic...@ip...<mailto:mic...@ip...>>: > > Hi Group > > Forgive my lack of VPN knowledge here. V85 of Yealink phones supports L2TP. Could this be supported on Astlinux? > It looks like it would be easier to set up on the phone than OpenVPN. > > Regards > > Michael Knill Hi Michael, I looked at it last year, when V85 was released. The Yealink L2TP implementation doesn't even support a static PSK. Only username/password. Michael http://www.mksolutions.info _______________________________________________ Astlinux-users mailing list Ast...@li...<mailto:Ast...@li...> https://lists.sourceforge.net/lists/listinfo/astlinux-users Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....<mailto:pa...@kr....> |
|
From: Michael K. <mic...@ip...> - 2021-09-27 20:55:55
|
Hi thanks Christopher Interesting you mention this as I am currently developing a solution whereby I'm going to put all my Astlinux systems in the cloud and connect remotely to it via Mikrotik switches in router mode, essentially creating a telephony gateway appliance. These are the products I will be using: https://mikrotik.com/product/crs112_8p_4s_in https://mikrotik.com/product/crs328_24p_4s_rm https://mikrotik.com/product/crs354_48p_4s_2q_rm From the gateway, I will have a management VPN terminating into our management and monitoring environment (Unimus and Zabbix) and a VPN directly to the Astlinux VM. I want to use Wireguard and I think 7.1b6 is getting very close to production ready and it has worked well for months in my home office. If L2TP works well I may use this in the interim while testing Wireguard or maybe just to the management and monitoring environment. I'm assuming you use Mikrotik CHR in the NOC? Have you ever connected L2TP directly to an Astlinux system? Thanks all. Regards Michael Knill From: AstLinux List <ast...@li...> Reply to: AstLinux List <ast...@li...> Date: Monday, 27 September 2021 at 11:27 pm To: AstLinux List <ast...@li...> Cc: The Cadillac Kid <eld...@ya...> Subject: Re: [Astlinux-users] L2TP on Astlinux for my remote workers I use a little Mikrotik POE router, establishes an L2TP tunnel to a Mikrotik in my NOC which then talks to my Asterisk Server.. phones work perfectly in this manner and voice is encrypted, no SIP ports open to the public side.. handles NAT situations in people's homes pretty well (as long as they dont have junk like EERO) On Monday, September 27, 2021, 06:15:23 AM EDT, Michael Keuter <li...@mk...> wrote: > Am 27.09.2021 um 10:37 schrieb Michael Knill <mic...@ip...<mailto:mic...@ip...>>: > > Hi Group > > Forgive my lack of VPN knowledge here. V85 of Yealink phones supports L2TP. Could this be supported on Astlinux? > It looks like it would be easier to set up on the phone than OpenVPN. > > Regards > > Michael Knill Hi Michael, I looked at it last year, when V85 was released. The Yealink L2TP implementation doesn't even support a static PSK. Only username/password. Michael http://www.mksolutions.info _______________________________________________ Astlinux-users mailing list Ast...@li...<mailto:Ast...@li...> https://lists.sourceforge.net/lists/listinfo/astlinux-users Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....<mailto:pa...@kr....> |
|
From: The C. K. <eld...@ya...> - 2021-09-27 13:27:16
|
for my remote workers I use a little Mikrotik POE router, establishes an L2TP tunnel to a Mikrotik in my NOC which then talks to my Asterisk Server.. phones work perfectly in this manner and voice is encrypted, no SIP ports open to the public side.. handles NAT situations in people's homes pretty well (as long as they dont have junk like EERO)
On Monday, September 27, 2021, 06:15:23 AM EDT, Michael Keuter <li...@mk...> wrote:
> Am 27.09.2021 um 10:37 schrieb Michael Knill <mic...@ip...>:
>
> Hi Group
>
> Forgive my lack of VPN knowledge here. V85 of Yealink phones supports L2TP. Could this be supported on Astlinux?
> It looks like it would be easier to set up on the phone than OpenVPN.
>
> Regards
>
> Michael Knill
Hi Michael,
I looked at it last year, when V85 was released.
The Yealink L2TP implementation doesn't even support a static PSK. Only username/password.
Michael
http://www.mksolutions.info
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: David K. <da...@ke...> - 2021-09-27 11:06:19
|
This may be a little off topic, but a while ago I decided to lock down port 5061 and only let in known IP addresses... which might change, so I needed to open based on DNS lookup. Be aware that DNS service may not be up yet when the firewall custom rules are executed, especially on system boot. My solution was to spawn a background shell task within custom rules (ampersand after brackets ( code ) & ) which waited for DNS to successfully resolve a known URL (like google.com) and when that worked then resolve my desired DNS into a list of IP and then set the rule.... or timeout and log error message. I have also used ipsets but only with ip route not with iptables. It does indeed provide a very useful way of dynamically managing a list of IP addresses without having to change the ip route rules (or in this case the iptables rules). David On Mon, Sep 27, 2021 at 6:33 AM Michael Keuter <li...@mk...> wrote: > That sounds very interesting. I have a customer using AstLinux as Proxy as > well. > Maybe we could document this in the Wiki? > > > Am 27.09.2021 um 02:54 schrieb Lonnie Abelbeck < > li...@lo...>: > > > > Michael, > > > > The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, > so parsing sip.conf using 'sed' or such should be reasonably > straightforward. > > > > BTW, for extra credit, if you combined all the allowed SIP IPs into an > ipset (ex. udp_sip_hosts), you can very efficiently match all of them with > only one rule: > > -- > > iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp > --dport 5060 -j ACCEPT > > -- > > That would allow you to rebuild only the "udp_sip_hosts" ipset when the > sip.conf got changed, without rebuilding the firewall. Though requires > some 'ipset' command knowledge, though not complex at all. > > > > Example 'ipset' usage in AstLinux: > > > https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 > > > > If you only use IPv4 a lot of the example can be simplified. > > > > Lonnie > > > > > > > >> On Sep 26, 2021, at 7:17 PM, Michael Knill < > mic...@ip...> wrote: > >> > >> Thanks Lonnie. > >> > >> Actually now that I think about it, is there any reason why the custom > rule could not parse sip.conf for host=<IP Address> and open up all Public > IP's? > >> It would mean that you would need to restart the firewall every time > you modified sip.conf but I'm sure we could build this into our portal very > simply. > >> > >> Regards > >> Michael Knill > >> > >> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo...> > wrote: > >> > >> Hi Michael, > >> > >> With 300 rules and the same across all your boxes, I would use > /mnt/kd/arno-iptables-firewall/custom-rules to define these. > >> > >> Very similar to the deny_ext_local() example I posted recently, but > the reverse ... pass_ext_local() using -j ACCEPT > >> > >> Without testing, something like ... > >> -- > >> pass_ext_local() > >> { > >> local proto="$1" host="$2" port="$3" > >> > >> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, > Port: $port" > >> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j > ACCEPT > >> } > >> ## uncomment to enable ## > >> #pass_ext_local udp 1.2.3.4 5060 > >> #pass_ext_local tcp 1.2.3.0/24 5061 > >> -- > >> > >> If you only use udp/5060, you could simplify things, maybe only one > "echo" statement and a variable defining all 300 IPs. Generic shell > scripting. > >> > >> Again untested ... > >> -- > >> pass_ext_local_udp_sip() > >> { > >> local host proto="udp" port="5060" IFS > >> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 > 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48" > >> > >> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts" > >> unset IFS > >> for host in $sip_hosts; do > >> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j > ACCEPT > >> done > >> } > >> pass_ext_local_udp_sip > >> -- > >> > >> Alternatively, you could define the sip_hosts variable with a file if > desired. > >> > >> Lonnie > >> > >> > >> > >> > >> > >>> On Sep 26, 2021, at 5:32 PM, Michael Knill < > mic...@ip...> wrote: > >>> > >>> Hi Group > >>> > >>> I'm looking to have a large number of firewall entries in Astlinux > e.g. 300. They would be all the same e.g. I want to open port 5060 from > multiple sites. > >>> Is there an easier/neater way to do this other than lots of firewall > entries in the Firewall Tab? > >>> > >>> Regards > >>> > >>> Michael Knill > >>> Managing Director > >>> > >>> D: +61 2 6189 1360 > >>> P: +61 2 6140 4656 > >>> E: mic...@ip... > >>> W: ipcsolutions.com.au > > > Michael > > http://www.mksolutions.info > > > > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to > pa...@kr.... |
|
From: Michael K. <li...@mk...> - 2021-09-27 10:33:31
|
That sounds very interesting. I have a customer using AstLinux as Proxy as well. Maybe we could document this in the Wiki? > Am 27.09.2021 um 02:54 schrieb Lonnie Abelbeck <li...@lo...>: > > Michael, > > The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward. > > BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule: > -- > iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT > -- > That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all. > > Example 'ipset' usage in AstLinux: > https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 > > If you only use IPv4 a lot of the example can be simplified. > > Lonnie > > > >> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip...> wrote: >> >> Thanks Lonnie. >> >> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's? >> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply. >> >> Regards >> Michael Knill >> >> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo...> wrote: >> >> Hi Michael, >> >> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these. >> >> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT >> >> Without testing, something like ... >> -- >> pass_ext_local() >> { >> local proto="$1" host="$2" port="$3" >> >> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port" >> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >> } >> ## uncomment to enable ## >> #pass_ext_local udp 1.2.3.4 5060 >> #pass_ext_local tcp 1.2.3.0/24 5061 >> -- >> >> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting. >> >> Again untested ... >> -- >> pass_ext_local_udp_sip() >> { >> local host proto="udp" port="5060" IFS >> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48" >> >> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts" >> unset IFS >> for host in $sip_hosts; do >> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT >> done >> } >> pass_ext_local_udp_sip >> -- >> >> Alternatively, you could define the sip_hosts variable with a file if desired. >> >> Lonnie >> >> >> >> >> >>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip...> wrote: >>> >>> Hi Group >>> >>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites. >>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab? >>> >>> Regards >>> >>> Michael Knill >>> Managing Director >>> >>> D: +61 2 6189 1360 >>> P: +61 2 6140 4656 >>> E: mic...@ip... >>> W: ipcsolutions.com.au Michael http://www.mksolutions.info |
|
From: Michael K. <li...@mk...> - 2021-09-27 10:14:12
|
> Am 27.09.2021 um 10:37 schrieb Michael Knill <mic...@ip...>: > > Hi Group > > Forgive my lack of VPN knowledge here. V85 of Yealink phones supports L2TP. Could this be supported on Astlinux? > It looks like it would be easier to set up on the phone than OpenVPN. > > Regards > > Michael Knill Hi Michael, I looked at it last year, when V85 was released. The Yealink L2TP implementation doesn't even support a static PSK. Only username/password. Michael http://www.mksolutions.info |
|
From: Michael K. <mic...@ip...> - 2021-09-27 08:37:30
|
Hi Group Forgive my lack of VPN knowledge here. V85 of Yealink phones supports L2TP. Could this be supported on Astlinux? It looks like it would be easier to set up on the phone than OpenVPN. Regards Michael Knill Managing Director D: +61 2 6189 1360 P: +61 2 6140 4656 E: mic...@ip...<mailto:mic...@ip...> W: ipcsolutions.com.au<https://ipcsolutions.com.au/> [IPC Solutions] Smarter Business Communications |
|
From: Michael K. <mic...@ip...> - 2021-09-27 02:06:28
|
Thanks Lonnie
May even add this to my standard build.
Regards
Michael Knill
On 27/9/21, 10:54 am, "Lonnie Abelbeck" <li...@lo...> wrote:
Michael,
The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward.
BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule:
--
iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT
--
That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all.
Example 'ipset' usage in AstLinux:
https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275
If you only use IPv4 a lot of the example can be simplified.
Lonnie
> On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip...> wrote:
>
> Thanks Lonnie.
>
> Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's?
> It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply.
>
> Regards
> Michael Knill
>
> On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo...> wrote:
>
> Hi Michael,
>
> With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these.
>
> Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT
>
> Without testing, something like ...
> --
> pass_ext_local()
> {
> local proto="$1" host="$2" port="$3"
>
> echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port"
> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
> }
> ## uncomment to enable ##
> #pass_ext_local udp 1.2.3.4 5060
> #pass_ext_local tcp 1.2.3.0/24 5061
> --
>
> If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting.
>
> Again untested ...
> --
> pass_ext_local_udp_sip()
> {
> local host proto="udp" port="5060" IFS
> local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48"
>
> echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts"
> unset IFS
> for host in $sip_hosts; do
> iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
> done
> }
> pass_ext_local_udp_sip
> --
>
> Alternatively, you could define the sip_hosts variable with a file if desired.
>
> Lonnie
>
>
>
>
>
>> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip...> wrote:
>>
>> Hi Group
>>
>> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites.
>> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab?
>>
>> Regards
>>
>> Michael Knill
>> Managing Director
>>
>> D: +61 2 6189 1360
>> P: +61 2 6140 4656
>> E: mic...@ip...
>> W: ipcsolutions.com.au
>>
>> <image001.png>
>> Smarter Business Communications
>>
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li...
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>>
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
>
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Lonnie A. <li...@lo...> - 2021-09-27 00:54:11
|
Michael, The /mnt/kd/arno-iptables-firewall/custom-rules is a basic shell script, so parsing sip.conf using 'sed' or such should be reasonably straightforward. BTW, for extra credit, if you combined all the allowed SIP IPs into an ipset (ex. udp_sip_hosts), you can very efficiently match all of them with only one rule: -- iptables -A EXT_INPUT_CHAIN -m set --match-set udp_sip_hosts src -p udp --dport 5060 -j ACCEPT -- That would allow you to rebuild only the "udp_sip_hosts" ipset when the sip.conf got changed, without rebuilding the firewall. Though requires some 'ipset' command knowledge, though not complex at all. Example 'ipset' usage in AstLinux: https://github.com/astlinux-project/astlinux/blob/d95ba9c3914b135da4440cb95f32af61a41d4650/package/arnofw/aif/bin/arno-iptables-firewall#L4275 If you only use IPv4 a lot of the example can be simplified. Lonnie > On Sep 26, 2021, at 7:17 PM, Michael Knill <mic...@ip...> wrote: > > Thanks Lonnie. > > Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's? > It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply. > > Regards > Michael Knill > > On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo...> wrote: > > Hi Michael, > > With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these. > > Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT > > Without testing, something like ... > -- > pass_ext_local() > { > local proto="$1" host="$2" port="$3" > > echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port" > iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT > } > ## uncomment to enable ## > #pass_ext_local udp 1.2.3.4 5060 > #pass_ext_local tcp 1.2.3.0/24 5061 > -- > > If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting. > > Again untested ... > -- > pass_ext_local_udp_sip() > { > local host proto="udp" port="5060" IFS > local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48" > > echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts" > unset IFS > for host in $sip_hosts; do > iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT > done > } > pass_ext_local_udp_sip > -- > > Alternatively, you could define the sip_hosts variable with a file if desired. > > Lonnie > > > > > >> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip...> wrote: >> >> Hi Group >> >> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites. >> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab? >> >> Regards >> >> Michael Knill >> Managing Director >> >> D: +61 2 6189 1360 >> P: +61 2 6140 4656 >> E: mic...@ip... >> W: ipcsolutions.com.au >> >> <image001.png> >> Smarter Business Communications >> >> _______________________________________________ >> Astlinux-users mailing list >> Ast...@li... >> https://lists.sourceforge.net/lists/listinfo/astlinux-users >> >> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... > > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr.... |
|
From: Michael K. <mic...@ip...> - 2021-09-27 00:17:19
|
Thanks Lonnie.
Actually now that I think about it, is there any reason why the custom rule could not parse sip.conf for host=<IP Address> and open up all Public IP's?
It would mean that you would need to restart the firewall every time you modified sip.conf but I'm sure we could build this into our portal very simply.
Regards
Michael Knill
On 27/9/21, 9:47 am, "Lonnie Abelbeck" <li...@lo...> wrote:
Hi Michael,
With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these.
Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT
Without testing, something like ...
--
pass_ext_local()
{
local proto="$1" host="$2" port="$3"
echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port"
iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
}
## uncomment to enable ##
#pass_ext_local udp 1.2.3.4 5060
#pass_ext_local tcp 1.2.3.0/24 5061
--
If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting.
Again untested ...
--
pass_ext_local_udp_sip()
{
local host proto="udp" port="5060" IFS
local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48"
echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts"
unset IFS
for host in $sip_hosts; do
iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
done
}
pass_ext_local_udp_sip
--
Alternatively, you could define the sip_hosts variable with a file if desired.
Lonnie
> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites.
> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab?
>
> Regards
>
> Michael Knill
> Managing Director
>
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>
> <image001.png>
> Smarter Business Communications
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Lonnie A. <li...@lo...> - 2021-09-26 23:47:19
|
Hi Michael,
With 300 rules and the same across all your boxes, I would use /mnt/kd/arno-iptables-firewall/custom-rules to define these.
Very similar to the deny_ext_local() example I posted recently, but the reverse ... pass_ext_local() using -j ACCEPT
Without testing, something like ...
--
pass_ext_local()
{
local proto="$1" host="$2" port="$3"
echo "[CUSTOM RULE] Pass EXT->Local for Proto: $proto, Host: $host, Port: $port"
iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
}
## uncomment to enable ##
#pass_ext_local udp 1.2.3.4 5060
#pass_ext_local tcp 1.2.3.0/24 5061
--
If you only use udp/5060, you could simplify things, maybe only one "echo" statement and a variable defining all 300 IPs. Generic shell scripting.
Again untested ...
--
pass_ext_local_udp_sip()
{
local host proto="udp" port="5060" IFS
local sip_hosts="1.2.3.4 1.22.33.40 1.22.33.41 1.22.33.42 1.22.33.43 1.22.33.44 1.22.33.45 1.22.33.46 1.22.33.47 1.22.33.48"
echo "[CUSTOM RULE] Pass EXT->Local for UDP/5060 SIP Hosts"
unset IFS
for host in $sip_hosts; do
iptables -A EXT_INPUT_CHAIN -s $host -p $proto --dport $port -j ACCEPT
done
}
pass_ext_local_udp_sip
--
Alternatively, you could define the sip_hosts variable with a file if desired.
Lonnie
> On Sep 26, 2021, at 5:32 PM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites.
> Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab?
>
> Regards
>
> Michael Knill
> Managing Director
>
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>
> <image001.png>
> Smarter Business Communications
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Michael K. <mic...@ip...> - 2021-09-26 22:33:03
|
Hi Group I'm looking to have a large number of firewall entries in Astlinux e.g. 300. They would be all the same e.g. I want to open port 5060 from multiple sites. Is there an easier/neater way to do this other than lots of firewall entries in the Firewall Tab? Regards Michael Knill Managing Director D: +61 2 6189 1360 P: +61 2 6140 4656 E: mic...@ip...<mailto:mic...@ip...> W: ipcsolutions.com.au<https://ipcsolutions.com.au/> [IPC Solutions] Smarter Business Communications |
|
From: Michael K. <mic...@ip...> - 2021-09-07 22:25:05
|
Thanks David We built a Wireguard Peers Tab which makes this easier. Managing IP’s is certainly a little tricky but we will be adding more tools later to make this easier. Regards Michael Knill From: David Kerr <da...@ke...> Reply to: AstLinux List <ast...@li...> Date: Tuesday, 7 September 2021 at 11:37 pm To: AstLinux List <ast...@li...> Subject: Re: [Astlinux-users] Wireguard limits Hi Michael, This is probably best asked over in the wireguard list. There are several commercial VPN providers that are supporting wireguard so I assume that it can handle a high volume of connections... it is likely dependent on the CPU/Memory available at the server side. The challenge with wireguard for a large deployment is managing all the connection secrets and IP addresses -- there is no built-in provision for e.g. dynamic IP address assignment. I've not looked into this at all so there could be tools available to manage that. But once you get into 100's of end points managing this manually could become burdensome. David On Mon, Sep 6, 2021 at 6:54 PM Michael Knill <mic...@ip...<mailto:mic...@ip...>> wrote: Hi Group Just wondering what you would consider is the maximum number of clients for a Wireguard interface that you would feel comfortable with assuming you have enough resources to support the traffic? Im looking at connecting up to 400 remote peers. Regards Michael Knill Managing Director D: +61 2 6189 1360 P: +61 2 6140 4656 E: mic...@ip...<mailto:mic...@ip...> W: ipcsolutions.com.au<https://ipcsolutions.com.au/> [IPC Solutions] Smarter Business Communications _______________________________________________ Astlinux-users mailing list Ast...@li...<mailto:Ast...@li...> https://lists.sourceforge.net/lists/listinfo/astlinux-users Donations to support AstLinux are graciously accepted via PayPal to pa...@kr...<mailto:pa...@kr...>. |
|
From: Michael K. <mic...@ip...> - 2021-09-07 22:22:44
|
Thanks Lonnie. Yep I suspected it wouldn't be an issue but certainly interesting info.
Seems like its pretty much based on resource usage which we are continually monitoring. The traffic over the VPN's is very low as its voice only.
I have plenty of RAM available so no problems there.
Regards
Michael Knill
On 8/9/21, 12:27 am, "Lonnie Abelbeck" <li...@lo...> wrote:
Hi Michael,
Good question ... I did a did a little research.
Two things come to mind, the WireGuard CPU usage per traffic and RAM usage per peer.
WireGuard CPU usage per traffic:
-------------------------------
WireGuard uses the ChaCha20 stream cypher, while very fast just in software, it can take advantage of common CPU features (in order of performance) [1]
--
CPU flags: ssse3 avx2 avx512f avx512vl
--
As a test I would suggest using 'iperf3' across a WireGuard tunnel and using 'htop' to monitor the total CPU usage across all cores. Granted not all the CPU usage will be WireGuard, but it gives you a feel for the overall performance.
Example:
Linode VM 1GB RAM
1-core of AMD EPYC 7601 32-Core Processor @ 2200 MHz
CPU flags: ssse3 avx2
WireGuard: iperf3 approx. 10% CPU usage for 100 Mbps traffic
BTW, If you can subtract the iperf3 CPU usage from above you would get an even better answer.
Example:
Bare metal 4GB RAM
4-core Intel Core i3-6100U @ 2300 MHz
CPU flags: ssse3 avx2
WireGuard: 6% CPU usage for 100 Mbps traffic
WireGuard RAM usage per peer:
----------------------------
In February of 2021, Jason Donenfeld (WireGuard author) made a change "queueing: get rid of per-peer ring buffers". [2]
Quoting Jason:
"Having two ring buffers per-peer means that every peer results in two massive ring allocations. On an 8-core x86_64 machine, this commit reduces the per-peer allocation from 18,688 bytes to 1,856 bytes, which is an 90% reduction. Ninety percent! With some single-machine deployments approaching 500,000 peers, we're talking about a reduction from 7 gigs of memory down to 700 megs of memory."
BTW, this RAM peer reduction was included in WireGuard 1.0.20210219 and AstLinux 1.4.2.
So 400 peers is very small by comparison, and even with AstLinux 1.4.1 and older, 400 peers uses 7.5 MB RAM (750 KB with latest) which should not be an issue in either case.
Lonnie
[1] https://git.zx2c4.com/wireguard-linux-compat/tree/src/crypto/zinc/chacha20/chacha20-x86_64.pl?id=635aa0b75f54eddbcb29fda282d05db4b66f803c
[2] https://git.zx2c4.com/wireguard-linux-compat/commit/?id=635aa0b75f54eddbcb29fda282d05db4b66f803c
> On Sep 6, 2021, at 5:53 PM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> Just wondering what you would consider is the maximum number of clients for a Wireguard interface that you would feel comfortable with assuming you have enough resources to support the traffic?
> Im looking at connecting up to 400 remote peers.
>
> Regards
>
> Michael Knill
> Managing Director
_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users
Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
|
|
From: Lonnie A. <li...@lo...> - 2021-09-07 14:26:43
|
Hi Michael, Good question ... I did a did a little research. Two things come to mind, the WireGuard CPU usage per traffic and RAM usage per peer. WireGuard CPU usage per traffic: ------------------------------- WireGuard uses the ChaCha20 stream cypher, while very fast just in software, it can take advantage of common CPU features (in order of performance) [1] -- CPU flags: ssse3 avx2 avx512f avx512vl -- As a test I would suggest using 'iperf3' across a WireGuard tunnel and using 'htop' to monitor the total CPU usage across all cores. Granted not all the CPU usage will be WireGuard, but it gives you a feel for the overall performance. Example: Linode VM 1GB RAM 1-core of AMD EPYC 7601 32-Core Processor @ 2200 MHz CPU flags: ssse3 avx2 WireGuard: iperf3 approx. 10% CPU usage for 100 Mbps traffic BTW, If you can subtract the iperf3 CPU usage from above you would get an even better answer. Example: Bare metal 4GB RAM 4-core Intel Core i3-6100U @ 2300 MHz CPU flags: ssse3 avx2 WireGuard: 6% CPU usage for 100 Mbps traffic WireGuard RAM usage per peer: ---------------------------- In February of 2021, Jason Donenfeld (WireGuard author) made a change "queueing: get rid of per-peer ring buffers". [2] Quoting Jason: "Having two ring buffers per-peer means that every peer results in two massive ring allocations. On an 8-core x86_64 machine, this commit reduces the per-peer allocation from 18,688 bytes to 1,856 bytes, which is an 90% reduction. Ninety percent! With some single-machine deployments approaching 500,000 peers, we're talking about a reduction from 7 gigs of memory down to 700 megs of memory." BTW, this RAM peer reduction was included in WireGuard 1.0.20210219 and AstLinux 1.4.2. So 400 peers is very small by comparison, and even with AstLinux 1.4.1 and older, 400 peers uses 7.5 MB RAM (750 KB with latest) which should not be an issue in either case. Lonnie [1] https://git.zx2c4.com/wireguard-linux-compat/tree/src/crypto/zinc/chacha20/chacha20-x86_64.pl?id=635aa0b75f54eddbcb29fda282d05db4b66f803c [2] https://git.zx2c4.com/wireguard-linux-compat/commit/?id=635aa0b75f54eddbcb29fda282d05db4b66f803c > On Sep 6, 2021, at 5:53 PM, Michael Knill <mic...@ip...> wrote: > > Hi Group > > Just wondering what you would consider is the maximum number of clients for a Wireguard interface that you would feel comfortable with assuming you have enough resources to support the traffic? > Im looking at connecting up to 400 remote peers. > > Regards > > Michael Knill > Managing Director |
|
From: David K. <da...@ke...> - 2021-09-07 13:36:58
|
Hi Michael, This is probably best asked over in the wireguard list. There are several commercial VPN providers that are supporting wireguard so I assume that it can handle a high volume of connections... it is likely dependent on the CPU/Memory available at the server side. The challenge with wireguard for a large deployment is managing all the connection secrets and IP addresses -- there is no built-in provision for e.g. dynamic IP address assignment. I've not looked into this at all so there could be tools available to manage that. But once you get into 100's of end points managing this manually could become burdensome. David On Mon, Sep 6, 2021 at 6:54 PM Michael Knill < mic...@ip...> wrote: > Hi Group > > > > Just wondering what you would consider is the maximum number of clients > for a Wireguard interface that you would feel comfortable with assuming you > have enough resources to support the traffic? > > Im looking at connecting up to 400 remote peers. > > > > Regards > > > > *Michael Knill* > > Managing Director > > > > D: +61 2 6189 1360 > > P: +61 2 6140 4656 > > E: mic...@ip... > > W: ipcsolutions.com.au > > > > [image: IPC Solutions] > > *Smarter Business Communications* > > > _______________________________________________ > Astlinux-users mailing list > Ast...@li... > https://lists.sourceforge.net/lists/listinfo/astlinux-users > > Donations to support AstLinux are graciously accepted via PayPal to > pa...@kr.... |
63 messages has been excluded from this view by a project administrator.
