Adding an IP address from a phone

[danardf]

Hi.

Today, everyboby know that exist serveral attack from lots of country.
Iptables must be implemented, and you could accept only some trusted IP.
In this case, when a nomadic remote extension want to connect on Elastix server, you must contact your network admin to accpet your public IP.

I made a stuff to can do it from a phone.

Whe can imagine to enabling this function anoly for some phone number knew like some mobiles.
With an inbound route, you can make a route to forwarding this call on this function shuch reserved for only phone numbers (first security)

You must enter your secret code (47822537 like iptables on the keybord.) to access on this service (Second security)

Third security, the guy must know the line number (DID).

Next you must put your pubic IP like that: 210*23*43*11#

To install it, add this line with visudo:
asterisk ALL=NOPASSWD: /sbin/iptables
(Thanks at Bryce Chidester)

Create a file named format_ip.php into /var/lib/asterisk/agi-bin/
own and grp must be asterisk and with 755

format_ip.php

#!/usr/bin/php -q
<?php
exec("/usr/sbin/asterisk -rx 'database get ip accept'",$cmd);
$result = explode(' ',$cmd[0]);
$ip_formated = str_replace('*','.',$result[1]);
exec("/usr/sbin/asterisk -rx 'database put ip accept ".$ip_formated."'");
exit;
?>

Add this context on extension_custom.conf

[IpTables]
exten => s,1,Answer()
exten => s,n,Playback(please-enter-your)
exten => s,n,Read(PASSWORD,access-code,8,,6,5)
exten => s,n,GotoIf($["${PASSWORD}" = "47822537"]?:lbl_IpTables_0)
exten => s,n,Playback(please-enter-your&letters/i&letters/p)
exten => s,n,Read(IP_TABLES,address,16,,6,5)
exten => s,n,Set(DB(ip/accept)=${IP_TABLES})
exten => s,n,AGI(format_ip.php)
exten => s,n,Set(IP_TABLES=${DB(ip/accept)})
exten => s,n,System(sudo /sbin/iptables -I INPUT 1 -s ${IP_TABLES} -j ACCEPT)
exten => s,n,Playback(address&recorded)
exten => s,n,System(echo "[${STRFTIME(${EPOCH},,%Y-%m-%d %H:%M:%S)}] ${CALLERID(num)} has added this ip address ${IP_TABLES}" >> /var/log/asterisk/add_iptables.log)
exten => s,n(lbl_IpTables_1),Hangup()
exten => s,n(lbl_IpTables_0),Playback(please-try-again-later)
exten => s,n,Goto(lbl_IpTables_1)

Now just to declare this application on Freepbx.

Enjoy

 

[elandivar]

Great work Franck, one of the most interesting security ideas i have heard in recent times!!!

 

[danardf]

Hi Edgard

Thanks a lot.

This stuff could be included by Alberto in his module.
Just to change the password, use a dial plan number, and enable or disable this function.

Regards

PS: See the vdp file attached.
[file name=iptables.vdp size=2312]http://asterisk.agmp.org/uploads/iptables.vdp[/file]

 

[danardf]

I do a mistake about the iptables cmd line.
Just modify this line:

exten => s,n,System(sudo /sbin/iptables -A INPUT -s ${IP_TABLES} -j ACCEPT)

by this line.

exten => s,n,System(sudo /sbin/iptables -I INPUT 1 -s ${IP_TABLES} -j ACCEPT)

Indeed, every trusted ip was included after the drop line.

Regards

 

[danardf]

Just small bug when you launch IpTables under Elastix 1.6.2.
The Read cmd can read only one prompt file under Asterisk 1.4 engine.
file1&files2 putting only file1

So, you must add a playback() cmd before each Read line.

After this modification, it works fine.

Regards

 

[danardf]

Hi.

I updated every early posts with some fixed bugs like the compatibility with all Asterisk version (1.4, 1.6 & 1.8).
Adding a log file with the date, time, callerid(num), ip address.

Displaying a news diagram.

The vdp file is downloadable directly from my server without zip extension.

Regards