iptables and nftables command not found

[Song]

Hi,

By default the 3cx debian should come with a iptables or nftables right? I tried the two command but with no luck. Anyone know why? this is a new installed 3cx .iso please advise. I'm trying to see if firewall is enabled if so I want to disable it.

 

[Nathan@Voxtelesys]

You should see nftables if you are on the Debian 12 ISO and running as root user.

See active firewall rules:
nft list ruleset

Temporarily remove the firewall rules for troubleshooting:
nft flush ruleset

Restarting 3CX services will put chain phonesystem rules in and restarting nftables will put rules found in the .conf listed below back into place:
systemctl restart 3CX*
systemctl restart nftables

Alternatively, reboot to put the rules back into place.

Config file:
nano /etc/nftables.conf

I hope this points you in the right direction. Be careful with leaving the firewall disabled on devices directly connected to the internet. The defaults are pretty good and are in place for a reason.

 

[Song]

You should see nftables if you are on the Debian 12 ISO and running as root user.

See active firewall rules:
nft list ruleset

Temporarily remove the firewall rules for troubleshooting:
nft flush ruleset

Restarting 3CX services will put chain phonesystem rules in and restarting nftables will put rules found in the .conf listed below back into place:
systemctl restart 3CX*
systemctl restart nftables

Alternatively, reboot to put the rules back into place.

Config file:
nano /etc/nftables.conf

I hope this points you in the right direction. Be careful with leaving the firewall disabled on devices directly connected to the internet. The defaults are pretty good and are in place for a reason.

it does.. thank you so much..

 

[Song]

You should see nftables if you are on the Debian 12 ISO and running as root user.

See active firewall rules:
nft list ruleset

Temporarily remove the firewall rules for troubleshooting:
nft flush ruleset

Restarting 3CX services will put chain phonesystem rules in and restarting nftables will put rules found in the .conf listed below back into place:
systemctl restart 3CX*
systemctl restart nftables

Alternatively, reboot to put the rules back into place.

Config file:
nano /etc/nftables.conf

I hope this points you in the right direction. Be careful with leaving the firewall disabled on devices directly connected to the internet. The defaults are pretty good and are in place for a reason.

disable the firewall worked. I was able to get my PMS connected to 3cx. now how do I add my PMS IP in there so it doesn't block? and allow everything from that IP?

 

[Nathan@Voxtelesys]

To allow all traffic from an IP:

ip saddr 1.1.1.1 counter accept comment "Allow all for PMS"
or
ip saddr 1.1.1.1 ct state new counter packets 0 bytes 0 accept comment "Allow all for PMS"

The second is more secure as it only allows new connections from the IP, not all of its traffic.

I would put this under "# Other services specific" in /etc/nftables.conf

Check your formatting is valid and free of errors before restarting/applying nftables.

nft -c -f /etc/nftables.conf

systemctl restart nftables

 

[Song]

To allow all traffic from an IP:

ip saddr 1.1.1.1 counter accept comment "Allow all for PMS"
or
ip saddr 1.1.1.1 ct state new counter packets 0 bytes 0 accept comment "Allow all for PMS"

The second is more secure as it only allows new connections from the IP, not all of its traffic.

I would put this under "# Other services specific" in /etc/nftables.conf

Check your formatting is valid and free of errors before restarting/applying nftables.

nft -c -f /etc/nftables.conf

systemctl restart nftables

which line should i add this?
Maybe I can just add this port 15374 into the 3cx section?

# Basic IPv4/IPv6 stateful firewall for server/workstation.
table inet filter {
chain input {
type filter hook input priority 0; policy drop;

iifname lo accept comment "Accept any localhost traffic"
ct state { established, related } accept comment "Accept traffic originated from us"

ip daddr 222.0.1.75 counter accept comment "Accept SIP Multicast"
#ip6 nexthdr ipv6-icmp type echo-request accept

ct state invalid drop comment "Drop invalid connections"

tcp dport 113 reject with icmpx type port-unreachable comment "Reject AUTH to make it fail fast"

# 3CX PhoneSystem specific
tcp dport { 80,443,5000,5001,5015,5060,5061,5062,5090 } ct state new counter accept comment "Accept 3CX PhoneSystem TCP ports"
udp dport { 69,5060,5090,7000-10999 } counter accept comment "Accept 3CX PhoneSystem UDP ports"

# Other services specific
udp dport { 137,138 } counter accept comment "Accept NetBIOS"
tcp dport { 139,445 } counter accept comment "Accept TCP/IP MS Networking"

# SSH Bruteforce blacklist
tcp dport ssh ct state new limit rate 15/minute accept comment "Avoid brute force on SSH"

# ICMPv4
ip protocol icmp icmp type {
echo-reply, # type 0
destination-unreachable, # type 3
time-exceeded, # type 11
parameter-problem, # type 12
} accept comment "Accept ICMP"

ip protocol icmp icmp type echo-request limit rate 1/second accept comment "Accept max 1 ping per second"

# ICMPv6
icmpv6 type {
echo-request,
time-exceeded,
destination-unreachable,
parameter-problem,
nd-neighbor-solicit,
nd-router-advert,
nd-neighbor-advert
} accept comment "Accept ICMPv6"

ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate 1/second accept comment "Accept max 1 ping per second"

fib daddr type broadcast drop comment "Drop other broadcast"
fib daddr type multicast drop comment "Drop other multicast"
fib daddr type anycast drop comment "Drop other anycast"
ip daddr 224.0.0.0/4 drop comment "Drop DVMRP"

}

chain forward {
type filter hook forward priority 0; policy drop;