I am having problims with getting the firewall configured correctly. I use FreeBSD with pf as my router without any luck from that. I then tried WinRoute Pro (30 day eval) I still have the same problems. Can someone please elighten me on what the proper config would be for pf. Also a second problem I think I'm experencing this problem because of the firewall issues however I may as well throw it out. When making an outboud call from an extension from the inside lan thru a VoIP provider on a sip trunk. When I have been testing and I call my cell phone and then hangup on the extension it will call back my cellphone about 2 minutes later without me making a second call.
Here is my pf.conf file:
# $OpenBSD: pf.conf,v 1.37 2008/05/09 06:04:08 reyk Exp $
#
# See pf.conf(5) for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
ext_if="xl0"
int_if="dc0"
3CX = "192.168.0.100"
PHONE1 = "192.168.0.101"
PHONE2 = "192.168.0.102"
PHONE3 = "192.168.0.103"
table <spamd-white> persist
set skip on lo
scrub in
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr-anchor "relayd/*"
nat on $ext_if from !($ext_if) -> ($ext_if:0)
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
no rdr on $ext_if proto tcp from <spamd-white> to any port smtp
#############################################################################
# 3CX Port Redirect to Phone Switch
#############################################################################
rdr on $ext_if proto udp from any to any port 3478 -> $3CX
rdr on $ext_if proto { tcp udp } from any to any port 5060 -> $3CX
rdr on $ext_if proto { tcp udp } from any to any port 5090 -> $3CX
rdr on $ext_if proto tcp from any to any port 5000 -> $3CX
rdr on $ext_if proto tcp from any to any port 5481 -> $3CX
rdr on $ext_if proto udp from any to any port 9000:9049 -> $3CX
############################################################################
anchor "ftp-proxy/*"
anchor "relayd/*"
block in
pass out
pass quick on $int_if no state
antispoof quick for { lo $int_if }
pass in on $ext_if proto icmp to ($ext_if)
pass in on $ext_if proto tcp to ($ext_if) port ssh
pass in log on $ext_if proto tcp to ($ext_if) port smtp
pass out log on $ext_if proto tcp from ($ext_if) to port smtp
pass out log on $ext_if proto tcp all modulate state flags S/SA
pass out log on $ext_if proto { udp, icmp } all keep state
#############################################################################
# 3CX Ports Pass to Phone Switch
#############################################################################
pass in quick on $ext_if proto udp from any to $3CX port 3478 keep state
pass in quick on $ext_if proto udp from any to $3CX port 5060 keep state
pass in quick on $ext_if proto tcp from any to $3CX port 5060 keep state flags S/SA
pass in quick on $ext_if proto udp from any to $3CX port 5090 keep state
pass in quick on $ext_if proto tcp from any to $3CX port 5090 keep state flags S/SA
pass in quick on $ext_if proto tcp from any to $3CX port 5000 keep state flags S/SA
pass in quick on $ext_if proto tcp from any to $3CX port 5481 keep state flags S/SA
pass in quick on $ext_if proto udp from any to $3CX port 9000:9049 keep state
nat on $ext_if proto udp from $3CX to any -> ($ext_if) static-port
pass out quick on $ext_if proto udp from any to any port 3478 keep state
pass out quick on $ext_if proto udp from any to any port 5060 keep state
pass out quick on $ext_if proto tcp from any to any port 5060 keep state flags S/SA
pass out quick on $ext_if proto udp from any to any port 5090 keep state
pass out quick on $ext_if proto udp from any to any port 9000:9049 keep state
#EOF
Here is what I get when I conduct a firewall check:
3CX Firewall Checker, v1.0. Copyright (C) 3CX Ltd. All rights reserved.
<02:04:31>: Phase 1, checking servers connection, please wait...
<02:04:31>: Stun Checker service is reachable. Phase 1 check passed.
<02:04:31>: Phase 2a, Check Port Forwarding to UDP SIP port, please wait...
<02:04:32>: UDP SIP Port is set to 5060. Response received WITH TRANSLATION 60340::5060. Phase 2a check passed with WARNINGS. Some functionality will be LIMITED.
<02:04:32>: Phase 2b. Check Port Forwarding to TCP SIP port, please wait...
<02:04:32>: TCP SIP Port is set to 5060. Response received WITH TRANSLATION 60340::5060. Phase 2b check passed with WARNINGS. Some functionality will be LIMITED.
<02:04:32>: Phase 3. Check Port Forwarding to TCP Tunnel port, please wait...
<02:04:32>: TCP TUNNEL Port is set to 5090. Response received WITH TRANSLATION 62269::5090. Phase 3 check passed with WARNINGS. Some functionality will be LIMITED.
<02:04:32>: Phase 4. Check Port Forwarding to RTP external port range, please wait...
<02:04:37>: UDP RTP Port 9000. Response received WITH TRANSLATION 59035::9000. Phase 4-01 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9001. Response received WITH TRANSLATION 34894::9001. Phase 4-02 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9002. Response received WITH TRANSLATION 42184::9002. Phase 4-03 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9003. Response received WITH TRANSLATION 60109::9003. Phase 4-04 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9004. Response received WITH TRANSLATION 51856::9004. Phase 4-05 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9005. Response received WITH TRANSLATION 45596::9005. Phase 4-06 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9006. Response received WITH TRANSLATION 40527::9006. Phase 4-07 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9007. Response received WITH TRANSLATION 54496::9007. Phase 4-08 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9008. Response received WITH TRANSLATION 40669::9008. Phase 4-09 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9009. Response received WITH TRANSLATION 58019::9009. Phase 4-10 check passed with WARNINGS. Some functionality may be IMPAIRED.
Application exit code is 53
Here is my pf.conf file:
# $OpenBSD: pf.conf,v 1.37 2008/05/09 06:04:08 reyk Exp $
#
# See pf.conf(5) for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.
ext_if="xl0"
int_if="dc0"
3CX = "192.168.0.100"
PHONE1 = "192.168.0.101"
PHONE2 = "192.168.0.102"
PHONE3 = "192.168.0.103"
table <spamd-white> persist
set skip on lo
scrub in
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr-anchor "relayd/*"
nat on $ext_if from !($ext_if) -> ($ext_if:0)
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
no rdr on $ext_if proto tcp from <spamd-white> to any port smtp
#############################################################################
# 3CX Port Redirect to Phone Switch
#############################################################################
rdr on $ext_if proto udp from any to any port 3478 -> $3CX
rdr on $ext_if proto { tcp udp } from any to any port 5060 -> $3CX
rdr on $ext_if proto { tcp udp } from any to any port 5090 -> $3CX
rdr on $ext_if proto tcp from any to any port 5000 -> $3CX
rdr on $ext_if proto tcp from any to any port 5481 -> $3CX
rdr on $ext_if proto udp from any to any port 9000:9049 -> $3CX
############################################################################
anchor "ftp-proxy/*"
anchor "relayd/*"
block in
pass out
pass quick on $int_if no state
antispoof quick for { lo $int_if }
pass in on $ext_if proto icmp to ($ext_if)
pass in on $ext_if proto tcp to ($ext_if) port ssh
pass in log on $ext_if proto tcp to ($ext_if) port smtp
pass out log on $ext_if proto tcp from ($ext_if) to port smtp
pass out log on $ext_if proto tcp all modulate state flags S/SA
pass out log on $ext_if proto { udp, icmp } all keep state
#############################################################################
# 3CX Ports Pass to Phone Switch
#############################################################################
pass in quick on $ext_if proto udp from any to $3CX port 3478 keep state
pass in quick on $ext_if proto udp from any to $3CX port 5060 keep state
pass in quick on $ext_if proto tcp from any to $3CX port 5060 keep state flags S/SA
pass in quick on $ext_if proto udp from any to $3CX port 5090 keep state
pass in quick on $ext_if proto tcp from any to $3CX port 5090 keep state flags S/SA
pass in quick on $ext_if proto tcp from any to $3CX port 5000 keep state flags S/SA
pass in quick on $ext_if proto tcp from any to $3CX port 5481 keep state flags S/SA
pass in quick on $ext_if proto udp from any to $3CX port 9000:9049 keep state
nat on $ext_if proto udp from $3CX to any -> ($ext_if) static-port
pass out quick on $ext_if proto udp from any to any port 3478 keep state
pass out quick on $ext_if proto udp from any to any port 5060 keep state
pass out quick on $ext_if proto tcp from any to any port 5060 keep state flags S/SA
pass out quick on $ext_if proto udp from any to any port 5090 keep state
pass out quick on $ext_if proto udp from any to any port 9000:9049 keep state
#EOF
Here is what I get when I conduct a firewall check:
3CX Firewall Checker, v1.0. Copyright (C) 3CX Ltd. All rights reserved.
<02:04:31>: Phase 1, checking servers connection, please wait...
<02:04:31>: Stun Checker service is reachable. Phase 1 check passed.
<02:04:31>: Phase 2a, Check Port Forwarding to UDP SIP port, please wait...
<02:04:32>: UDP SIP Port is set to 5060. Response received WITH TRANSLATION 60340::5060. Phase 2a check passed with WARNINGS. Some functionality will be LIMITED.
<02:04:32>: Phase 2b. Check Port Forwarding to TCP SIP port, please wait...
<02:04:32>: TCP SIP Port is set to 5060. Response received WITH TRANSLATION 60340::5060. Phase 2b check passed with WARNINGS. Some functionality will be LIMITED.
<02:04:32>: Phase 3. Check Port Forwarding to TCP Tunnel port, please wait...
<02:04:32>: TCP TUNNEL Port is set to 5090. Response received WITH TRANSLATION 62269::5090. Phase 3 check passed with WARNINGS. Some functionality will be LIMITED.
<02:04:32>: Phase 4. Check Port Forwarding to RTP external port range, please wait...
<02:04:37>: UDP RTP Port 9000. Response received WITH TRANSLATION 59035::9000. Phase 4-01 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9001. Response received WITH TRANSLATION 34894::9001. Phase 4-02 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9002. Response received WITH TRANSLATION 42184::9002. Phase 4-03 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9003. Response received WITH TRANSLATION 60109::9003. Phase 4-04 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9004. Response received WITH TRANSLATION 51856::9004. Phase 4-05 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9005. Response received WITH TRANSLATION 45596::9005. Phase 4-06 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9006. Response received WITH TRANSLATION 40527::9006. Phase 4-07 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9007. Response received WITH TRANSLATION 54496::9007. Phase 4-08 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9008. Response received WITH TRANSLATION 40669::9008. Phase 4-09 check passed with WARNINGS. Some functionality may be IMPAIRED.
<02:04:37>: UDP RTP Port 9009. Response received WITH TRANSLATION 58019::9009. Phase 4-10 check passed with WARNINGS. Some functionality may be IMPAIRED.
Application exit code is 53
