Quick CSF firewall setup

[RustBoy]

Re:Quick firewall setup

We have a few iPhone users that are running the "GroundWire" softphone app when they are out of the office. Is there a way to get these working with the CSF firewall, perhaps by making access exceptions based on their MAC addresses?

 

[DaveD]

Re:Quick firewall setup

Yes
You can use dyndns names in CSF firewall and set it to check for new ip's every 5 min, so when they leave the office it will take approx 5-7 min for CSF to add the ip to allow list

 

[RustBoy]

Re:Quick firewall setup

Yes
You can use dyndns names in CSF firewall and set it to check for new ip's every 5 min, so when they leave the office it will take approx 5-7 min for CSF to add the ip to allow list

Thank you Dave!

I Googled DynDNS and I understand what it does. Is DynDNS something that we can run on our own server or do we need to pay for this service?

Can I use this company that provides the service for free or does it only work with DynDNS: http://freedns.afraid.org/

Is this the official documentation for CSF firewall?
http://configserver.com/free/csf/readme.txt

Sorry for all the newbie questions.

 

[DaveD]

Re:Quick firewall setup

Rustboy

From memory you get a number of dyndns names for free, after that you start paying.I use the paid service and think it was something like $29/year for 32 hosts

Not sure about using freedns as I think CSF is only set for dyndns

Yes that is the document that comes with CSF as a guideline

Dave

 

[RustBoy]

CSF firewall is preventing Elastix from sending voicemail notification emails. Can anyone tell me how we can open up the firewall to allow these to go through?

 

[RustBoy]

I finally got it working by opening port 587 on TCP_OUT in the CSF firewall.

 

[topgun]

I just installed CSF using the instructions.

I have allowed the IP addresses of my SIP providers, my remote office and the local LAN IP range.

Inbound calls work without incident.

Outbound calls complete, but there is no audio.
If I disable the firewall with call in progress the audio is heard.
If I disable the firewall outbound calls work without issue.

Please help!

Two days now working through this.

Thanks

 

[DaveD]

Did you add the required ports to UDP outbound in CSF

 

[topgun]

Thanks, that was the answer.

The RTP stream was coming and going to an IP different than the registration server so it was being blocked. I opened the ports 10,001-25,000 and all is working.

 

[dolesec]

nice document but nothing specific on LFD blocking brute force attacks on sip passwords ...

i found a previous post by dicko on the subject and copied his regex but its not capturing the failed attempts

i prefer to use CSF at this point as its more comprehensive than simply running fail2ban

does anyone have LFD protecting the system from brute force password attacks and would they share it with the board ?

 

[DaveD]

If your using CSF to lock SIP to your provider by IP address only ,you really don't need to worry about the attempts on your system so much.

 

[dolesec]

good answer for a static system ...

but i use the bria sip client on my iphone and ipad for my test system and have many remote extensions on my business systems - manually managing their dynamic addresses seems like a losing proposition

 

[DaveD]

I would be allowing only a certain IP range or use CSF to block countries you have no connections in.

 

[dolesec]

so LFD cant detect/block sip brute force attacks ?

 

[DaveD]

It would detect it as a ddos attack,if unsure run fail2ban in conjunction with it

 

[netizen]

Hi there,

I am having the same problem as dolesec.
Has someone a solution to the problem he is mentioning?
Dolesec, have you solved it?

 

[agidi1]

Dave can you elaborate a bit on this? how can we protect from countries we have no connections from?
all pointers are appreciated. thanks

 

[DaveD]

Under country code lists

CC_ALLOW_FILTER = countries you wish to allow eg.( AU,EU )

Use the above as it still follows your filter rules but will drop any countries not listed

 

[JordanLCN]

Hi there I have used this same exact code and it does block some attempts. Im not sure yet but I have seen temp bans on my system comming from this script. Though Normally I just block the whole IP block when I see one.

Maybe someone more knowledgeable in regex scripting start looking into this. Or maybe ask in the CSF forums since it is a csf function not an Elastix Function.

I havent edited dicko's script at all so I would have the same one as yours. But there are some typos's there typical dicko fashion. Like where to exactly add the script in the regex.

 

[vladv1]

Re:Quick firewall setup

All you should need to enter is like 192.168.1.0/24 into allow

Replace for whatever ip range you use

Hello friends, need little bit of help
if my ip range something like xx.yy.0.0-xx.yy.255.255. what would I enter into allow list?
Thanks.