Quick CSF firewall setup

[DaveD]

I have put together a quick guide to install and setup CSF firewall for those that wish to use it.

It is a quick guide only but it will lock down your systems

Ok it will not let me upload the 143KB pdf file forums have a 120KB limit

 

[Bob1]

Re:Quick firewall setup

Dave,

Do you want me to load it onto ElastixConnection in the interim....

Until we can get Palosanto to place in Elastix docs area??

Just a an offer....

Regards

Bob

 

[DaveD]

Re:Quick firewall setup

Thanks Bob email sent

 

[Bob1]

Re:Quick firewall setup

DaveD,

Thanks for the email.

Your document is available for anyone to download at

http://www.elastixconnection.com.au/ind ... Itemid=120

Regards

Bob

 

[DaveD]

Re:Quick firewall setup

Thanks Bob

Should help a few out

 

[Bob1]

Re:Quick firewall setup

Sure will...it just introduced me to CSF.....looking into it further..

However it also points out a process that needs to be improved which is document submission to the Elastix web site. Will bring it up, as Elastix is only more enriched with documents like this...

Regards

Bob

 

[DaveD]

Re:Quick firewall setup

yes CSF is great I actually have a few boxes sitting on DMZ zones and nothing can get to them except for what I allow.
The other good thing is when you allow the ip in ,it gives access to all ports but only for that ip.

I also had a few remote phones with dynamic ip's and needed a solution, Csf was the perfect fit.
I could get a dyndns name and put it into their routers, and set it to update every 10min, which would in turn allow their ip through.


Dave

 

[Amphibian]

Re:Quick firewall setup

For CSF & Webmin did you create a directory for each one or just downloaded it to the root of Elastix box?


Amphibian

 

[DaveD]

Re:Quick firewall setup

ll I did was download the files as I presented in the PDF ,it will create everything you need

 

[Amphibian]

Re:Quick firewall setup

DaveD,

Thanks for the info, all went well on install.



Amphibian

 

[Amphibian]

Re:Quick firewall setup

Looks like I spoke too soon.


I installed and followed directions as listed.

After setting up as directed I'm now locked out of my Elastix box GUI. I went in through a terminal window and did a csf stop and that allowed me to get into the webmin but I'm still not able to get into anything else including all my softphones and PAP2 from within my network.

I went to csf.allow and entered my lan ip bank, went into csf.ignor and did the same.

Any ideas DaveD?


Amphibian

 

[DaveD]

Re:Quick firewall setup

All you should need to enter is like 192.168.1.0/24 into allow

Replace for whatever ip range you use

 

[Amphibian]

Re:Quick firewall setup

DaveD,

That's what I had in there. I went in and took it out and just entered the lan ip for the puter I was on and it worked. So I have just entered the lan ip's for all the units on seperate lines and its all good for now. I will get into it tomorrow and figure out whats going on. But for now, makes for great testing tomorrow.

Thanks for the info on this software. You are correct, it is easy to set up. Elastix should have this one installed for dummies like me.

It's 2 a.m. here, going to call it a night.

Have a great day there,

Amphibian

 

[DaveD]

Re:Quick firewall setup

Amphibian

Don't forget to add your sip providers ip address as well for any trunks or you will have no registration for the trunk

 

[Amphibian]

Re:Quick firewall setup

DaveD,

Currently it is strictly for testing and playing with. No VoIp trunks at this point.

When this one goes into production it will be to replace all the tone remotes and controllers stacked on my desk for our two-way radio voice & data communications throughout the state. Will be switching them over from dedicated loop lines to VoIp. That's why I needed the iptables working right.

Have a great day,


Amphibian

 

[RustBoy]

Re:Quick firewall setup

Amphibian

Don't forget to add your sip providers ip address as well for any trunks or you will have no registration for the trunk

My sip provider has given us a domain instead of an IP address. When I try to enter it I get an error telling me that it's not valid. How can I resolve this issue?

 

[RustBoy]

Re:Quick firewall setup

I was able to get the IP addresses from our SIP provider. If I want to allow a block of 10 IP addresses (for example, 192.168.1.25 - 192.168.1.35) would I type something like this: 192.168.1.25/10 ?

 

[RustBoy]

Re:Quick firewall setup

Our hardware phones are working in both directions but we are having some issues getting our softphones to work after installing the CSF firewall. We can call out on the softphones but the inbound calls are going straight to voicemail.

I have tried to toggle the firewall on and off but even when it's turned off the softphones are still not answering inbound calls.

When I view our phones in the "Flash Operator Panel" the hardware phones are solid, the software phones are half dimmed and the inactive extensions are fully dimmed.

Any suggestions?

 

[DaveD]

Re:Quick firewall setup

If you have turned CSF off and you are still getting issues ,you have another problem not related to CSF firewall.

Check firewall settings on PC's with softphones

 

[RustBoy]

Re:Quick firewall setup

I discovered that changes that I made to our router just prior to installing the CSF firewall were the cause of the softphone problem that we were having.