Hi,
I am running a ASTERISK BOX behind a firewall. It is at DMZ .
Now I want to connect to my ASTERISK BOX from Internet. So I want to DNAT. How can I do it?
Pls assume that ip address that connects to Internet on firewall is 1.2.3.4and is attached to eth0. And ASTERISK BOX is 192.168.101.23
Then, What is the rule (PREROUTING) for it? What is the port to DNAT?
I think udp 5060. So I have added below 2 rules . But it does not work at all.
iptables -t nat -A PREROUTING -p udp -i eth0 -d 1.2.3.4 --dport 5060 -j DNAT --to-destination 192.168.101.23:5060 iptables -A FORWARD -p udp -d 192.168.101.23 --dport 5060 -j ACCEPT
Can you help me to solve this issue?
Indunil Jayasooriya wrote:
Hi,
I am running a ASTERISK BOX behind a firewall. It is at DMZ .
Now I want to connect to my ASTERISK BOX from Internet. So I want to DNAT. How can I do it?
Pls assume that ip address that connects to Internet on firewall is 1.2.3.4and is attached to eth0. And ASTERISK BOX is 192.168.101.23
Then, What is the rule (PREROUTING) for it? What is the port to DNAT?
I think udp 5060. So I have added below 2 rules . But it does not work at all.
iptables -t nat -A PREROUTING -p udp -i eth0 -d 1.2.3.4 --dport 5060 -j DNAT --to-destination 192.168.101.23:5060 iptables -A FORWARD -p udp -d 192.168.101.23 --dport 5060 -j ACCEPT
Can you help me to solve this issue?
With all the problems you're having with iptables, I really think you should skip round the issue and install shorewall.
The docs on the website outline how to set up several more-or-less standard scenarious, and most users will find theirs similar to one of those.
Indunil Jayasooriya wrote:
Hi,
I am running a ASTERISK BOX behind a firewall. It is at DMZ .
Now I want to connect to my ASTERISK BOX from Internet. So I want to DNAT. How can I do it?
sip proxy behind nat = major pain in the neck.
Trust me, it will not work. At best, it will work half the time.
Pls assume that ip address that connects to Internet on firewall is 1.2.3.4and is attached to eth0. And ASTERISK BOX is 192.168.101.23
Then, What is the rule (PREROUTING) for it? What is the port to DNAT?
I think udp 5060. So I have added below 2 rules . But it does not work at all.
iptables -t nat -A PREROUTING -p udp -i eth0 -d 1.2.3.4 --dport 5060 -j DNAT --to-destination 192.168.101.23:5060 iptables -A FORWARD -p udp -d 192.168.101.23 --dport 5060 -j ACCEPT
Can you help me to solve this issue?
Yes. Give the asterisk box a proper ip. No natting. Natting on the client side is bad enough, you do not want to add sip proxy behind nat.
You can fill in the variables yourself: iptables -A FORWARD -i $EXTIF -o $INTIF -m multiport -p udp --dport 3478,4569,5060,10000:20000 -s $UNIVERSE -j ACCEPT iptables -t nat -A PREROUTING -i $EXTIF -m multiport -p udp --dport 3478,4569,5060,10000:20000 -j DNAT --to-destination 192.168.101.23
Port 10000:20000 are needed for the RTP traffic, configure it in rtp.conf
Hmm, I suppose one has to do the same on the client side?
I have an asterisk box that was behind a natting router (all ports forwarded to the asterisk box) that could accept connections from other clients but not from one client that was behind a natting router.
Feizhou wrote:
You can fill in the variables yourself: iptables -A FORWARD -i $EXTIF -o $INTIF -m multiport -p udp --dport 3478,4569,5060,10000:20000 -s $UNIVERSE -j ACCEPT iptables -t nat -A PREROUTING -i $EXTIF -m multiport -p udp --dport 3478,4569,5060,10000:20000 -j DNAT --to-destination 192.168.101.23
Port 10000:20000 are needed for the RTP traffic, configure it in rtp.conf
Hmm, I suppose one has to do the same on the client side?
I have an asterisk box that was behind a natting router (all ports forwarded to the asterisk box) that could accept connections from other clients but not from one client that was behind a natting router.
It should work, but you have to setup this client with NAT=yes in the sip.conf.
Theo
-
Feizhou -
Indunil Jayasooriya -
John Summerfield -
Theo Band