Re: Problems setting up Vonage VoIP with FreeBSD + ipfilter

From: Michael W. Oliver (michael_at_gargantuan.com)
Date: 05/21/04

  • Next message: Muhammad Reza: "named in sandbox" 
    Date: Thu, 20 May 2004 21:32:40 -0400
To: Adam McLaurin <adam.mclaurin@gmx.net>

    On 2004-05-20T20:16:57-0400, Adam McLaurin wrote:
    > So I got set up with Vonage VoIP, which I am really excited to have, but
    > I am having a heck of a time getting it set up behind my FreeBSD box.
    >
    > My network configuration is as follows:
    > Cable modem --> FreeBSD 5.2.1-R (ipf/ipnat) --> 8-port D-Link Switch -->
    > Internal network
    >
    > The Vonage Voice Terminal (VT) is on port 8 of the switch
    >
    > So basically what I need to do is forward the following UDP ports to the
    > VT (which I will be assigning 192.168.56.22).
    > 53
    > 69
    > 5060-5061
    > 10000-20000

    Note that you don't need to allow incoming traffic to reach the VT on
    ports 53 or 69, you need to allow the VT to open outbound connections on
    those ports (DNS and TFTP, respectively). In addition, I had to open up
    outbound UDP on port 123 (NTP) as well, because even though I run NTP
    internally, the ATA's configuration is locked down and can't be changed
    (thanks Vonage :( ).

    > So in my ipf.rules I added the following:
    > pass in quick on dc0 proto udp from any to any port 9999 >< 20001
    > pass in quick on dc0 proto udp from any to any port = 53
    > pass in quick on dc0 proto udp from any to any port = 69
    > pass in quick on dc0 proto udp from any to any port = 5060
    > pass in quick on dc0 proto udp from any to any port = 5061
    >
    > And in the ipnat.rules I added:
    > rdr dc0 146.115.126.186/32 port 53 -> 192.168.56.22 port 53 udp
    > rdr dc0 146.115.126.186/32 port 69 -> 192.168.56.22 port 69 udp
    > rdr dc0 146.115.126.186/32 port 5060 -> 192.168.56.22 port 5060 udp
    > rdr dc0 146.115.126.186/32 port 5061 -> 192.168.56.22 port 5061 udp

    Also note that I am using IPFW2+NATD, but this looks ok (except for the
    53 and 69, but we already talked about that :)

    > Now, I'm not 100% certain the rdr's are correct (I'm not too comfortable
    > with ipnat, and the docs confuse the hell out of me).
    >
    > However, I have absolutely no idea how to forward all UDP ports from
    > 10000-20000 without manually writing a rule for each port (which seems
    > to be a very bad idea just for the processing overhead on each incoming
    > UDP packet).

    Ok, I had the same problem, but I discovered that my ATA (I got mine
    when they sent out Cisco Analog Telephone Adapters, hence ATA) always
    uses port 10000, and the Vonage-side of the connection is always port
    11000. I have been using the service for more than a year now and I
    haven't had a single occasion where the connection was anything other
    than what I just described.

    > Can someone guide me through this? There aren't any Vonage How-To's for
    > FreeBSD yet, so I'm pretty much flying blind.

    Like I said, I am using IPFW2+NATD, and the dummynet pipe/queue
    configuration works very well for giving my VoIP traffic plenty of
    bandwidth. I don't know if ipf has the same or similar facility, but it
    is worth looking into. I hope to soon be running pf+altq :D

    Hope this helps! 

    -- 
Mike
perl -e 'print unpack("u","88V]N=&%C=\"!I;F9O(&EN(&AE861E<G,*");'

  • Next message: Muhammad Reza: "named in sandbox"

    Relevant Pages

    • UDP ports for Internet Explorer
      ... Does anybody know how UDP ports are assigned to IE? ... use the TCP/UDP filtering to allow only certain ports to be open. ... For example I've allowed TCP 3389 for Remote Desktop, ...
      (microsoft.public.windowsxp.network_web)
    • Re: TCP/IP filter & SMTP
      ... Also, if you are using MS SMTP server or Exchange server, you'll need to ... and I can't find any other ports that SMTP might use. ... > If I enable all UDP ports, ...
      (microsoft.public.inetserver.iis.security)
    • Re: SBS2003 Outlook HTTP/RPC not working
      ... Do you have rpc listening on any UDP ports? ... I also still have TCP ...
      (microsoft.public.windows.server.sbs)
    • Re: [Fwd: cvs commit: ports/dns/bind9 Makefile distinfo ports/dns/bind94 Makefile distinfo ports/dns
      ... try to use UDP ports which are administratively blocked (e.g. ports ... That option *only* affects UDP queries, ... control for the UDP ports to be used. ... but it's the same for all 9.x versions of BIND. ...
      (FreeBSD-Security)
    • Re: Port Scans
      ... for tcp 'listening' means it is waiting for a connection on that port. ... the *:* is for udp ports that are listening, ... >>this group for other questions about ports. ...
      (microsoft.public.security)