Shorewall users - May 2008 - Shorewall - VoIP - SIP Traffic Blocked

Hello All,

I''m trying to use Shorewall for my amateur radio over IP station and
home VoIP network.

My IP connection is via a ADSL PPPOE modem on one Ethernet interface and
my local network on another. Initially I am just trying to get a web
server and Asterisk server working. I am running Centos 5.1 on the
firewall server.

With the attached set up (I followed the guidelines and examples to the
best of my ability), I can reach the web server but the port 5060 SIP
services fail to register through the firewall; I get a SIP registration
timeout. Is it legitimate to use Wireshark on the same machine to look
at the interfaces with Shorewall running? When I do, it doesn''t look
like port 5060 traffic on the LAN is making it to the WAN.

All is well if I revert back to my trusty dd-wrt-54-gl. I''d like to get
the Shorewall firewall working so I can pass it on to the Asterisk
community and enjoy its features.

I couldn''t bring myself to let my mail client mangle the dump. I hope
the attached file makes it.

Thanks,

Steve Henke




-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Steven Henke wrote:
> Hello All,
> 
> I''m trying to use Shorewall for my amateur radio over IP station
and
> home VoIP network.
>
Summary of problem report: VOIP doesn''t work and I haven''t a
clue why --
here''s a dump (no details about what zone the clients are in, what zone
the
Asterisk server is in, just "it doesn''t work").

Analysis: From the dump, I can see that a local client (10.25.163.210) has 
been able to establish a SIP connection to a server (216.143.130.3) so the 
problem is not that Shorewall is blocking anything. It appears that the 
clients are in the ''loc'' zone and the server is in the
''net'' zone. Also, as
recently as 40 minutes before the dump was taken, the firewall configuration 
was so broken that connections were being rejected out of the FORWARD chain 
(see Shorewall FAQ 17).

Summary of response: When VOIP doesn''t work, see Shorewall FAQ 77 
(http://www.shorewall.net/FAQ.htm#id332102).

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key



-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/