Archive for August, 2010

How to setup IPTables for Asterisk 1.6.2 on CentOS 5.4

August 29, 2010 Comments off

# iptables -P INPUT ACCEPT
# iptables -F
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
# iptables -A INPUT -p tcp –dport 22 -j ACCEPT
# iptables -P INPUT DROP
# iptables -P FORWARD DROP
# iptables -P OUTPUT ACCEPT

iptables -P INPUT ACCEPT – This sets the default policy on the input chain to ACCEPT, so we don’t lock ourselves out if we’re connected remotely via ssh.

iptables -F – This is the command to flush the current rule set and only use the defaults (which we just set to ACCEPT on inbound connections, which gives us a blank slate to work with without locking us out of our own box).

iptables -A INPUT -i lo -j ACCEPT – This is a simple rule to allow all access from the loopback adapter.  The -A switch means we’re Appending a new rule to the chain.  -i means this rule has to do with all traffic flowing through a network interface (in this case, the lo, or loopback, interface).  -j means to Jump to the ACCEPT action.  A lot of applications expect to be able to talk with the loopback adapter, so be sure to include this rule.

iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT – You should already recognize some parts of this line.  What’s new here is the -m switch, which we use to load a module (in this case, the ’state’ module). The state module is able to examine the state of a packet and determine if it is NEW, ESTABLISHED or RELATED. NEW refers to incoming packets that are new incoming connections that weren’t initiated by the host system. ESTABLISHED and RELATED refers to incoming packets that are part of an already established connection or related to an already established connection.

iptables -A INPUT -p tcp –dport 22 -j ACCEPT – This rule is a very important rule, at least it’s important if you’re connecting remotely!  This rule is appended to the INPUT chain and says that any packets coming in on the tcp protocol (-p), on port 22 (–dport 22), should be accepted.  Port 22 is of course the default ssh port.  If you’ve changed your ssh port in your sshd_config, you would of course alter this line accordingly.

iptables -P INPUT DROP – Remember our first rule?  When we set the default policy for the INPUT chain to ACCEPT?  This line changes the default policy for the INPUT chain back to DROP, which is what is required if you want to actually block traffic coming into your server.  If you correctly set the previous line to allow ssh traffic, you shouldn’t lock yourself out at this point.

iptables -P FORWARD DROP – This rule is pretty much the same as the previous one, except that we’re setting the default policy for the FORWARD chain, which handles traffic flowing through our system from one interface to another (i.e if you’re using your server as a router, which in this case we’re not).

iptables -P OUTPUT ACCEPT – And finally, this rule allows all traffic to flow outwards from your server.

Now that we’ve got these new rules, we should save them so that they’re applied the next time we restart the iptables service.

# iptables-save
# service iptables save

If you want to learn more about iptables and the various switches available to you, I recommend you read the IPTables How-To on the CentOS wiki I linked to earlier.  There’s a lot of useful information there.

Now, if you want to run asterisk on your server that you’ve got protected with IPTables, you’ll need to setup a few specific rules.  Let’s go over those here:

# iptables -A INPUT -p udp -m udp –dport 5060 -j ACCEPT
# iptables -A INPUT -p udp -m udp –dport 10000:20000 -j ACCEPT
# iptables -A INPUT -p udp -m udp –dport 4000:4999 -j ACCEPT
# iptables -A INPUT -p udp -m udp –dport 4569 -j ACCEPT
# iptables -A INPUT -p tcp -m tcp –dport 5038 -j ACCEPT

Let’s take a look at what we’re doing here:

iptables -A INPUT -p udp -m udp –dport 5060 -j ACCEPT – This rule and the next are needed if you have SIP endpoints or a SIP connection to your ITSP.  UDP port 5060 is the port used for SIP traffic.  If you don’t want to accept SIP traffic from anyone, anywhere, you can further restrict this line by adding source IP addresses or networks with the -s switch:

# iptables -A INPUT -p udp -m udp -s –dport 5060 -j ACCEPT
# iptables -A INPUT -p udp -m udp -s –dport 5060 -j ACCEPT
# iptables -A INPUT -p udp -m udp -s –dport 5060 -j ACCEPT

iptables -A INPUT -p udp -m udp –dport 10000:20000 -j ACCEPT – This rule goes hand in hand with the previous rule.  This is the rule that allows RTP traffic.  By default, asterisk uses a large range of rtp ports to establish rtp connections, and you have to set a large range of udp ports as well.  If you’re uncomfortable with this idea, you can trim down on the number of ports used for your RTP traffic in asterisk’s /etc/asterisk/rtp.conf file.

# cat /etc/asterisk/rtp.conf

# iptables -A INPUT -p udp -m udp –dport 10000:10050 -j ACCEPT

A good rule of thumb is to have 4 ports per concurrent call you plan on having flow through your system, plus 10% for breathing room.  So if you plan on having at most 10 concurrent calls on your system at any time, configure asterisk to use 44 ports (10 calls x 4 ports = 40, 40 * 1.10 = 44).  Be sure the range in your firewall matches the range in your rtp.conf file.

iptables -A INPUT -p udp -m udp –dport 4000:4999 -j ACCEPT – This rule is used to allow udptl traffic, which is a T.38 transport protocol.  If you don’t plan on doing faxing, you can skip this rule.  I don’t have any handy rules of thumb for the number of udptl ports used per T.38 fax, so you may want to leave this rule at it’s default.  You can try changing it down, but until I hear otherwise from the folks at Digium, I’ll leave the defaults as the recommended.

iptables -A INPUT -p udp -m udp –dport 4569 -j ACCEPT – This rule is for IAX2 connections.  IAX2 is another VoIP protocol, much like SIP.  Unlike SIP, it only needs one port open on your firewall for both control traffic and audio / data traffic.  You don’t need to open any ranges of ports to allow multiple concurrent calls using IAX2 either, as it’s all handled through the one port.  If you plan on making any IAX2 connections through your firewall, be sure to open this port.

iptables -A INPUT -p tcp –dport 5038 -j ACCEPT – This rule is to allow connections to the Asterisk Manager Interface, or AMI.  If you’re not accessing AMI remotely, you should leave this rule off your firewall.

Now that you’ve got your rules in place, go ahead and test your system.  If everything seems to be working properly, save your new rules to your iptables config by running one of the following commands:

# iptables-save
# service itpables save

Categories: Asterisk

Your Skype Name and password were not recognized. Please check and try again

August 16, 2010 2 comments

Writing this post just in case if someone experienced the same problem i had, and trying to find the solution through search engine.

I have been using skype for many years. But i can’t login this afternoon, it says:”Your Skype Name and password were not recognized. Please check and try again”.

First i tried the log into my account through website, i logged in successfully,  so im sure my username and password are correct. Then i tried to login skype on my machine again… same result…. after a while i tried to use my friend’s skype account to login on my machine……. Same result!!~~~!~ So there got be something to do with my own computer.

I don’t have firewall on my PC so i don’t think it’s the problem will ports. I did a full scan on my computer, no virus..

At this point i thought my account maybe got suspended, so i tried to login my account from another PC, surprised me!~~!~ i can login on another machine, but not mine.

I did search on line, just realized there thousands of people experiencing the same thing, i tried all method provided by them, still the same result!~ Your Skype Name and password were not recognized. Please check and try again!!!\

After a while, i reminded i have been seen a post regarding skype blocks people hard drive ID due people use their account in improper way. So i find a tool online changed my hard drive ID.

WOW!~ I logged in successfully !!

If you are the one have the same problem, feel free to try my method ~!~ Good luck!

Categories: Uncategorized

Useful commands

August 14, 2010 Leave a comment

extract files:   tar -zxvf

Categories: Linux

Yum install asterisk on CentOS

August 14, 2010 19 comments
Use the text editor of your choice to create a new file named “centos-asterisk.repo” in the “/etc/yum.repos.d” folder. Add the following text to the file:
name=CentOS-$releasever – Asterisk – Tested
name=CentOS-$releasever – Asterisk – Current
Save the new file and create another named “centos-digium.repo” and insert the following text:
name=CentOS-$releasever – Digium – Tested
name=CentOS-$releasever – Digium – Current

yum install asterisk16 asterisk16-configs asterisk16-voicemail dahdi-linux dahdi-tools libpri

Categories: Asterisk