Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Software Maintenance and Hardening

|

233

IAX

5036 UDP

RSVP

3455 TCP and UDP

RTSP

1756, 1757, 4056, 4057 TCP and UDP (RTSP can vary by session like RTP)

So, if you are using SIP, you need to permit inbound SIP signaling on UDP ports

5060 and 5061.

Consider the following iptables policy commands:

iptables –P INPUT –j DROP

iptables –A INPUT –p UDP –-dport 5060-5061 –j ACCEPT

iptables –A INPUT –p UDP --dport 5036 –j ACCEPT

iptables –A INPUT –p UDP –-dport 5004 –j ACCEPT

iptables –P OUTPUT –j ACCEPT

This set of iptables commands manipulates the kernel’s firewall so that only RTP,

IAX, and SIP traffic can be accepted by the server, while all outbound traffic (OUT-

PUT chain) is permitted. This policy is based only on UDP port numbers. If incom-

ing traffic isn’t on ports 5060, 5061, 5036, or 5004, it is dropped. A truly hardened

server would restrict outbound traffic, too.

Check for security risks in the dial-plan

It’s possible to create a dial-plan that unintentionally allows incoming calls to use the

Asterisk server to dial out, possibly placing expensive and resource-consuming out-

bound calls. Examine the sample configuration for Asterisk to see how its designers

recommend separating outbound contexts from inbound ones. Then, make sure

your dial-plan separates them, too. Here’s part of a dial-plan ...