iptables for Vonage

Posts: 3 · Posted: Wed Nov 03, 2004 8:29 am Post subject: iptables for Vonage

I am new to iptables and I want to put my Vonage box behind my Linux Firewall.

I am wondering if anybody has some iptables script that already does this that I could learn from.

Thanks so much

Posted: Wed Nov 03, 2004 10:01 pm Post subject:

#Location of iptables binary
IPTABLES="/sbin/iptables"

#External (public) interface
EXTIF="eth0"

#IP address of Vonage device
VONAGE="192.168.0.2"

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --dport 5060:5061 -j DNAT --to $VONAGE
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --dport 53:53 -j DNAT --to $VONAGE
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --dport 69:69 -j DNAT --to $VONAGE
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --dport 10000:10000 -j DNAT --to $VONAGE

Posted: Wed Nov 03, 2004 10:03 pm Post subject:

OOPS! Forgot this line (I'm pulling parts out of a very long script - you wouldn't want all of it.)

-DNAT doesn't do much good if you aren't natting - I use masquerade:

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

Posts: 3 · Posted: Thu Nov 04, 2004 6:37 am Post subject:

Are you sure the last line is correct? According to the Vonage manual, it says the port range to allow through to be 10000:20000, but your iptables has a range 10000:10000. Does the phone actually work like that?

Learned several things though, on how to through iptables to a filter to a specific address.

Thanks!

Posted: Fri Nov 05, 2004 9:02 pm Post subject:

You are right - I have a typo...

It works fine like it is now though... Wink

Guest

If the example given works for your system, I urge you to do a pen test on your system. You may not have the security you think you do.

Posts: 43 · Posted: Sun Feb 27, 2005 2:12 pm Post subject:

With Vonage the TCP connection is opened by the telephone adapter when it boots and is kept continuously open by some keep-alive mechanism. If you watch the adapter lights you see constant activity.

Since the connection is opened from the LAN side of the router then entries in routing tables may be unnecessary. This is what I discovered with my Linksys router, which uses Linux.

Guest

Just get ipcop, it will solve all of your problems.. Nice web GUI too..