Cisco firewall guys, another question...

[WiKDMoNKY]

I have a client that currently has a RV082 and I am moving them over to a RV325, but I am trying to work out some settings issues on the RV082 first.

They have a Fonality SIP/VOIP phone system that has been attacked a few times lately which totally brings down the phone server. I spoke to Fonality support and they told me I need to whitelist the VOIP/SIP ports to only allow traffic from the ISP (http://help.fonality.com/Troubleshoo...urity_Settings). I created a couple of access rules as they told me/the faq explained and the phones stopped working. The phone system works fine when I forward ports 5060 and 10000-20000 to the internal phone server IP address, but as soon as I enable 2 access rules, the system stops working. I noticed in the logs, I am getting internal connections refused when the access rules are enabled, so I decided to add access rules for the LAN to WAN, still no go. What am I missing? Do I have them out of order? Do I need to remove one of the default deny rules?



Thank you for any guidance!

[jmlivingston]

The VoIP that you're trying to allow through the firewall, is that from an internet-based VoIP provider or is it for remote phones?

How do you have the various services defined? The screenshot you showed doesn't really show that very well.

Was the phone system setup to handle the NAT? You can't just NAT sip traffic as it carries port information in the packet data. Either the firewall has to be able to inspect the packet and rewrite it or the server has to be able to handle it correctly.

[WiKDMoNKY]

We have the Fonality phone server local at our office and we will have 1 remote phone in the near future. I have brought a phone home with me and was able to work with the server remotely when the ports are forwarded, but when I enable the access rules (and disable forwarding), it all stops working. No NAT'ing that I know of.


Here is a screenshot of the forwards/services

The VoIP that you're trying to allow through the firewall, is that from an internet-based VoIP provider or is it for remote phones?

How do you have the various services defined? The screenshot you showed doesn't really show that very well.

Was the phone system setup to handle the NAT? You can't just NAT sip traffic as it carries port information in the packet data. Either the firewall has to be able to inspect the packet and rewrite it or the server has to be able to handle it correctly.

[ocabj]

When you see the dropped packets in the logs, what IP are they coming from? Does that IP match the allow rule for source?

[ocabj]

Note that in your screen cap, rules 3 and 4 are kind of redundant since you have that 5th rule which allows all internal LAN traffic regardless of port.

[WiKDMoNKY]

They are internal IP's that show connection refused. That is what I don't understand. When I disable the access rules, I don't see any connections refused errors in the logs.

RV082 System log

Aug 26 0411 2014 Connection Refused - Policy violation TCP 192.168.16.152:64271->192.168.16.10:5222 on ixp0
Aug 26 0411 2014 Authentication Success HTTP Basic authentication succeeded for user: admin
Aug 26 0439 2014 Connection Refused - Policy violation UDP 192.168.16.20:1127->239.255.255.250:1900 on ixp0
Aug 26 0441 2014 Authentication Success HTTP Basic authentication succeeded for user: admin
Aug 26 0454 2014 Connection Accepted UDP 198.101.xx.xx:5060->192.168.16.10:5060 on ixp1
Aug 26 0454 2014 Connection Accepted UDP 198.101.xx.xx:5060->192.168.16.10:5060 on ixp1
Aug 26 0458 2014 Connection Accepted UDP 198.101.xx.xx:21847->192.168.16.10:17089 on ixp1
Aug 26 0411 2014 Authentication Success HTTP Basic authentication succeeded for user: admin
Aug 26 0531 2014 Connection Refused - Policy violation TCP 192.168.16.10:5222->192.168.16.186:54167 on ixp0
Aug 26 0538 2014 Authentication Success HTTP Basic authentication succeeded for user: admin
Aug 26 0538 2014 Authentication Success HTTP Basic authentication succeeded for user: admin
Aug 26 0554 2014 Connection Refused - Policy violation UDP 192.168.16.137:65299->224.0.0.252:5355 on ixp0
Aug 26 0501 2014 Authentication Success HTTP Basic authentication succeeded for user: admin
Aug 26 0501 2014 Authentication Success HTTP Basic authentication succeeded for user: admin
Aug 26 0506 2014 Connection Refused - Policy violation UDP 192.168.16.137:137->192.168.16.255:137 on ixp0
Aug 26 0512 2014 Authentication Success HTTP Basic authentication succeeded for user: admin

RV082 Incoming Log

Aug 26 0439 2014 Connection Refused - Policy violation UDP 192.168.16.20:1127->239.255.255.250:1900 on ixp0
Aug 26 0454 2014 Connection Accepted UDP 198.101.xx.xx:5060->192.168.16.10:5060 on ixp1
Aug 26 0454 2014 Connection Accepted UDP 198.101.xx.xx:5060->192.168.16.10:5060 on ixp1
Aug 26 0458 2014 Connection Accepted UDP 198.101.xx.xx:21847->192.168.16.10:17089 on ixp1
Aug 26 0458 2014 Connection Accepted UDP 198.101.xx.xx:21847->192.168.16.10:17089 on ixp1
Aug 26 0531 2014 Connection Refused - Policy violation TCP 192.168.16.10:5222->192.168.16.186:54167 on ixp0
Aug 26 0531 2014 Connection Refused - Policy violation TCP 192.168.16.10:5222->192.168.16.186:54167 on ixp0
Aug 26 0531 2014 Connection Refused - Policy violation TCP 192.168.16.10:5222->192.168.16.186:54167 on ixp0
Aug 26 0554 2014 Connection Refused - Policy violation UDP 192.168.16.137:65299->224.0.0.252:5355 on ixp0
Aug 26 0554 2014 Connection Refused - Policy violation UDP 192.168.16.137:65299->224.0.0.252:5355 on ixp0
Aug 26 0554 2014 Connection Refused - Policy violation UDP 192.168.16.137:65299->224.0.0.252:5355 on ixp0
Aug 26 0506 2014 Connection Refused - Policy violation UDP 192.168.16.137:137->192.168.16.255:137 on ixp0
Aug 26 0506 2014 Connection Refused - Policy violation UDP 192.168.16.137:137->192.168.16.255:137 on ixp0
Aug 26 05:15:50 2014 Connection Refused - Policy violation UDP 192.168.16.148:53107->224.0.0.252:5355 on ixp0
Aug 26 05:15:50 2014 Connection Refused - Policy violation UDP 192.168.16.148:53107->224.0.0.252:5355 on ixp0
Aug 26 05:15:50 2014 Connection Refused - Policy violation UDP 192.168.16.148:53107->224.0.0.252:5355 on ixp0
Aug 26 05:15:59 2014 Connection Refused - Policy violation UDP 192.168.16.20:1127->239.255.255.250:1900 on ixp0
Aug 26 05:15:59 2014 Connection Refused - Policy violation UDP 192.168.16.20:1127->239.255.255.250:1900 on ixp0
Aug 26 05:16:21 2014 Connection Refused - Policy violation UDP 192.168.16.137:61740->224.0.0.252:5355 on ixp0
Aug 26 05:16:21 2014 Connection Refused - Policy violation UDP 192.168.16.137:61740->224.0.0.252:5355 on ixp0

When you see the dropped packets in the logs, what IP are they coming from? Does that IP match the allow rule for source?

[WiKDMoNKY]

I was trying anything to get it to work and I knew it was redundant, but I was reading somewhere to try adding them.

Note that in your screen cap, rules 3 and 4 are kind of redundant since you have that 5th rule which allows all internal LAN traffic regardless of port.

[Mute]

Without looking more in depth at the admin interface, based on the log it looks like it uses a range of ports for the service, not just the 5060 port. Also, does the setup allow you to choose the port types (TCP, UDP...etc), or does it only let you choose the port number/range? I suggest looking at your log and setting the forwarding to cover the entire range that are shown for policy violations for the specific IPs and ports listed.

[ocabj]

Based on the drop errors, it looks like the 192.168. is getting blocked.

I assumed 192.168 was your 'LAN' subnet, which would be covered by rule 5.

You can try creating an explicit allow any from the 192.168.0.0/16 to the 192.168.0.0/16 (or whatever mask is appropriate that defines your internal network) to see if that solves the issue.

[jmlivingston]

I'd be shocked if you aren't using NAT, especially since you have 192.168.x.x IP addresses and you're connecting from home. Presumably that connection you're making is coming over the internet, where 192.168.0.0 addresses are not allowed.

Looking at those logs it seems to me like you have an outbound problem. The ixp0 interface referenced in the drops for 192.168.16.10 (the Trixbox server, right?) is the LAN side of the router I believe. Any sort of outbound filters in place?

[WiKDMoNKY]

Yes, the Fonality server runs on asterick/tribox.

I am installing the router this weekend with just the port forwarding like the old router for now. After I get their new domain and 3 servers installed this weekend I will focus on working on the access lists/whitelists next week.

Is anyone available to be hired to help me with the whitelist setup?

I'd be shocked if you aren't using NAT, especially since you have 192.168.x.x IP addresses and you're connecting from home. Presumably that connection you're making is coming over the internet, where 192.168.0.0 addresses are not allowed.

Looking at those logs it seems to me like you have an outbound problem. The ixp0 interface referenced in the drops for 192.168.16.10 (the Trixbox server, right?) is the LAN side of the router I believe. Any sort of outbound filters in place?

[jmlivingston]

Send me a PM and let mn know when/where, I am probably available. You're in OC right?