Re: [Shorewall-users] [SPAM] Re: Dual WAN reliability help needed

2009-09-22 Thread Harry Lachanas
The hope is that new sessions can automatically be configured to work correctly, though. New outgoing sessions should automatically be routed among the ISP's that are still up. The goal is to prevent them from somehow erroneously selecting an ISP that is down, thus stalling out the new

Re: [Shorewall-users] Dual WAN reliability help needed

2009-09-22 Thread Josh Lehan
Roberto C. Sánchez wrote: I am the maintainer of the official Debian Shorewall packages. However, since I run Lenny on my servers and want the latest Shorewall packages on them, I create a set of Lenny packages for each set og packages I create for Sid. I figure that they might be useful to

Re: [Shorewall-users] Dual WAN reliability help needed

2009-09-22 Thread Josh Lehan
Laurent CARON wrote: Here is how it works on my DSL link. I've got an interconnection IP which is used by the router itself, and a netblock (/27) routed through the interconnection IP. That's really cool. You have a real routing subnet. I have a block of IP addresses, that isn't a real

Re: [Shorewall-users] Dual WAN reliability help needed

2009-09-22 Thread Josh Lehan
Harry Lachanas wrote: I would suggest a) Don't run pppoe on shorewall box, instead have both your modems run in routing mode and let them handle the pppoe story. ;-) If I had just a single IP address coming in, I could do that. Unfortunately, I need to set up multiple IP addresses, so I

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Simon Hobson
Max DiOrio wrote: Cable modem with multiple IPs. One goes to the ASA, one to the Trixbox. The ASA connects to a switch and handles the entire network, PCs and phones. Private lan (phones, servers, pcs, tribox) is 10.1.0.0/255.255.255.0 Trixbox interface eth1 - public interface with ip

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Max DiOrio
You're right. I have done all that. My problem isn't with the trixbox setup since it was working before. I just can't get the firewall rules set up properly. I think I need to see someone elses config files that are similar to mine to sort this out. Thanks. Max DiOrio IT Coordinator

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Robert K Coffman Jr. -Info From Data Corp.
I don't have to support SIP so I may be out of line here, but couldn't you enable logging on everything and see what the firewall is blocking? -- Come build with us! The BlackBerryreg; Developer Conference in SF, CA is

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Max DiOrio
My SIP provider is asking me to open all UDP ports, which is a huge security risk. What rule can I use to allow all traffic two and from a particular IP? This might be easiest, as the provider only uses two IP addresses. This way I can block all traffic inbound except from those IPs.

[Shorewall-users] shorewall logging

2009-09-22 Thread Sven Richter
Hello list, according to: http://sourceforge.net/mailarchive/forum.php?thread_name=450EB7580E6AE7469F8826BFBF09BAB60889EC%40earwax.uent.comforum_name=shorewall-users i tried to setup the logging in shorewall to find out where my packages are hiding because i have almost the same problem. But i

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Simon Hobson
Also, tshark is a very useful tool - have a look at the packets on the two networks. Of particular interest might be a full decode (-V option) of the SIP packets to see what address/port Asterisk is telling the remote system to use for RDP/ -- Simon Hobson Visit

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Simon Hobson
Max DiOrio wrote: My SIP provider is asking me to open all UDP ports, which is a huge security risk. Then they are a bunch of ignorant tools ! The only ports you need to open are the signalling ports (eg 5060 for SIP) and the ports specified in /etc/asterisk/rtp.conf - those are the only

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Max DiOrio
Still not working for me. In fact, this time it was worse. Everything stays registered, but this time I get no audio in either direction, and although it was working after I enabled the firewall, web access stopped working after a few minutes. I can see the calls come in, but the RTP stream

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Justin Pryzby
On Tue, Sep 22, 2009 at 06:51:14PM -0400, Max DiOrio wrote: Here's my config, maybe someone can spot something that's wrong. rules: ACCEPTnet:204.11.116.47,204.11.119.47,67.242.xx.xx$FW all ACCEPT$FW:204.11.116.47,204.11.119.47,67.242.xx.xxnet all The 2nd line

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Max DiOrio
Thank you for correcting my stupidity. This is the first Linux based firewall I've configured (well, tried to). I'm used to working with Cisco ASA devices. This was quite a learning experience, but I think I'm starting to get the hang of it now. I can place calls in just fine and leave a

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Jerry Vonau
On Tue, 2009-09-22 at 18:51 -0400, Max DiOrio wrote: Still not working for me. In fact, this time it was worse. Everything stays registered, but this time I get no audio in either direction, and although it was working after I enabled the firewall, web access stopped working after a few

Re: [Shorewall-users] Losing my mind after a long day

2009-09-22 Thread Terry Gilsenan
On Tue, 2009-09-22 at 18:51 -0400, Max DiOrio wrote: Still not working for me. In fact, this time it was worse. Everything stays registered, but this time I get no audio in either direction, and although it was working after I enabled the firewall, web access stopped working after a few