In the case where people do not read the manual concerning the use of a hardware firewall, given that you have the ports closed on the external firewall, you may as well close them on the PBX as well.
See IPTables script below:
This must be run as a script - not copied and pasted line by line into the console, or you will lock yourself out, right after iptables -F
Code:
#!/bin/sh
#
# IPTABLES settings for PBX in a Flash systems, to only allow connections from the internal network.
#
# Copyright (C) <2010> <Jonathan Roper Star2billing S.L.>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
# [email protected]
#
#Variables
LANA="10.0.0.0/8"
LANB="172.16.0.0/12"
LANC="192.168.0.0/16"
TCPPORTS="22,80,4445,443,10000,9022,9080,9001"
UPDPORTS="69,123,69,53,4520,4569,5060,10000:20000"
#IPTABLES
iptables -F
iptables -Z
iptables -X
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports $TCPPORTS -s $LANA -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports $TCPPORTS -s $LANB -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports $TCPPORTS -s $LANC -j ACCEPT
iptables -A INPUT -p udp -m multiport --dports $UPDPORTS -s $LANA -j ACCEPT
iptables -A INPUT -p udp -m multiport --dports $UPDPORTS -s $LANB -j ACCEPT
iptables -A INPUT -p udp -m multiport --dports $UPDPORTS -s $LANC -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 600 --hitcount 2 -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -p all -s localhost -i eth0 -j DROP
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT
service iptables save
This script prevents access from all external public IP addresses, (except for SSH access) and only allows access from internal ranges which are defined as:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
If you have chosen an IP address range other than the standard non-routable ones above, then you would have to make some changes to the script.
This allows trunks to register, as the connection is being initiated from inside the PBX, but will not allow any connections from the outside world of any type (other than pings and SSH)
This section is interesting:
Code:
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 600 --hitcount 3 -j DROP
This allows you to remote manage the PBX externally via SSH. But it only allows you two connections in 600 seconds, so brute force attacks will be stopped by this rule. So even without Fail2Ban running in the background, under standard SSH configuration, it allows 6 goes at getting the password correct in 10 minutes. e.g. first attempt, SSH allows you 3 goes to put in the password, then drops the connection, then allows you another three goes when you reconnect, and then drops the connection, IPTables will not let you reconnect for a further 10 minutes.
I suspect that a rule similar to this on port 5060 could be used to prevent brute force attacks on SIP, but we would have to get the timing correct.
If someone would like to test, as second pair of eyes is always a good thing.
Comments always welcome, and if this were added to the Incredible PBX, it would be fair to say that there is extra security!
Joe
Phone System 