VoipPorts

Category:Sasecurity
back to http://scratchpad.wikia.com/wiki/Sasecurity
TableOfContents
=== asdfsadf ===
 * You should undo those PortMapping, they need to be made on your ADSL router and not the meshbox.
The only known firmware version for the grandstream which works is 1.0.4.54 - You should upgrade/downgrade the grandstream to this version to get it working. It is also important to enable the sipproxy software module on all nodes which you want to use SIP routing on and set downstream nodes to "lock to gateway" of the gateway node, which should also have the sip routing module enabled. If you're using a SIP provider with an outbound proxy server, this setting should be removed when using meshed sip.
=== ss ===
Thanks for the info. I have UDP ports set on the router side in the range as you described from 5060 to 9002 and couldn't get the Grandstream 286 to work. Right now I have sipproxy module installed, the red LED is out and the unit works. If I go ahead and uninstall the siproxy either on the GW node or the node serving the 286 unit with DHCP the red LED will start flashing as soon as the sipproxy module is uninstalled. Please comment.
One more question. Does the VoIP traffic stays inside the Mesh when customers call each other. I assume that is IP to IP calling. Since the IP is dynamic can I set the VoIP telephone adapters with static IPs.
In addition to router subject I have set the DMZ IP for GW node. Would this eliminate ports problems at router side. Do you recommend DMZ to be enabled as far as security reasons problems it may cause.
-----
=== 345 ===
> Scenario: > I've got a PheeNet AP in Client AP mode to which is attached an 8 port hub. > Off the hub are a laptop and a Grandstream IP phone. The laptop works a > treat, the 'phone won't connect. All the settings in the 'phone are > correct as I have been testing it on my LAN - it connects to UK provider, > accounts all set-up , etc. > > Problem: > Joel has advised that I need to make sure that "ports 5060 and 8000-8100 > are forwarded to the meshbox (if you are using NAT).
Also enable the Gateway NAT workaround option if appropriate." The meshbox is connected to my ADSL router (as is my LAN on which the phone works OK).
So on the WIANA Port Mappings section..... under Spec 1 I entered - eth:5060 (1.xxx.xxx.xxx):5060 and under Spec 2 I entered - eth:8000-8100 1.xxx.xxx.xxx):8000-8100 > I also enabled the Gateway NAT workaround
You should undo those port mappings, they need to be made on your ADSL router and not the meshbox.
The only known firmware version for the grandstream which works is 1.0.4.54 - You should upgrade/downgrade the grandstream to this version to get it working.
It is also important to enable the sipproxy software module on all nodes which you want to use SIP routing on and set downstream nodes to "lock to gateway" of the gateway node, which should also have the sip routing module enabled.
If you're using a SIP provider with an "outbound proxy server", this setting should be removed when using meshed sip.
Best Regards,
=== docu me ===
You can safely ignore the error message just make sure you reboot after installing the SIP proxy, Jon warned about this one, see item 6.
“4) On your mesh nodes go to manage each node you want to use for SIP and
select the "software module manager" and enable "Clustering SIP proxy for
multi-point VoIP" and disable all other modules if not already disabled.
5) Manage each wireless non-gateway node and select Lock to gateway of your
gateway node. If you have multiple gateways then you need to be locking to a
gateway which also has the sip module loaded. - Click make changes to update
the node. - selective cloning can be used to make this change more quickly.
6) Login to each node you have made changes for and issue SwMan - you'll see
stuff download - and then issue "reboot" - don't worry if you get a message
about missing libraries, that will go away after reboot.
After all your nodes have loaded the software and changes and restarted they
will be sip capable.”
The mail list is incredibly slow today - 2 hours 20 mins between post and reply - help the day is running away from me!
BTW - thanks to Russel for getting back to me re:Cloning mail I sent
Anyway, another problem with my new node (I'm beginning to regret this)
I checked sipproxy on WIANA, then ran RemoteManagement.
All went well until.... (taken from monitor attached to new node)
Directory: sipproxy
Installing
Sipproxy/
Sipproxy/ro/
Sipproxy/read.cfs
Sipproxy:error while loading shared libraries: libosipparser2.so2: cannot open shard object file:
 . No such file or directory
DONE
OK, I'm a Windows chappie, still learning this Linux stuff, but it seems to me that when read.cfs is called/invoked(?) the box is in the wrong directory, but I'm probably wrong.
One option I guess would be to uninstall and then re-install, but.... I am having a very bad day so ....
Haven't got a clue what to do now. Which one of you good folk out there can clue me in to what I should be doing next.
Thanks once again
At 4:22 pm -0700 22/6/04, Stephen Murphy wrote: >I have a 3 node mesh with 2 repeaters and 1 gateway. I am testing a >sip phone box with a D-Link wireless bridge. I configure the bridge >to see the gateway node and everything works fine, however, when I >configure the bridge to communicate with either of the 2 repeaters I >don't get a dial tone and the phone does not work. My gateway has >been set to a static IP so my question is - do I need to set the >repeaters to a static IP? >
Have you installed the SIP proxy module on your meshboxes?
 . ' 
This looks like you are using PPP for the gateway tunnels. Try switching this to IP tunnels. 
 
I had exactly the same problem with one of the customers on our network, he had replaced his hub, connected to a WAP-11 in client mode, with a broadband router/firewall and they usually come with pppoe turned on and so you get the threads spawned which you are seeing. The router doesn’t negotiate a successful pppoe conection so it tries again and another thread is spawned and again, and again, you get the picture. 
Just make sure pppoe is turned off on the customers router that is causing the problem, his MAC is in the output of the ps. 
Cheers! 
Roy… 
-----
 Original Message 
-----
After several days, I did a ps on one of the repeaters and I see many thread pairs (over 60) like this: 
... 
32444 root 1992 S pppd pty /hj/pppoe -n -I br0 -e 54:00:02:6f:09:65:73 -S file /etc/ppp/pppoe-server-options 192.168.1.2:192.168.17.57 nodetach noaccomp nobsdcomp nodeflate nopcomp n 32445 root 1364 S /hj/pppoe -n -I br0 -e 54:00:02:6f:09:65:73 -S 22671 root 1992 S pppd pty /hj/pppoe -n -I br0 -e 55:00:02:6f:09:65:73 -S file /etc/ppp/pppoe-server-options 192.168.1.2:192.168.17.58 nodetach noaccomp nobsdcomp nodeflate nopcomp n 22672 root 1364 S /hj/pppoe -n -I br0 -e 55:00:02:6f:09:65:73 -S 13306 root 1992 S pppd pty /hj/pppoe -n -I br0 -e 56:00:02:6f:09:65:73 -S file /etc/ppp/pppoe-server-options 192.168.1.2:192.168.17.59 nodetach noaccomp nobsdcomp nodeflate nopcomp n 13307 root 1364 S /hj/pppoe -n -I br0 -e 56:00:02:6f:09:65:73 -S ... 
I monitored this over a few days and it does not come down, only increase. 
Since the repeaters are small machines, this uses precious resources. Is there a problem with MeshAP not terminating these threads? Is it normal? Is there a configuration setting I can use to prevent this from happening? 
> I'm not sure what you mean. If my SIP provider has an "outbound proxy > server" which setting should be removed, the "lock to gateway" or sipproxy > software module? >
No, if your sip provider has an outbound proxy server which you would program in to your IP phone or PC phone then when using this on the mesh you leave this setting blank on the phone or select "no outbound proxy" on the phone depending on the configuration of the device. On phones where you can't leave this blank, enter "vpnhost." - without the quotes as a workaround.
It can still work sometimes without changing this setting, but I strongly recommend not using outbound proxy servers when using SIP with the mesh.
=== traffic ===
Subject: Re: [MeshAPuser] VOIP Mapping