Re: cornfedsip: voip and sip protocol problems

Hello!

Sorry for the stupid question:

Is it possible to put a -m state --state NEW option in iptables for UDP 
packages so that i can open the 5004 port socket? I tried it, modifiing the 
guarddog export script, but cornfedsip still doesn't work with audio 
transport. I think that I'm still making some idiot conceptual mistake.

giorgio

Alle 16:15, venerdì 23 dicembre 2005, Simon Edwards ha scritto:
> Hello,
>
> On Friday 23 December 2005 13:55, Giorgio Pioda wrote:
> > Of course, otherwise the "userdefined" sections in the guarddog-
> > generated firewall script would not be present.
> >
> > 1) the difference between the ipchains and the iptables rules. The
> > ipchains section of the guarddog-firewall script works with kernel 2.2 or
> > lower. In this part the communication seem to be bidirectional.
> > In the iptables (i have debian sarge, kernel 2.6.8, an then is the active
>
> part
>
> > of the script!) the communication is NOT bidirectional, as the are three
> > missing iptables rules (compared to the ipchains). So this seems to be a
> > BAD BUG in guarddog, that doesn't generate a correct script for
> > bidirectional user defined ports (i checked the bidirectional option, of
> > course).
>
> UDP connection tracking.
>
> > I also thik that at least for general SIP and STUN services there should
> > be
>
> a
>
> > predefined checkbox, avoiding this manual play.
>
> True.
>
> I also accept patches BTW (or at least a link to some good information
> about what these protocol require).
>
> Are you using Guidedog too? Have you checked your settings and zones in
> Guarddog multiple times?
>
> cheers,


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click