0

I'm trying to open up a complete subnet of IP's to connect to my server but the customer is getting weekly issues where his IP updates and then he cannot access the server anymore.

I have the IP down to 197.245.0.0/16 (so 197.245.0.1 - 197.245.255.255) and although the IP remains within the ip range, they get locked out of ports 5060 and 5061. Here is my output of my zones public.xml - I have opened up the specific ports for other ranges which works fine so not sure why the one above does this.

The current IP address for the customer is 197.245.90.x so it should not get firewall blocked?

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="dhcpv6-client"/>
  <service name="ssh"/>
  <port protocol="tcp" port="443"/>
  <port protocol="tcp" port="1567"/>
  <port protocol="tcp" port="80"/>
  <rule family="ipv4">
    <source address="195.35.114.0/23"/>
    <port protocol="tcp" port="5061"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="195.35.114.0/23"/>
    <port protocol="tcp" port="5060"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="197.245.0.0/16"/>
    <port protocol="tcp" port="5060"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="195.35.114.0/23"/>
    <port protocol="udp" port="10000-30000"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="197.245.0.0/16"/>
    <port protocol="udp" port="10000-30000"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="197.245.0.0/16"/>
    <port protocol="tcp" port="5061"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="204.27.0.0/16"/>
    <reject/>
  </rule>
  <rule family="ipv4">
    <source address="89.163.0.0/16"/>
    <reject/>
  </rule>
</zone>
1

According to the info you posted it should not get blocked.

To debug the iptables insert a rule with TRACE target into raw table:

TRACE

This target marks packets so that the kernel will log every rule which match the packets as those traverse the tables, chains, rules.

A logging backend, such as ip(6)t_LOG or nfnetlink_log, must be loaded for this to be visible. The packets are logged with the string prefix: "TRACE: tablename:chainname:type:rulenum " where type can be "rule" for plain rule, "return" for implicit rule at the end of a user defined chain and "policy" for the policy of the built in chains. It can only be used in the raw table.

so in your case:

modprobe nfnetlink_log
iptables -t raw -I PREROUTING -s 197.245.0.0/16 -p tcp --dport 5061 -j TRACE

When you are done with analysis, remove it:

iptables -t raw -D PREROUTING -s 197.245.0.0/16 -p tcp --dport 5061 -j TRACE

Use iptables command to do that, not firewall-* commands.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.