I have been searching the web for an asterisk behind NAT configuration but couldn’t find a short but definite example so I decided to create a working example configuration of asterisk behind NAT. So if you guys are currently having problems configuring your asterisk behind NAT, please feel free to use my example below:
Put the following in your rc.local:
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -t nat -A POSTROUTING -o eth0 -j SNAT –to your.public.ip.here
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p udp –dport 10000:20000 -j DNAT –to-destination 192.168.30.1
iptables -t nat -A PREROUTING -p udp –dport 5060 -j DNAT –to-destination 192.168.30.1
iptables -A FORWARD -p udp -s 192.168.30.1 -j ACCEPT
iptables -A FORWARD -p udp –dport 10000:20000 -d 192.168.30.1 -j ACCEPT
iptables -A FORWARD -p udp –dport 5060 -d 192.168.30.1 -j ACCEPT
your sip.conf should be:
[general]
context=default
port = 5060
bindaddr = 0.0.0.0
context = default
externip = your.public.ip.here
nat=yes
localnet=192.168.30.0/255.255.255.0
canreinvite=no
Sample gateway-to-gateway SIP config for sip.conf:
[toyoursipprovider]
type=friend
host= sip.provider.gateway.ip
canreinvite=no
disallow=all
allow=g729
allow=ulaw
dtmfmode=rfc2833
ENJOY!
IBM announced the System z10 mainframe that will help clients create a new enterprise data center with increased efficiency. z10 will significantly improve the performance of data centers by reducing power consumption, cooling costs, and floor space requirements. It also offers unmatched levels of security and automates the management and tracking of IT resources to respond to ever-changing business conditions.
The z10’s capacity is equivalent to 1,500 servers based on the popular x86 design, IBM says, though it has 85% lower energy costs and takes up 85% less space than the batch of x86 servers. IBM also says that the system allows the consolidation of x86 software license at up to a 30:1 ratio.
The new machines also boast more processing horsepower, using 64 quad-core processors compared to the 54 processors used in its predecessor, the z9. The z10 also supports a broad range of workloads. In addition to Linux, XML, Java, WebSphere and increased workloads from Service Oriented Architecture implementations, IBM is working with Sun Microsystems and Sine Nomine Associates to pilot the Open Solaris operating system on System z, demonstrating the openness and flexibility of the mainframe.
Here are some of z10’s great features:
- Single z10 equal to nearly 1,500 x86 servers
- Up to 85% less energy costs
- Up to 85% smaller footprint
- Consolidates x86 software licenses at up to a 30-to-1 ratio.
- Mainframe goes Quad-Core
- z10 brings discipline to data center chaos:
- Just-in-time capacity to meet ever-changing business conditions
- Automated management of system performance to favor high-value transactions
A flaw in Linux kernel versions 2.6.17 to 2.6.24.1 can give local users access to root privileges. The vulnerability is caused by a missing verification of parameters within the Linux kernel’s “vmsplice” function which appears in versions 2.6.17 to 2.6.24.1. This flaw can be used to steal data or mount denials of service on any Linux-based system running on the affected kernel versions.
A researcher, calling himself “qaaz” has released two exploit codes namely “Linux kernel 2.6.17 - 2.6.24.1 vmsplice Local Root Exploit” and “Linux kernel 2.6.23 - 2.6.24 vmsplice Local Root Exploit” for this newly discovered flaw and posted them on milw0rm.com website.
DONT PANIC! This Linux kernel flaw has been labeled as “moderate risk” by FrSIRT, the French security response team, and “less critical” by Danish vulnerability clearinghouse Secunia – apparently already have been fixed in newer versions of Linux kernel 2.6, researchers said. Secunia also said in its advisory that the Linux flaws can only be exploited from local systems.
Port Scan Attack Detection (PSAD) is a collection of three lightweight system daemons written in Perl and C and is designed to work with Linux firewalls like iptables (for Linux 2.4.x kernels) and ipchains (for the 2.2.x kernels) to detect port scans and other suspicious traffic. A typical deployment is to run psad on the iptables firewall where it has the fastest access to log data.
PSAD has verbose alert messages which include the source IP, destination IP, scanned port range, timestamps, tcp flags and corresponding nmap options used (for 2.4.x kernels only), reverse DNS info, email alerting, and automatic blocking of offending ip addresses via dynamic configuration of ipchains/iptables firewall rulesets. PSAD incorporates many of the tcp signatures included in Snort to detect highly suspect scans (for kernel 2.4.x only).
PSAD is developed around three main principles:
- Good network security starts with a properly configured firewall.
- A significant amount of intrusion detection data can be gleaned from firewalls logs, especially if the logs provide information on nearly every field of the network and transport headers (and even application layer signature matches as in Netfilter’s case).
- Suspicious traffic should not be detected at the expense of trying to also block such traffic.
We all know that IPv6 has existed a long time ago and that it is not being utilized in many parts of the world. However, the Internet Corporation for Assigned Names and Numbers (ICANN) has deployed half dozen new root DNS servers to answer for IPv6 requests. IPv6 addresses were added for six of the world’s 13 root server networks (A, F, H, J, K, M) to the appropriate files and databases. This move allows for the possibility of fuller IPv6 usage of the Domain Name System (DNS). Prior to today, those using IPv6 had needed to retain the older IPv4 addressing system in order to be able to use domain names.
This move will add the ability of an IPv6 host to connect to another IPv6 host without needing to resolve an address on an older IPv4 server.
“Today’s addition of IPv6 addresses for the root servers enhances the end-to-end connectivity for IPv6 networks, and furthers the growth of the global interoperable Internet,” added David Conrad, ICANN’s Vice President of Research and IANA Strategy. “This is a major step forward for IPv6-only connectivity and the global migration to IPv6.”
Four of the five Regional Internet Registries were accessible via IPv6 except the American Registry for Internet Numbers (ARIN) because ARIN is not yet operating public IPv6 nameservers.
