As a result of constantly attacks to my IP01, I am planning to set up a firewall in the middle.
Bought RB750G last summer and haven't used it (planned as VPN client but never succeeded). It seems to be much advanced than home router.
Anyone has experience with RouterOS and asterisk setup for the following (basic) objectives?
1. Protect IP01 from attacks.
2. IP01 works as before(outside normal users should be able to access my IP01).
Currently, I set
1. allowguests=no
2. simple error "No matching peer found" is given
However, the attacks come always back a few days after changing ip address with 30 register trials per minutes. IP01 cannot work properly as CPU load is too high
I set up the RB750G in the frontline. Put port forwarding rules for 5060 & 10000-20000. All traffic from intruders' ip are dropped.
Both incoming call and outgoing call work!
Add the block-list by hand. Missing the dynamic black-list add-on feature as fail2ban.
As the black_list of hacker's ip addresses increases, it is hard to handle it.
Let's think the opposite: white list! I have 10 sip providers and a few extensions. Hence this white list would be much easier to handle.
Divide the white-list into two groups:
#1. DNS resolvable, like, sip providers, your client's dyndns address(es) etc.
#2. Static ip addresses, like your local ip address pool. (which cannot be find out through DNS)
/system script add \
name=resolvehostnames policy=write,read \
source="# define variables\r\
\n:local list\r\
\n:local comment\r\
\n:local newip\r\
\n\r\
\n# Loop through each entry in the address list.\r\
\n:foreach i in=[/ip firewall address-list find] do={\r\
\n\r\
\n# Get the first five characters of the list name\r\
\n :set list [:pick [/ip firewall address-list get \$i list] 0 5]\r\
\n\r\
\n# If they're 'host_', then we've got a match - process it\r\
\n :if (\$list = \"host_\") do={\r\
\n\r\
\n# Get the comment for this address list item (this is the host name to u\
se)\r\
\n :set comment [/ip firewall address-list get \$i comment]\r\
\n\r\
\n# Resolve it and set the address list entry accordingly.\r\
\n :set newip [:resolve \$comment]\r\
\n /ip firewall address-list set \$i address=\$newip\r\
\n }\r\
\n }"
And scheduler(run each hour, you can change the frequency if you like):
Another field is the QoS. As ADSL, the bandwidth is always a problem(OK, for those who has dual-wan, 100M etc., plz ignore this issue). Following the wiki from Mikrotik. Here is my QoS setup:
1. Mark packets.
2. Define queue tree.
3. Define priority in queue tree.
1. For RTP traffic, it is hard to mark with layer 7 protocol. I simply mark the packets to/from the asterisk ip(here is 192.168.88.100) as voip_in and voip_out.
2. Define your queue tree:
Note: change Max upload and download speed under DSL_IN(11M in) and DSL_OUT(600k out) (global-in gloabal-out) after your xDSL:
No more monkey jumping in the bed, I mean the white-list method DOES give a better protection to my asterisk server. However, it has its main drawback, i.e., all users must be in the white-list.
It works with hostnames too. However it needs frequently(typ. 10 min.) running script to resolve the hostnames.
The white-list starts with the "host_" string and hostnames are "hided" within the comments.
See https://wiki.mikrotik.com/wiki/Use_host_names_in_firewall_rules
發表於 2012-1-7 18:16
| 
