Thursday, January 22, 2009

Make Aastra plugins work in sipXecs 3.10.3

We're looking at putting sipXecs into a customer that already has a bunch of Aastra 5x series phones. Problem is that Aastra managed phone support isn't coming to sipXecs until version 4.0.

However, it is possible to take the plugins from the development version of sipXecs (currently 3.11.

Built a 3.11.9 box and grabbed aastra-phones.jar from the \usr\share\java\sipXecs\sipXconfig folder.

Copied aastra-phones.jar to \usr\share\sipxpbx\lib folder on 3.10.3 box.

Copied all files from http://sipxecs.sipfoundry.org/ViewVC/sipXecs/main/sipXconfig/plugins/aastra/etc/ to /etc/sipxpbx/aastra.

Changed owner of files and folder to sipxchange ( 'chown sipxchange:sipxchange /etc/sipxpbx/aastra' and 'chown sipxchange:sipxchange /etc/sipxpbx/aastra/*' )

Restarted sipxpbx services (service sipxpbx restart).

What to do when sipXecs ISO installer doesn't have the proper network card drivers...

Installing sipXecs on BioStar Motherboard with Integrated Realtek RTL8110SC/8169SC Network Adpter

CentOS 5.2 with Realtek RTL8110SC/8169SC network adapter

The CentOS installed from the sipXecs 3.10.2 ISO did not have the drivers for this particular motherboard / network adapter so I was forced to do some digging. So others can benefit from my pain I documented my solution..

I downloaded kmod-r8169-2.3LK_NAPI-1.el5.i686.rpm from http://centos.toracat.org/ajb/CentOS-5/r8169 to a USB drive on my laptop.

Plugged the USB drive into the server and waited for the 'up' message.

Made a directory to mount the usb drive to (mkdir /media/usbdisk1 )

Mounted the drive (mount /dev/sda1 /media/usbdisk1 )

Changed to the directory (cd /media/usbdisk1 )

Installed the RPM (rpm -ivh kmod-r8169-2.3LK_NAPI-1.el5.i686.rpm )

Rebooted machine.

After boot, login as root.

Run linux setup command (setup)

Set the static IP address on the network card that was specified at sipXecs installation.

Save and exit setup.

Restart network services (service network restart)

Restart sipX services (service sipxpbx restart)

Wednesday, January 7, 2009

Rules for Vyatta to pass XBox Live Traffic

Here are the NAT, Firewall and Interface rules required to pass XBox Live traffic for an XBox 360. My inside interface is eth0 and my outside interface it eth1. Tweak accordingly...

yyy.yyy.yyy.yyy = IP Address of the xbox

NAT stuff:

rule 10 {
destination {
port 88
}
inbound-interface eth1
inside-address {
address yyy.yyy.yyy.yyy
}
protocol udp
type destination
}
rule 11 {
destination {
port 3074
}
inbound-interface eth1
inside-address {
address yyy.yyy.yyy.yyy
}
protocol udp
type destination
}
rule 12 {
destination {
port 3074
}
inbound-interface eth1
inside-address {
address yyy.yyy.yyy.yyy
}
protocol tcp
type destination
}

Rules to apply inbound to outside interface:

rule 30 {
action accept
destination {
port 88
}
protocol udp
}
rule 31 {
action accept
destination {
port 3074
}
protocol udp
}
rule 32 {
action accept
destination {
port 3074
}
protocol tcp
}

The MTU settings on the Interfaces:

ethernet eth0 {
address xxx.xxx.xxx.xxx/24
description inside
firewall {
in {
name OUTBOUND
}
}
hw-id xx:xx:xx:xx:xx:xx
mtu 1500
}
ethernet eth1 {
address dhcp
firewall {
in {
name INBOUND
}
local {
name TO-ROUTER
}
}
hw-id xx:xx:xx:xx:xx:xx
mtu 1500
}

And, give your XBOX a static IP address:

static-mapping XBOX360 {
ip-address yyy.yyy.yyy.yyy
mac-address xx:xx:xx:xx:xx:xx
}

Saturday, January 3, 2009

DNS Concepts with Session Border Controllers

Published another document today on configuring internal / external DNS for use with Session Border Controllers. It's got a bit of a sipXecs slant to it but should be useful for others looking for redundant and load balanced SBC setup help.

It is available HERE and HERE2

YMMV with Asterisk & FreeSwitch installations and SRV based authentication methods... Most of the setups I have seen are A records pointing to the PBX.

Use Microsoft DNS Servers with sipXecs

Alright, so you want to maintain one set of DNS servers for your organization and it's just easier for you to do it with Microsoft's DNS servers?

I made public a document I wrote a couple years ago and published it on the sipX Wiki. Located here.

Thursday, January 1, 2009

OpenSBC on Vyatta Firewall How-To published

After toiling for many hours I was finally able to get OpenSBC running properly on Vyatta. This solution builds a firewall that allows for Inbound SIP calling, Outbound SIP calling and far-end NAT traversal for remote users.

The paper is published HERE and HERE2

Many thanks to Joegen, Eric and Raymond over on the OpenSBC site for their help and patience with me in getting this going.

Wednesday, December 31, 2008

Vyatta Rules to Block China / Pacific Rim IP's

Created a set of Vyatta rules to block all traffic from Pacific Rim nations. I usually do this as a matter of course with firewalls with customers. To get the addresses I combed through IANA's database.

The first set should be the first set of rules inbound on your outside interface.

set firewall name INBOUND rule 5 action drop
set firewall name INBOUND rule 5 source address 202.0.0.0/7
set firewall name INBOUND rule 5 log enable
set firewall name INBOUND rule 6 action drop
set firewall name INBOUND rule 6 source address 210.0.0.0/8
set firewall name INBOUND rule 6 log enable
set firewall name INBOUND rule 7 action drop
set firewall name INBOUND rule 7 source address 218.0.0.0/7
set firewall name INBOUND rule 7 log enable
set firewall name INBOUND rule 8 action drop
set firewall name INBOUND rule 8 source address 220.0.0.0/7
set firewall name INBOUND rule 8 log enable
set firewall name INBOUND rule 9 action drop
set firewall name INBOUND rule 9 source address 222.0.0.0/8
set firewall name INBOUND rule 9 log enable
set firewall name INBOUND rule 10 action drop
set firewall name INBOUND rule 10 source address 59.0.0.0/8
set firewall name INBOUND rule 10 log enable
set firewall name INBOUND rule 11 action drop
set firewall name INBOUND rule 11 source address 60.0.0.0/7
set firewall name INBOUND rule 11 log enable
set firewall name INBOUND rule 12 action drop
set firewall name INBOUND rule 12 source address 114.0.0.0/7
set firewall name INBOUND rule 12 log enable
set firewall name INBOUND rule 13 action drop
set firewall name INBOUND rule 13 source address 116.0.0.0/6
set firewall name INBOUND rule 13 log enable
set firewall name INBOUND rule 14 action drop
set firewall name INBOUND rule 14 source address 120.0.0.0/6
set firewall name INBOUND rule 14 log enable
set firewall name INBOUND rule 15 action drop
set firewall name INBOUND rule 15 source address 124.0.0.0/7
set firewall name INBOUND rule 15 log enable
set firewall name INBOUND rule 16 action drop
set firewall name INBOUND rule 16 source address 126.0.0.0/8
set firewall name INBOUND rule 16 log enable


This second set of rules should be set for inbound on your inside interface.

set firewall name OUTBOUND rule 5 action drop
set firewall name OUTBOUND rule 5 destination address 202.0.0.0/7
set firewall name OUTBOUND rule 5 log enable
set firewall name OUTBOUND rule 6 action drop
set firewall name OUTBOUND rule 6 destination address 210.0.0.0/8
set firewall name OUTBOUND rule 6 log enable
set firewall name OUTBOUND rule 7 action drop
set firewall name OUTBOUND rule 7 destination address 218.0.0.0/7
set firewall name OUTBOUND rule 7 log enable
set firewall name OUTBOUND rule 8 action drop
set firewall name OUTBOUND rule 8 destination address 220.0.0.0/7
set firewall name OUTBOUND rule 8 log enable
set firewall name OUTBOUND rule 9 action drop
set firewall name OUTBOUND rule 9 destination address 222.0.0.0/8
set firewall name OUTBOUND rule 9 log enable
set firewall name OUTBOUND rule 10 action drop
set firewall name OUTBOUND rule 10 destination address 59.0.0.0/8
set firewall name OUTBOUND rule 10 log enable
set firewall name OUTBOUND rule 11 action drop
set firewall name OUTBOUND rule 11 destination address 60.0.0.0/7
set firewall name OUTBOUND rule 11 log enable
set firewall name OUTBOUND rule 12 action drop
set firewall name OUTBOUND rule 12 destination address 114.0.0.0/7
set firewall name OUTBOUND rule 12 log enable
set firewall name OUTBOUND rule 13 action drop
set firewall name OUTBOUND rule 13 destination address 116.0.0.0/6
set firewall name OUTBOUND rule 13 log enable
set firewall name OUTBOUND rule 14 action drop
set firewall name OUTBOUND rule 14 destination address 120.0.0.0/6
set firewall name OUTBOUND rule 14 log enable
set firewall name OUTBOUND rule 15 action drop
set firewall name OUTBOUND rule 15 destination address 124.0.0.0/7
set firewall name OUTBOUND rule 15 log enable
set firewall name OUTBOUND rule 16 action drop
set firewall name OUTBOUND rule 16 destination address 126.0.0.0/8
set firewall name OUTBOUND rule 16 log enable

If you are using any local services on the firewall itself, consider applying the rules to the local section of the outside interface.

Vyatta with OpenSBC Install

Finally got pointed in the right direction with Vyatta and OpenSBC by Joegen (the main developer over at OpenSipStack.org). Here are my install notes for OpenSBC on Vyatta.

Install OpenSBC on Vyatta Firewall


Install Vyatta:


Boot from Vyatta LiveCD ISO. Press ENTER.

At login, username 'root', password 'vyatta'.

Enter 'install-system'

Configure as needed... I'll share mine when I get this all working...


Get items required for building OpenSBC (kitchen sink approach):


Login to Firewall as user 'vyatta'

cd /etc/apt

su

Password: (enter root password)

nano -w sources.list

Add line: "deb ftp://ftp.us.debian.org/debian/ lenny main contrib non-free"

Ctrl-X and Y to overwrite

apt-get update

apt-get install -y mc autoconf automake cvs flex expat libexpat1-dev libtool build-essential libxml2 libxml2-dev libtiff4 libtiff4-dev php5 php5-cli php5-mysql php5 php5-cli php5-mysql php5-gd mysql-server libmysqlclient15-dev php-pear php-db curl sox apache2 libssl-dev libncurses5-dev bison libaudiofile-dev subversion libnewt-dev libcurl3-dev libnet-ssleay-perl openssl ssl-cert libauthen-pam-perl libio-pty-perl libmd5-perl libpg-perl libdbd-pg-perl php5-pgsql sqlite3 libsqlite3-dev openssl ssl-cert libapache2-mod-php5 php5-cli php5-common phpMyAdmin php5-mcrypt mcrypt phppgadmin apache2 libmcrypt-dev


Get OpenSipStack and OpenSBC from CVS:

cd /usr/src

cvs -d:pserver:anonymous@opensipstack.cvs.sourceforge.net:/cvsroot/opensipstack login

cvs -z3 -d:pserver:anonymous@opensipstack.cvs.sourceforge.net:/cvsroot/opensipstack co -P opensipstack

cvs -z3 -d:pserver:anonymous@opensipstack.cvs.sourceforge.net:/cvsroot/opensipstack co -P opensbc


Compile / Make OpenSipStack and OpebSBC:

cd /usr/src/opensipstack

chmod +x ./configure

./configure

make bothnoshared

cd ../opensbc

chmod +x ./configure

./configure

make bothnoshared

make distrib

Starting OpenSBC

In the distrib folder under /usr/src/opensbc there should be a couple of scripts. Use ./startup.sh to start the services and ./shutdown.sh to stop them.

Access the OpenSBC management then at http://inside.ip.addr.offw:9999

Hope this helps others who have been struggling getting this going! I'm working on some Vyatta configuration files for making things all work together.
.

Sunday, December 28, 2008

Looking for an SBC solution? Vyatta + Freeswitch...

Started working on getting a proper SBC for the home network. I hacked on Vyatta with OpenSBC this morning with less than stellar compilation results. I may revisit that.

I did get a good start on Vyatta (beta of Ver 5... Debiab) with Freeswitch installed though. Here are my installation notes so far:

Vyatta VC5 Beta ISO download is at: http://www.vyatta.org/downloads

Vyatta (ver 5 beta) with FreeSwitch Installation

Install Vyatta

Boot from ISO. Press ENTER.

At login, username 'root', password 'vyatta'.

Enter 'install-system'

Configure as needed...


Get items required for building Freeswitch

Login to Firewall as user 'vyatta'

vyatta@FW1:~$ cd /etc/apt
vyatta@FW1:/etc/apt$ su
Password: (enter root password)
vyatta@FW1:/etc/apt$ nano -w sources.list

Add line: "deb ftp://ftp.us.debian.org/debian/ lenny main contrib non-free"

Ctrl-X and Y to overwrite

FW1:/etc/apt# apt-get update

FW1:/etc/apt# apt-get install -y mc autoconf automake libtool build-essential libxml2 libxml2-dev libtiff4 libtiff4-dev php5 php5-cli php5-mysql php5 php5-cli php5-mysql php5-gd mysql-server libmysqlclient15-dev php-pear php-db curl sox apache2 libssl-dev libncurses5-dev bison libaudiofile-dev subversion libnewt-dev libcurl3-dev libnet-ssleay-perl openssl ssl-cert libauthen-pam-perl libio-pty-perl libmd5-perl libpg-perl libdbd-pg-perl php5-pgsql sqlite3 libsqlite3-dev openssl ssl-cert libapache2-mod-php5 php5-cli php5-common phpMyAdmin php5-mcrypt mcrypt phppgadmin apache2 libmcrypt-dev


Get the Freeswitch Code

cd /usr/src/

svn checkout http://svn.freeswitch.org/svn/freeswitch/trunk freeswitch


Build Freeswitch...

cd freeswitch

./bootstrap.sh

./configure –prefix=/usr/local/freeswitch

make

make install

make sounds-install

make moh-install

make samples


Run Freeswitch...

cd /usr/local/freeswitch/bin

./freeswitch


That's as far as I've taken it at this point...

Shout out to http://madhawa.com/?p=10 for shedding light on Debian (etch)  install of Freeswitch.
.

Saturday, December 20, 2008

New Snom 820

Looks like Snom is finally getting their act together with their phones. They've always had the technology underneath (much better from an administrative perspective than Polycom) but their packaging left a LOT to be desired.



The new Snom 820 is set to change that. With sleek new looks, finally no paper templates, an available wireless version and Snom's great software under the hood, the 820 looks ready for prime time.

Take a closer look: http://www.snom.com/sv/products/snom-820/

Let's hope they follow it up quickly with an 860 or 870 for the attendant position.
.