Re: h.323 firewall

[Thomas Heinz <creatix@hipac.org>]

Hi Vincent

You wrote:
> The current situation incorporates :
> 
>           10.66.0.xxx
>      +---------------+
>      | SMC7008BR |
>      +---------------+
>           10.66.1.xxx
>                    DEV2
>                 |           |
>   +---------+-+   +--+--------+
>   | slack 8.0 |   | Slack 8.0 |
>   +-----------+   +-----------+
>                       192.168.0.xxx   +-----+       10.66.0.xxx
>                                              | pp0 |  +---------------+
>                                              +--+--+  |   switch      |
>                                                  |       +---------------+
>                                                  |         DMZ
>                                                  +-------+  +-------------+
>                                                  |  NS2  |   | NS1
> |
>                       10.66.0.xxx          |  HTTP2| | HTT1        |
>                  +---------------+         +-------+  | FTP           +--ISP
>                  |  SMC7008BR|                        | SMTP       |
>                  +---------------+                        +-------------+
>                   192.168.0.xxx                            192.168.0.xxx
>                      DEV1
>                   |            |
>  +-----------+-+      +-+---------+
>  |   linux         | .... |    w2k      |
>  +-------------+      +-----------+
>   GnomeMeeting         NetMeeting

The formatting is somewhat broken ;-)

> - I read yesterday that it is possible to concentrate h.323 connections on a
> gatekeeper as OpenH323 Gatekeeper
>   ... do you think I have to use a gatekeeper with iptables ???

Yes, I'd recommend it. You might want to take a look at
http://www.gnugk.org. I'm using it in my private lan and it works just 
fine although my lan's topology is a little simpler than yours ;-)

> So maybe you can find my questions stupid or without any sense but I repeat
> it I got no experience with this.

Your questions are definitely not stupid.

> So, with information I received I imagine to impelement my h.323
> infrastructure as mentionned below.
> 
> - configuring iptables on NS1 (10.66.0.1) with the script mentionned above
> and replacing PCA_HOST with ip adress of NS2 (10.66.0.2)
> - installing OpenH323 gatekeeper on NS2 (10.66.0.2)
> - configuring all clients with gatekeeper NS2 (10.66.0.2).

What about using gatekeepers only? You can use gk's on NS1 and NS2 which
define each other as neighbours. Although I haven't tested this, it
should work.

With gnugk you can restrict the dynamic udp and tcp ports to stay
within a certain range whereby the range also restricts the number
of parallel connections. Anyway this solution implies that you have
to open all ports within the given ranges on NS1 in order to allow
incoming calls. This is not necessary for external calls.

Using netfilter's h323 module on NS1 would be a better solution
if you don't want to open the dynamic ports but I'm not sure whether
it works in your case. Just try it.

Please post your results as I believe that there are a lot of users
out there with similar problems.


Thomas