From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mohammad Khan Subject: Re: net2phone rules Date: Mon, 14 Feb 2005 17:16:07 -0500 Message-ID: <1108419367.13080.18.camel@localhost.localdomain> References: <55503955141a.55141a555039@vsnl.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit In-Reply-To: <55503955141a.55141a555039@vsnl.net> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: varun_saa@vsnl.net, netfilter@lists.netfilter.org On Tue, 2005-02-08 at 01:01, varun_saa@vsnl.net wrote: > Hello, > I want my firewall to allow Net2phone. > > A visit to http://web.net2phone.com/consumer/commcenter/helpfirewall.asp > states that you need to open up at least three ports: > tcp 80 - tcp 6800 - udp 6801. > > One should use INPUT or FORWARD rule ? Depends on where is your net2phone client. If it is *NOT* on your firewall, use FORWARD I visited the net2phone link, your forward rules should be # Following two rules would allow log in, # maintaining online status, and instant messaging -A FORWARD -s internal_ne_ips -d relay.net2phone.com -p tcp --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT -A FORWARD -s relay.net2phone -p tcp --sport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT # Following two rules would allow voice packets to go out -A FORWARD -s internal_net_ips tcp --sport 6800 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT -A FORWARD -s internal_net_ips -p udp --sport 6801 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT # Following two rules would allow voice packets to get in -A FORWARD -d external_ip tcp --dport 6800 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT -A FORWARD -d external_ip -p udp --dport 6801 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT Above rules can be made more restrictive ! Enjoy firewalling. Mohammad -- "Mad cow? You'd be mad too, if someone was trying to eat you."