what IP does your FreePBX box report? This will make sure your SNAT is working right.
[[email protected] ~]$ curl ifconfig.co
68.XXX.XXX.XXX
[[email protected] ~]$
Thanks @Kelly for this btw.
https://mangolassi.it/topic/14922/neat-trick-for-routing-and-linux
Obviously, yours will have some SNAT rules that I do not as I only have a single IP here. So all the SNAT is handled by the default masquerade
@eddiejennings said in RTP traffic being sent to incorrect IP address:
@scottalanmiller said in RTP traffic being sent to incorrect IP address:
WAN_IN, shouldn't the firewall rule allow based on the public IP, not the translated LAN IP?
With VyOS, NAT is done before firewall rules for inbound traffic and after firewall rules for outbound traffic.
Correct. Here are my WAN_IN and NAT rules for a site that has an EdgeRouter 4
name WAN_IN {
default-action drop
description "Internet to internal networks"
rule 10 {
action accept
description "Accept Established / Related"
log disable
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop Invalid"
log disable
state {
invalid enable
}
}
rule 40 {
action accept
description "Allow Telnet from Epicor"
destination {
address 10.1.1.250
port 23
}
log enable
protocol tcp
source {
group {
address-group EpicorIPAddr
}
}
}
rule 41 {
action accept
description "Allow RDP from Epicor"
destination {
address 10.1.1.12
port 3389
}
log enable
protocol tcp
source {
group {
address-group EpicorIPAddr
}
}
}
rule 42 {
action accept
description "Allow SMTP from Google"
destination {
group {
address-group Exchange_Servers
port-group SMTP_Ports
}
}
log disable
protocol tcp
source {
group {
network-group Google_SMTP_Networks
}
}
state {
established disable
invalid disable
new enable
related disable
}
}
}
nat {
rule 1 {
description "Forward Telnet from Epicor"
destination {
group {
address-group ADDRv4_eth0
}
port 23
}
inbound-interface eth0
inside-address {
address 10.1.1.250
port 23
}
log enable
protocol tcp
source {
group {
address-group EpicorIPAddr
}
}
type destination
}
rule 2 {
description "Forward RDP from Epicor"
destination {
group {
address-group ADDRv4_eth0
}
port 3389
}
inbound-interface eth0
inside-address {
address 10.1.1.12
port 3389
}
log enable
protocol tcp
source {
group {
address-group EpicorIPAddr
}
}
type destination
}
rule 3 {
description "Allow SMTP from Google"
destination {
group {
address-group ADDRv4_eth0
}
port 25
}
inbound-interface eth0
inside-address {
address 10.1.1.5
port 25
}
log disable
protocol tcp
source {
group {
network-group Google_SMTP_Networks
}
}
type destination
}
rule 4 {
description "Allow SMTP from Google"
destination {
group {
address-group ADDRv4_eth0
}
port 587
}
inbound-interface eth0
inside-address {
address 10.1.1.5
port 587
}
log disable
protocol tcp
source {
group {
network-group Google_SMTP_Networks
}
}
type destination
}
rule 5004 {
description "Default NAT Masquerade"
log disable
outbound-interface eth0
protocol all
type masquerade
}
}
Is FreePBX configured correctly?
Settings -> Asterisk SIP Settings
@dave247 said in Trying to correctly understand core licensing in a vmware environment:
@scottalanmiller said in Trying to correctly understand core licensing in a vmware environment:
@dave247 said in Trying to correctly understand core licensing in a vmware environment:
@scottalanmiller said in Trying to correctly understand core licensing in a vmware environment:
@dave247 said in Trying to correctly understand core licensing in a vmware environment:
@scottalanmiller said in Trying to correctly understand core licensing in a vmware environment:
Now to make things more complicated, if you didn't want cluster mobility, but only failover, you can move to SA licensing which isn't cheap, but is way cheaper than this. But if you wanted that, the three node cluster doesn't make sense. So based on the example, SA doesn't cover the goals.
So this is the first time I think I've heard of Software Assurance, and I've just looked it up and done a bit of reading. I understood the words that I read, but it's not really clear to me what exactly SA is or how it could help me in this situation... would you mind helping me understand?
SA is a "maintenance plan" for your Microsoft software products that are not SaaS (so MS office, Windows desktop, Windows Server, Exchange, SQL Server, etc.)
Basically, if you buy software the non-SA way, you pay for it and then... that's it. One time cost, and that's all you pay and.. that's all you get. It's very straightforward.
With SA, you get several benefits, but essentially there is one big one that is what SA is really about - you pay a small amount annually and you get upgrade rights. So, as long as you maintain your SA on a product, it changes it from...
Non-SA: "I bought Windows Server 2016!"
to
SA: "I bought Windows Server!"
You no longer care about the "version" that you buy, your SA means you have the right to use any recent version (so right now that's something like 2008 R2, 2012, 2012 R2, 2016, and 2019 in a few weeks.) You can deploy any of them that make sense today, and upgrade anytime that you want. No more "paying for the next version."
You get lots of silly extra like training and "support", but it's all minor. Sometimes certain features like maybe VDI are included with SA only, in those cases it can be a bigger deal.
In the Windows world, SA is often just considered a part of the license cost and most people ignore that there is even another way to buy Windows because it's the cheaper way to keep your Windows running healthy. Paying for each new version is more costly and more complex. But in the extreme small business arena, skipping SA is common and is often a major contributing factor to finding shops with extremely outdated systems because the pain of the full cost for the next upgrade was too much, but SA makes it a small, annual fee every year instead which is way easier to budget for.
So, does that mean if I installed 2008 R2 several years ago, with SA, I can move that server to a 2016 box for free? Otherwise I still don't understand.
Yes. Where "free" = "already paid for SA". So no additional cost.
but... doesn't that like circumvent the new core licensing??
No. It converted to 16 cores. This is also assuming that you have maintained SA this whole time. It is a yearly cost.
@ccwtech said in Ping... Is a 2 or 4 ms return on ethernet significant?:
That's their main switch. No other switches to bypass.
The point was ping something besides the server.
The server has all kinds of reason to provide bad responses.
If nothing else pings with odd response times, it means it is the server.
@black3dynamite said in Best naming strategy for IT assets:
Using Snipe-IT, we use a two-letter prefix followed by a five-digit number.
We have a 2-3 letter prefix (company initials) and then 5 digit number also.
@eddiejennings said in What Are You Doing Right Now:
@jaredbusch said in What Are You Doing Right Now:
@eddiejennings said in What Are You Doing Right Now:
Working on my FreePBX and VyOS vms.
Give me an hour to get a few drinks in me then ask away!
Ha!
This is a little different than using FreePBX on a Vultr instance. My current experiment is this:
- NAT traffic to the pbx (not ports configured on this)
- Allow only necessary ports in with my WAN_IN firewall rule set
- Let the responsive firewall do it's thing.
#2 is probably not necessary, as I could just let any traffic to the pbx through and just rely on the responsive firewall, but this is an experiment; thus, a chance to see if I can configure it like this.
You need 5060/5061 for SIP and SIP with TLS.
RTP is 10000-20000 by default. You can narrow that in FreePBX.
