Howto13r1:Firewall Settings
Applies To
This information applies to
V13 and up
Scenario: Reverse Proxy, TURN and SBC in a DMZ
Here we would like to give an overview of the necessary ports and protocols for Reverse Proxy, TURN and SBC in the DMZ.
Configuration
- Before you can setup your Firewall you have to read the book Reverse Proxy in the V13 IT Connect Training.
- If you already have used some of the port forwards from the column WAN ⇒ DMZ for other Systems you have to combine all forwards in the reverse Proxy or use a separate ip address
WAN ⇒ DMZ | DMZ ⇒ inside (Endpoints) | DMZ ⇒ inside (PBX) | DMZ ⇒ inside (AP) | inside ⇒ DMZ | DMZ ⇒ WAN |
---|---|---|---|---|---|
STUN/TURN (udp/tcp/3478) | / | / | / | STUN/TURN (udp/tcp/3478) • needed to talk to the TURN Server if you have blocked RTP traffic |
/ |
LDAPS (tcp/636) • optionally LDAP (tcp/389) if you need plaintext |
/ | LDAPS (tcp/636) • optionally LDAP (tcp/389) if you need plaintext |
LDAPS (tcp/636) • optionally LDAP (tcp/389) if you need plaintext |
/ | / |
HTTPS (tcp/443) • optionally HTTP (tcp/80) if you need plaintext |
/ | HTTPS (tcp/443) • optionally HTTP (tcp/80) if you need plaintext |
HTTPS (tcp/443) • optionally HTTP (tcp/80) if you need plaintext |
HTTPS (tcp/<your custom port>) • Advanced UI admin access |
/ |
H.323 (tcp/1300) • optionally H.323 (tcp/1720) if you need plaintext |
/ | H.323 (tcp/1300) • optionally H.323 (tcp/1720) if you need plaintext or username/password auths with invalid certificates |
/ | / | / |
SIPS (tcp/5061) • optionally SIP (tcp/5060) if you need plaintext |
/ | SIPS (tcp/5061) • optionally SIP (tcp/5060) if you need plaintext |
/ | / | SIPS (tcp/5061) • optionally SIP (tcp/5060) if you need plaintext |
/ | RTP (udp/16384-32767, udp/50000-50299) • needed if you want to use RTP instead of TURN to inside. (eg. SIP Trunk with Media-Relay, TURN Server in DMZ) |
/ | / | RTP (udp/16384-32767, udp/50000-50299) • needed if you want to use RTP instead of TURN to DMZ. (eg. SIP Trunk with Media-Relay, TURN Server in DMZ) |
RTP (udp/xxx) • xxx are the negotiated ports in context of the outgoing sip/udp connection. The ports depend on your SIP Provider |