Howto:V13 Firewall Settings

From innovaphone-wiki

Jump to: navigation, search

Contents

Applies To

This information applies to

V13 and up

Scenario: Reverse Proxy, TURN and SBC in a DMZ

Here we would like to give an overview of the necessary ports and protocols for Reverse Proxy, TURN and SBC in the DMZ.

Firewall Configuration


WAN ⇒ DMZ DMZ ⇒ inside (Endpoints) DMZ ⇒ inside (PBX) DMZ ⇒ inside (AP) inside ⇒ DMZ DMZ ⇒ WAN
STUN/TURN (udp/tcp/3478) / / / STUN/TURN (udp/tcp/3478)

needed to talk to the TURN Server if you have blocked RTP traffic

/
LDAPS (tcp/636)

optionally LDAP (tcp/389) if you need plaintext
needed if you want to offer LDAP lookups

/ LDAPS (tcp/636)

optionally LDAP (tcp/389) if you need plaintext
needed if you want to offer LDAP lookups

LDAPS (tcp/636)

optionally LDAP (tcp/389) if you need plaintext
needed if you want to offer LDAP lookups

/ /
HTTPS/WSS (tcp/443)

optionally HTTP/WS (tcp/80) if you need plaintext
needed if you want to offer myApps
please also allow wss/ws (websocket) connections

/ HTTPS/WSS (tcp/443)

optionally HTTP/WS (tcp/80) if you need plaintext
needed if you want to offer myApps
please also allow wss/ws (websocket) connections

HTTPS/WSS (tcp/443)

optionally HTTP/WS (tcp/80) if you need plaintext
needed if you want to offer myApps
please also allow wss/ws (websocket) connections

HTTPS (tcp/<your custom port>)

Advanced UI admin access

/
H.323 (tcp/1300)

optionally H.323 (tcp/1720) if you need plaintext
needed if you want to offer Phone registrations

/ H.323 (tcp/1300)

optionally H.323 (tcp/1720) if you need plaintext or username/password auths with invalid certificates
needed if you want to offer Phone registrations

/ / /
SIPS (tcp/5061)

optionally SIP (tcp/5060) if you need plaintext
needed only if you want to accept SIP registrations, i.e. for 3rd. Party SIP phones but not for SIP-Trunks

/ SIPS (tcp/5061)

optionally SIP (tcp/5060) if you need plaintext
needed only if you want to accept SIP registrations, i.e. for 3rd. Party SIP phones but not for SIP-Trunks

/ / SIPS (tcp/5061)

optionally SIP (tcp/5060) if you need plaintext

/ RTP (udp/16384-32767, udp/50000-50299)

needed if you want to use RTP instead of TURN to inside. (eg. SIP Trunk with Media-Relay, TURN Server in DMZ)

/ / RTP (udp/16384-32767, udp/50000-50299)

needed if you want to use RTP instead of TURN to DMZ. (eg. SIP Trunk with Media-Relay, TURN Server in DMZ)

RTP (udp/xxx)

xxx are the negotiated ports in context of the outgoing sip/udp connection. The ports depend on your SIP Provider
not needed if RTP from inside to WAN is allowed directly and no media-relay is enabled)

Port Forwardings

If you have to use port forwardings often some of the needed ports are also needed by other systems (eg. Microsoft Exchange OWA access via tcp/443). If you run into this problem you have to forward the port to the reverse proxy and create rules (based on hostname) inside the reverse proxy to forward the traffic to the correct system. If you have multiple external ip addreses you can also use a separate ip address per system. See also Possible scenarios if port 443 is already in use.

The complete Workload Picture

Related Articles

Personal tools