Howto13r1:Firewall Settings

Applies To

This information applies to

V13 and up

Scenario: Reverse Proxy, TURN and SBC in a DMZ

Here we would like to give an overview of the necessary ports and protocols for Reverse Proxy, TURN and SBC in the DMZ.

Firewall Configuration

• Before you can setup your Firewall you have to read the book Reverse Proxy.

WAN ⇒ DMZ	DMZ ⇒ inside (Endpoints)	DMZ ⇒ inside (PBX)	DMZ ⇒ inside (AP)	inside ⇒ DMZ	DMZ ⇒ WAN
STUN/TURN (udp/tcp/3478)	/	/	/	STUN/TURN (udp/tcp/3478)	/
TURN Extern (tcp/xxxx) • optionally TCP Port if you configure a fallback way	/	/	/	TURN Extern (tcp/xxxx) • optionally TCP Port if you configure a fallback way	/
LDAPS (tcp/636) • optionally LDAP (tcp/389) if you need plaintext • needed if you want to offer LDAP lookups	/	LDAPS (tcp/636) • optionally LDAP (tcp/389) if you need plaintext • needed if you want to offer LDAP lookups	LDAPS (tcp/636) • optionally LDAP (tcp/389) if you need plaintext • needed if you want to offer LDAP lookups	/	/
HTTPS/WSS (tcp/443) • optionally HTTP/WS (tcp/80) if you need plaintext • needed if you want to offer myApps • please also allow wss/ws (websocket) connections	/	HTTPS/WSS (tcp/443) • optionally HTTP/WS (tcp/80) if you need plaintext • needed if you want to offer myApps • please also allow wss/ws (websocket) connections	HTTPS/WSS (tcp/443) • optionally HTTP/WS (tcp/80) if you need plaintext • needed if you want to offer myApps • please also allow wss/ws (websocket) connections	HTTPS (tcp/<your custom port>) • Advanced UI admin access	/
H.323 (tcp/1300) • optionally H.323 (tcp/1720) if you need plaintext • needed if you want to offer Phone registrations	/	H.323 (tcp/1300) • optionally H.323 (tcp/1720) if you need plaintext or username/password auths with invalid certificates • needed if you want to offer Phone registrations	/	/	/
SIPS (tcp/5061) • optionally SIP (tcp/5060) if you need plaintext • needed only if you want to accept SIP registrations, i.e. for 3rd. Party SIP phones but not for SIP-Trunks	/	SIPS (tcp/5061) • optionally SIP (tcp/5060) if you need plaintext • needed only if you want to accept SIP registrations, i.e. for 3rd. Party SIP phones but not for SIP-Trunks	/	/	SIPS (tcp/5061) • optionally SIP (tcp/5060) if you need plaintext
/	RTP (udp/16384-32767, udp/50000-50299) • needed if you want to use RTP instead of TURN to inside. (eg. SIP Trunk with Media-Relay, TURN Server in DMZ)	/	/	RTP (udp/16384-32767, udp/50000-50299) • needed if you want to use RTP instead of TURN to DMZ. (eg. SIP Trunk with Media-Relay, TURN Server in DMZ)	RTP (udp/xxx) • xxx are the negotiated ports in context of the outgoing sip/udp connection. The ports depend on your SIP Provider • not needed if RTP from inside to WAN is allowed directly and no media-relay is enabled)

Port Forwardings

If you have to use port forwardings often some of the needed ports are also needed by other systems (eg. Microsoft Exchange OWA access via tcp/443). If you run into this problem you have to forward the port to the reverse proxy and create rules (based on hostname) inside the reverse proxy to forward the traffic to the correct system. If you have multiple external ip addreses you can also use a separate ip address per system. See also Possible scenarios if port 443 is already in use.

Port Forwardings for 3rd-party SIP phones

Be aware that 3rd-party SIP-phones can use different port number ranges for RTP. Depending on the configured restrictions on your firewall, you might need to adapt your firewall settings for the used port ranges. Consult the manufacturers' documentation which range to configure.

The complete Workload Picture

Related Articles

• Howto:Innovaphones_public_services
• Courseware:IT_Advanced_-_06_Public_Access_to_PBX_Resources_(theory)_-_optional
• Courseware:IT_Advanced_-_07_Public_access_to_PBX_resources_(practice)