D-Link DFL-260E User Manual for DFL-260E - Page 298
Solution A - Using NAT, Destination Port, Solution B - Without NAT, Service, TCP/UDP, Record-Route
View all D-Link DFL-260E manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 298 highlights
6.2.8. The SIP ALG Chapter 6. Security Mechanisms • Without NAT so the network topology is exposed. Solution A - Using NAT Here, the proxy and the local clients are hidden behind the IP address of the NetDefend Firewall. The setup steps are as follows: 1. Define a single SIP ALG object using the options described above. 2. Define a Service object which is associated with the SIP ALG object. The service should have: • Destination Port set to 5060 (the default SIP signalling port) • Type set to TCP/UDP 3. Define three rules in the IP rule set: • A NAT rule for outbound traffic from the local proxy and the clients on the internal network to the remote clients on, for example, the Internet. The SIP ALG will take care of all address translation needed by the NAT rule. This translation will occur both on the IP level and the application level. Neither the clients or the proxies need to be aware that the local clients are being NATed. If Record-Route is enabled on the SIP proxy, the source network of the NAT rule can include only the SIP proxy, and not the local clients. • A SAT rule for redirecting inbound SIP traffic to the private IPv4 address of the NATed local proxy. This rule will have core as the destination interface (in other words NetDefendOS itself) since inbound traffic will be sent to the private IPv4 address of the SIP proxy. • An Allow rule which matches the same type of traffic as the SAT rule defined in the previous step. OutboundFrom ProxyUsers InboundTo ProxyAndClients InboundTo ProxyAndClients Action NAT SAT SETDEST ip_proxy Allow Src Interface lan wan Src Network lannet (ip_proxy) all-nets Dest Interface Dest Network wan all-nets core wan_ip wan all-nets core wan_ip If Record-Route is enabled then the Source Network for outbound traffic from proxy users can be further restricted in the above rules by using "ip_proxy" as indicated. When an incoming call is received, the SIP ALG will follow the SAT rule and forward the SIP request to the proxy server. The proxy will in turn, forward the request to its final destination which is the client. If Record-Route is disabled at the proxy server, and depending on the state of the SIP session, the SIP ALG may forward inbound SIP messages directly to the client, bypassing the SIP proxy. This will happen automatically without further configuration. Solution B - Without NAT Without NAT, the outbound NAT rule is replaced by an Allow rule. The inbound SAT and Allow rules are replaced by a single Allow rule. OutboundFrom Action Allow Src Interface lan Src Network Dest Interface Dest Network lannet wan all-nets 298