Bypassing Broken SIP ALG Implementations

January 11, 2015 by Rick Osgood 15 Comments

The SIP protocol is commonly used for IP telephone communications. Unfortunately it’s notorious for having issues with NAT traversal. Even some major vendors can’t seem to get it right. [Stephen] had this problem with his Cisco WRVS4400N router. After a bit of troubleshooting, he was able to come up with a workaround that others may find useful.

The router had built in SIP ALG functionality, but it just didn’t work. [Stephen] was trying to route SIP traffic from a phone to an Asterisk PBX system behind the router. The router just couldn’t properly handle these packets regardless of whether SIP ALG was enabled or disabled.

[Stephen] first tried to change the SIP port on the external VOIP phone from the default of 5060 to something else. Then he setup port forwarding on the router to the Asterisk box to forward the traffic to the Asterisk system on the original port. This sort of worked. The calls would go through but they would eventually drop after about 20 seconds.

The only thing that [Stephen] could get to work completely was to change the SIP port in Asterisk’s sip.conf file using the “bindport” directive. He changed it to some random unused high port number. Then he setup port forwarding on the router to forward incoming UDP packets on that port to the Asterisk system. This worked fine, but now all of the original phones behind the router stopped working because they were configured to use the default port of 5060.

Rather than re-configure all of the phones in the organization, [Stephen] made one change on the Asterisk system. He setup an iptables rule to forward all incoming traffic on UDP port 5060 to the new SIP port. Now all of the phones are working with minimal changes across the organization. It’s a lot of hassle to go through just because the router couldn’t handle SIP correctly, but it gets the job done.

Finally, A Firewall For All The Porn On The Internet

July 29, 2013 by Brian Benchoff 34 Comments

porn

The current UK government is proposing an Internet porn firewall. Unlike other countries with Internet firewalls, such as North Korea, China, Iran, Saudi Arabia, and Syria, the citizens of the UK are so especially helpful some of them decided to help code the new porn filter. The idea behind the Great Firewall of Porn is simple: if a user wants to visit a NSFW website, let them. If, the user wants to visit the other 19% of the Internet, block it, and forward them to a page with hand drawn cockswains a baubles as the background.

The way the firewall works is actually pretty clever – it checks each request against the OpenDNS FamilyShield filter. If the request is denied, load the page, and if the OpenDNS request is allowed, block the page.

The genius behind this filter, [sicksad], provided all the tools required to get your own porn filter up and running over on his git. There’s also a great setup tutorial video available below, with a little social commentary thrown in for free.

Continue reading “Finally, A Firewall For All The Porn On The Internet” →

Adding Mobile Control To Your Gardening

October 11, 2010 by Mike Szczys 13 Comments

[The Cheap Vegetable Gardener] wanted to check in on his garden from the road so he wrote a control app for his WinPhone. The hardware work is already done; having been built and tested for quite some time.

The implementation comes in two parts, both shown in the chart above. The grow box is behind a firewall as you don’t want random folks turning on the water and grow lights on a whim. The first part of the interface takes care of this separation by providing a set of functions on the host machine. The second portion is the phone app itself which calls those functions and displays all the pertinent information from the status of the lights, heater, exhaust, and water pump, to the current temperature and humidity. He’s even used Google Charts to graph data over time. The app itself took about two hours to code with no prior experience, a testament to the level of approachability these tools are gaining.

Investigating The Leopard Firewall

November 1, 2007 by Eliot 5 Comments

Our friend [Rich Mogull] has been flipping the switches on Leopard’s new firewall and scanning it to see what’s actually going on. There is some good and some bad. The new application signing is a mixed bag. It breaks Skype and a commenter pointed out that automatically trusting Apple installed apps like NetCat isn’t a good idea either. You can roll your own firewall using user friendly tools like WaterRoof since ipfw is still included.