VoIP Mailing List Archives

[gregor at infomedia.si]

I have defined ACL with IPs and if I test IP in CLI with acl xxx.xxx.xxx.xxx aclname, I get true. But when a call is made from this IP, it doesn't get authenticated.


Any ideas why?


BR, Gregor

[gregor at infomedia.si]

Only difference between IPs that are correctly authenticated and this one is that for non working IP I get in log:
fc740b4d-d48d-41c9-b06d-75cc8f23a833 2023-01-02 15:09:48.685609 97.43% [INFO] sofia.c:10462 sofia/external/xxxxxxxxx@xxx.xxx.xxx.186receiving invite from xxx.xxx.xxx.186:5060



there is external instead of internal. One of our gateway is registered to similar IP. For example: non authenticated IP is: xxx.xxx.xxx.186 and gateways is connected to xxx.xxx.xxx.190


Since it is the same subdomain, is it possible that FS thinks that this is from external?


BR, Gregor


On Tue, 3 Jan 2023 at 09:50, Gregor Nanger <gregor@infomedia.si (gregor@infomedia.si)> wrote:

[brian at freeswitch.com]

Pay attention to the default allow / deny settings you may have it inverted


On Tue, Jan 3, 2023 at 7:32 AM Gregor Nanger <gregor@infomedia.si (gregor@infomedia.si)> wrote:

[gregor at infomedia.si]

Well, I double checked. And if I test in CLI with acl it works ok.


Could it be, that FS takes this IP as external as similar IP (same subnet) is used in gateway to register trunk? And since it is external there is no apply_inbound_acl on this profile.


On Wed, 4 Jan 2023 at 02:48, Brian West <brian@freeswitch.com (brian@freeswitch.com)> wrote:

[brian at freeswitch.com]

The issue I see is we've done a bad job of documenting the negative vs positive ACL cases, they are used in various ways, so a default allow, vs deny on the acl vs each entry. 

Which setting are you using the ACL in, and how is the ACL setup?


/b




On Wed, Jan 4, 2023 at 4:29 AM Gregor Nanger <gregor@infomedia.si (gregor@infomedia.si)> wrote:

[gregor at infomedia.si]

No, you've made a good job. I overlooked that invite is coming to port 5080. Although that I lost hours looking at it.


Thank you for your time.



/g


On Wed, 4 Jan 2023 at 18:55, Brian West <brian@freeswitch.com (brian@freeswitch.com)> wrote:

[brian at freeswitch.com]

Excellent that its resolved, but we still need to clean up the areas where ACLs docs to help make some of these more clear.

On Wed, Jan 4, 2023 at 3:32 PM Gregor Nanger <gregor@infomedia.si (gregor@infomedia.si)> wrote: