D-Link DFL-1600 Benutzerhandbuch
•
Destination Port set to 5060 (the default SIP signalling port)
•
Type set to TCP/UDP
3.
Define four rules in the IP rule set:
•
An Allow rule for outbound traffic from the clients on the internal network to the proxy
located on the DMZ interface.
located on the DMZ interface.
•
An Allow rule for outbound traffic from the proxy behind the DMZ interface to the remote
clients on the Internet.
clients on the Internet.
•
An Allow rule for inbound SIP traffic from the SIP proxy behind the DMZ interface to the
clients located on the local, protected network.
clients located on the local, protected network.
•
An Allow rule for inbound SIP traffic from clients and proxies on the Internet to the proxy
behind the DMZ interface.
behind the DMZ interface.
4.
If Record-Route is not enabled at the proxy, direct exchange of SIP messages must also be
allowed between clients, bypassing the proxy. The following two additional rules are therefore
needed when Record-Route is disabled:
allowed between clients, bypassing the proxy. The following two additional rules are therefore
needed when Record-Route is disabled:
•
An Allow rule for outbound traffic from the clients on the local network to the external
clients and proxies on the Internet.
clients and proxies on the Internet.
•
An Allow rule for inbound SIP traffic from the Internet to clients on the local network.
The IP rules with Record-Route enabled are:
Action
Src Interface
Src Network
Dest Interface
Dest Network
OutboundToProxy
Allow
lan
lannet
dmz
ip_proxy
OutboundFromProxy
Allow
dmz
ip_proxy
lan
lannet
InboundFromProxy
Allow
dmz
ip_proxy
core
dmz_ip
InboundToProxy
Allow
wan
all-nets
dmz
ip_proxy
With Record-Route disabled, the following IP rules must be added to those above:
Action
Src Interface
Src Network
Dest Interface
Dest Network
OutboundBypassProxy
Allow
lan
lannet
wan
all-nets
InboundBypassProxy
Allow
wan
all-nets
lan
lannet
6.2.9. The H.323 ALG
H.323 is a standard approved by the International Telecommunication Union (ITU) to allow
compatibility in video conference transmissions over IP networks. It is used for real-time audio,
video and data communication over packet-based networks such as the Internet. It specifies the
components, protocols and procedures for providing such multimedia communication, including
Internet phone and voice-over-IP (VoIP).
compatibility in video conference transmissions over IP networks. It is used for real-time audio,
video and data communication over packet-based networks such as the Internet. It specifies the
components, protocols and procedures for providing such multimedia communication, including
Internet phone and voice-over-IP (VoIP).
H.323 Components
H.323 consists of four main components:
Terminals
Devices used for audio and optionally video or data
communication, such as phones, conferencing units, or
"software phones" such as the product "NetMeeting".
communication, such as phones, conferencing units, or
"software phones" such as the product "NetMeeting".
6.2.9. The H.323 ALG
Chapter 6. Security Mechanisms
280