Setting Up IpSec VPN on TB

maayan1
Posts: 30
Member Since:
2007-07-03

Although I've used trixbox for almost 2 years now and have managed to make my way through the unknown world of linux (to me at least) I wish now to expand my business' Box to include outside extensions.

Can Someone please point me\explain a How-To guide on installing and configuring IPSec on TB? (something in the way a "For Dummies" sort of guide would be very much appreciated :)...

I have installed and used Hamachi But I need A more available VPN solution that I can configure a smart cell phone to use (for example)

thanx A Lot



maayan1
Posts: 30
Member Since:
2007-07-03
anyone?

anyone?



wisey
Posts: 22
Member Since:
2007-03-02
Although not what you are

Although not what you are looking for i would look at pfsensewww.pfsense.org to implement a firewall/Vpn server setup i dont like to keep all my eggs in one basket!

Regards



SkykingOH
Posts: 9678
Member Since:
2007-12-17
Did you search IPSec and

Did you search IPSec and Linux and look at all the packages. Why people think trixbox is different is beyond me.

I think a phone system is the wrong place to run a VPN also. When Cisco PIX's go for under $50 on eBay it seem silly.

You can also use an old machine and pfSense, all depends on what you like.

Let me ask you this, forget the Linux are you able to setup a typical VPN on a router or a firewall. If not you will be lost on Linux.

--

Scott

aka "Skyking"



IcelandDreams
Posts: 415
Member Since:
2007-09-11
agreed that VPN is best done

agreed that VPN is best done at the border router. Most firewalls make that process much easier than doing it at the system level of a linux box without a VPN specific GUI tool. However if I had VoIP endpoints with VPN I'd go right to the PBX if I could, end to end encryption. None of my phones have onboard VPN but phones on remote networks work very well over a net-net VPN.
Doing IPSEC on a trixy box isn't a "Dummies" type of thing. Do it on the firewall designed to run VPNs. $0.02



maayan1
Posts: 30
Member Since:
2007-07-03
Thanks for all the

Thanks for all the responses. To answer some of the questions:
- I've looked at IPSec and linux on google but for someone with limited knowledge of linux I find that most of the times when things dont work it is because of some "minor" definitions\security issues. That was why I hoped someone is familiar with a guide similar to "trixbox without tears" which was very helpful for making the first steps into linux and asterisk.

- I am not familiar with hardware solutions nor have I implemented VPN connections in the past (except Hamachi)....nevertheless I believe it is within my capabilities and I understand and have worked with various firewalls and security hardware\applications.

Let me elaborate on my problem and perhaps some1 can give an idea on solving this:
Where I live there is Telephony\Internet supplier that gives you a router through which you get internet (they are your ISP) and two analog FXO lines. The communication between the router and the Provider is through SIP so the provider seizes the ports used for SIP and Using TB 2.2.4 I haven't been able so far to change the ports used by TB without harming my configuration.
I know the whole thing is pretty dumb: TB(digital) through Rhino4FXO (analog) to router and Provider (digital) but they wont allow direct SIP link to them and their prices are unbeatable...:(

To sum up - VPN seems to be the necessary solution which will let me connect remote extensions while not being blocked by the Provider. Will software VPN will deteriorate my TB that bad? Any other solutions?
Thanx



wisey
Posts: 22
Member Since:
2007-03-02
without seeing details of

without seeing details of your router its hard to say but it may be possible to map the ports needed for your remote clients need toarange that your isp hasn't blocked where abouts do you live and which provider do you use? with pfsense there are some good guides available to helpyou implement a vpn soloution.

pf sense is much like trixbox in that it is an open source soloution and will happily run on an old pc.

Regards



IcelandDreams
Posts: 415
Member Since:
2007-09-11
I think he is stuck with the

I think he is stuck with the router he was provided if he wants to use their lines (FXO ports). The question is if he can do *any* configuration on the router. If you can and there are basic port forwarding options I would port forward an odd port such as 5062 and map it to port 5060 and point to the internal trixbox. That way you only have to change the phone to use 5062 which should be easy. Much like you would bypass an ISP port 80 filter yet use port 80 at the server.

If he can't configure the router then it simply won't work for a remote phone since he won't be able to port forward anything. Going from the inside shouldn't be a problem unless the ISP blocks SIP which isn't very likely.

If your remotes are on a remote network that allows you to configure a VPN then there is hope but again this isn't a simple task without previous experience. If by chance your provider is a cable modem then you might be able to run two firewalls with one being available for normal SIP/IAX port forwarding.



maayan1
Posts: 30
Member Since:
2007-07-03
Thanx for all the replies I

Thanx for all the replies

I used the port forwarding on the Router to configure an "odd" port like IcelandDreams suggested and it worked great with a softphone.
I now have the somewhat common problem of calls disconnected after 20sec But I looking for a solution to this (although a few ppl posted the issue I havent seen a solution).
I will check out pfsense also because leaving TB with the sip and RTP ports "open to the public" seems a too-big-of-a-risk to my taste....

All of you have been very helpful



Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.