Webmin is a web-based tool that allows you to manage Linux-based operating systems such as Ubuntu.
From this web interface, you can control various features of your Ubuntu operating system, such as users, system settings and more.
Source: How to Install Webmin on Ubuntu – Pi My Life Up
Webmin is an open source, web based system administration tool for Unix/Linux. Using Webmin, you can setup and configure all services such as DNS, DHCP, Apache, NFS, and Samba etc via any modern web browsers. So, you don’t have to remember all commands or edit any configuration files manually.
Source: Install Webmin On Ubuntu 14 15 and 16 | Unixmen (Unixmen)
One problem that some VoIP users are experiencing these days is that they have trouble connecting to their home Asterisk, FreeSWITCH, YATE, or other software PBX server, but only when using certain ISP’s. One suspicion is that certain ISP’s that offer their own VoIP or traditional landline service attempt to mess with packets using the common SIP port 5060, hoping customers will think that VoIP is unreliable and will subscribe to the company’s overpriced offering instead (see this thread at BroadbandReports.com).
There are various ways to enable an alternate SIP port on the server (in addition to the usual port 5060) but if you are using Webmin to manage your firewall, here’s an easy way, in just three steps:
Step 1:
If you use Webmin to manage your firewall, then you already know how to get to the Linux Firewall page. So go there and select the Network Address Translation (nat) table in the dropdown at the top of the page. Then when the page changes, click the topmost Add Rule button (in the Packets before routing (PREROUTING) section):
Step 2:
Now you should see this page. The items you need to change are indicated by the red ovals. The Destination TCP or UDP port is set to 7654 in this example, but don’t use that. Pick your own unique port; just make sure that it’s not used by anything else on the server already. And yes, you really do put the alternate SIP port you want to use in the Destination setting; it may not make intuitive sense but that’s just how it is. Avoid using ports in the range 10000 through 20000 because those are used for RTP traffic, and avoid ports below 1024 because those are protected ports that are reserved by the system. There are also other ports you should avoid (those used by other software on your system) but if you don’t know how to find ports in use on your system, a bit of time with a search engine will lead you to several pages that show you how to detect already active ports. It can vary a bit depending on your operating system, and it’s beyond the scope of this article.
SIP traffic is UDP only, not TCP (there may be rare exceptions but most software PBX’s use UDP by default). If by some very odd chance you are using TCP for SIP traffic (why?!?) then you will need to specify that under the Network Protocol item. Also, note that the incoming interface is set to eth0 in this example – Webmin will usually show the correct one by default, but you want to select the interface used by incoming SIP traffic if you happen to have more than one. Don’t forget to click Save when you’re finished.
Step 3:
After you have saved the page you should be back at the page you came from, and it should now show your new forwarding rule. If it does, just click Apply Configuration at the bottom of the page to make it active:
One other thing you might need to to is add a rule on the main Linux Firewall page allowing incoming traffic on your selected alternate port, if you have a restrictive firewall that blocks most traffic by default. Try it first without doing that, but if your clients can’t connect on the alternate port, just be aware that you may need to do that before they will be able to connect. For more security, you can enable access to your SIP ports only from specific IP addresses, if your remote clients are at fixed IP addresses.
Now you should be able to change the port number on your SIP endpoints from the default 5060 to your alternate port. Of course I can’t guarantee it will always work, but if you try it and suddenly find that your SIP connections become far more reliable, you might want to leave a comment, and mention the ISP that you suspect might be messing with SIP traffic.
By the way, if you are NOT using Webmin to manage your firewall, and have iptables installed, then all you should need to do is enter these two lines from a command prompt (replace 7654 with your chosen alternate port). But I strongly caution you NOT to do this if you are using Webmin to manage your firewall:
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 7654 -j REDIRECT --to-ports 5060
/etc/init.d/iptables save
Bacula is an open source network backup solution that permits you to backup and restore the data’s from a local or group of remote networked computers. It is very easy in terms of installation and configuration with many advanced storage management features.
In this tutorial, let us see how to install and configure Bacula on Ubuntu 14.04 server.
Full article here:
Setup Backup Server Using Bacula And Webmin On Ubuntu 14.04 (Unixmen)
Webmin is a web-based interface for system administration for Unix. Using any modern web browser, you can setup user accounts, Apache, DNS, file sharing and much more. Webmin removes the need to manually edit Unix configuration files like /etc/passwd, and lets you manage a system from the console or remotely.
Full article here:
How to install webmin on ubuntu 13.10 (Saucy Salamander) Server (Ubuntu Geek)
This is going to be a very barebones explanation because to be honest I’m really not motivated to make things easier for FreePBX users anymore. I really want you to think about trying other PBX software that doesn’t treat its users as if they need afternoon naps and their diapers changed occasionally.
But I have found a way to overcome the limitation, however you need Webmin or phpMyAdmin, and you need to be very careful because one wrong click could screw up your database. I use Webmin so that’s what I’ll be talking about here. I am NOT telling you to do this on your system, and if you should choose to follow my example and mess up your system, don’t email me about it because I can’t help you and I’m warning you that this might be dangerous if you don’t know what you are doing, and I will not assume any responsibility for what you choose to do. You break it, you own all the parts. Also note that I’m doing this on an FreePBX 2.8 system, so if you are using another version, things might be different from what I’m describing. This is what I have done that worked for me; it may or may not work for you, but if you wish to attempt it I strongly recommend that you make sure you have a full system backup (MondoRescue is a good program to use to create such a backup).
In Webmin, go into Servers | MySQL Database Server and in the MySQL Databases section, click on the icon or label (NOT the checkbox) for asterisk.
On the next page, you may get a message saying “There are too many tables to display. Find tables matching” followed by a search field. If so, enter the word “Outbound” and click “Search”.
Click on the icon or label (NOT the checkbox) for outbound_route_trunks
At this point, if your browser supports it, duplicate the tab so you have two tabs showing this page. In the first, click the Export as CSV button and in the next page, select “Yes” for “Include column names in CSV?“and select “Display in browser” as the Export Destination and then click Export Now. You should see a display showing your Outbound Routes, but since they are all identified by numbers, you won’t know which is which. Leave this tab open and do not reload it. This is a “snapshot” of your Outbound Route trunk selections as the database sees them, before you make any changes.
Now open another browser tab and go to the Outbound Route page for the route where you want to select the same trunk twice. In the Trunk Sequence for Matched Routes section, where you’d add the desired trunk the second time, add ANY other trunk instead, and Submit Changes, but don’t click the orange bar to apply the configuration changes. Do make sure that everything is correct in the route configuration because after you finish this you won’t be able to make any changes without repeating all these tedious steps, which would be totally unnecessary if… never mind. And make a mental note of the total number of trunks in the list, and don’t make any changes to any other Outbound Routes until you’ve completed this process. EDIT: Also, while that same Outbound Route page is open, look at your browser’s URL bar and note the address that is open — that may include the route_id number that will be needed in the next step. For example, if the address is https://your.server.address/admin/config.php?display=routing&extdisplay=21 then 21 is most likely the route_id number.
Now go back to the duplicated Webmin tab (the one NOT showing the CSV display), and click View Data. Under route_id, each outbound route is identified by a number, and the number of times that number appears equals the number of trunks in the Trunk Sequence for Matched Routes section, Note that if there are more than 25 entries you may have to page through them to find the route you are trying to change. So, let’s say that your Outbound Route originally had one trunk selection, and you added the second one which is incorrect, just to force FreePBX to accept it, so there is now a total of two trunks for that route. You’d look through the route_id’s to find one where the route_id number is listed twice (as many times as the number of trunk selections) and note the route_id number. You would then flip back to the other tab showing the CSV output to see if that route was only listed once (only had one trunk selected) when you took the CSV “snapshot”. If so, you have found the correct route; if not, keep looking.
The trunk order is determined by the number in the seq column and is zero based, so if you had two trunks total, and the first trunk was correct and the second was the incorrect trunk that you added, then look for the line with the correct route_id number and 0 in the seq column, and note the trunk_id for that line. Now find the line with the same route_id number but with 1 in the seq column. Make a mental note of the trunk_id so you can change it back if you somehow managed to get the wrong route, and click the checkbox at the start of the line and then click Edit Selected Rows. That row should turn into text boxes and what you want to do is change the trunk_id so that it matches that of the trunk selection you want to duplicate (the one with 0 in the seq column in this example). Click Save.
Go back to the Outbound Route page and do not click Submit Changes. Instead, reload the page, or go to another Outbound Route and come back. It should show the duplicated trunk where the incorrect trunk selection was. Once again, do not click Submit Changes, but NOW you can click the orange bar to apply the configuration changes. Remember that if you EVER click “Submit Changes” on this page from now on, the duplicated trunk will be removed and you get to do this all over again (unless you can figure out how to modify the source code so it doesn’t do that). 🙁
If you use phpMyAdmin you should be able to do something similar. Just remember that every time you need to go through this tedious procedure, you can silently “thank” the FreePBX developers for once again making the extra effort to make life difficult for their experienced users.
If you’ve somehow managed to screw up your system by doing this (and I hope you don’t), just remember I warned you that doing this could be dangerous, but on the flip side, now would be a really good time to try some other software (you could try FusionPBX, for example).
If you run Asterisk you may have encountered this issue: Your Internet connection goes down, and so does your ability to call from extension to extension, even between extensions on your local network. This is a long-standing bug in Asterisk (exactly the sort of bug that drives people to try alternatives such as FreeSWITCH) but let’s say that for whatever reason you need to stick with Asterisk, so you’d like to find a way to make that bug go away. Without going into all the technical details, the reason that calls fail is that Asterisk can’t access a DNS server. I’ve read several reports that say the easiest solution is to install the BIND DNS server on the same machine as your Asterisk server. If you are also running Webmin on the server, installing and configuring BIND is a relative piece of cake. So here’s how it’s done. Please note that most of the images below can be enlarged by clicking on them, and that I have installed the StressFree theme in Webmin, so if it looks a little different from what you’re used to seeing, that’s probably why.
To start with, log into Webmin, click on “Servers”, then click on “BIND DNS Server” (if you don’t find it there, try looking in “Un-used Modules”):
Assuming you have not previously installed BIND, you’ll get a screen like this. Just click where it says “Click here”:
You will then see this screen come up as BIND is installed. Just let it run to completion and (assuming it installs successfully) click on “Return to BIND DNS Server” at the bottom of the page:
Next, because you don’t yet have an /etc/named.conf file, you’ll see this page. Click the button for “Setup nameserver for internal non-internet use only” (don’t worry, we’ll fix it in the next steps), then click the bar that says “Create Primary Configuration File and Start Nameserver”:
At this point BIND is installed and running, but it probably isn’t doing what you want it to, and your system isn’t using it. So the first thing we need to do is tell it where to go when it needs to do a DNS lookup. You should be seeing a page that looks like this — click on “Forwarding and Transfers”:
When you get to the following screen, check “Yes” next to “Lookup directly if forwarders cannot?” You also need to enter one or more addresses of DNS servers that BIND can access when it needs to pull a DNS record. You might want to give some thought to which DNS servers you want to use, and in what order, before you start entering them. You can enter up to three IP addresses of DNS servers, and then click “Save”. This will throw you out to the previous screen, and if by some chance you want to enter even more DNS servers, you can click on “Forwarding and Transfers” again to come back and enter up to three more servers, until you are finished. In this example, I have already entered the IP addresses of my router’s DNS Server as the top priority pick, followed by two Google DNS Server addresses.
Once you have done this, you are through configuring BIND directly, but there are two more things we need to do. The first is to make sure that the BIND server starts each time we restart the machine. To do that, go to Webmin’s “System” page and then click on “Bootup and Shutdown”:
This is a long page so I’m not showing all of it — what you have to do is find the entry for named and check the box next to it:
Then go to the bottom of the page and click “Start on Boot”:
At this point BIND is running, and should be using the correct DNS servers, and is set to start at bootup, but your server still isn’t using it for its DNS queries. To get it to do that, go to Webmin’s “Networking” page and click on “Network Configuration”:
Once on the Network Configuration page, click on “Hostname and DNS Client”:
Once on the Hostname and DNS Client page, what you need to do is make the first entry in the DNS Servers list 127.0.0.1. If you trust BIND to always be operating, that’s the only entry you need. I didn’t quite trust BIND that much (actually, what I didn’t trust was my ability to set this up correctly) so I set the DNS server in the router as the secondary DNS address. You could use any DNS server as the secondary, or you could choose to just enter the 127.0.0.1 address to use BIND and let it go at that. Personally, I feel a lot more comfortable having a “fallback” DNS. Don’t forget to click “Save” when you are finished making changes here:
That’s all there is to it, as far as I know (if you think I’ve missed anything or done something wrong, the comment section is open!). If you’re like me, the next question you will have is, “How do I know it’s working?” And the easiest way to do that is to go to a Linux command prompt and “dig” some site you have not been to recently twice in a row. Here’s an example, using cnn.com — the part we are interested in is in red:
# dig cnn.com
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> cnn.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8274
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 13, ADDITIONAL: 9
;; QUESTION SECTION:
;cnn.com. IN A
;; ANSWER SECTION:
cnn.com. 287 IN A 157.166.224.25
cnn.com. 287 IN A 157.166.224.26
cnn.com. 287 IN A 157.166.226.25
cnn.com. 287 IN A 157.166.226.26
cnn.com. 287 IN A 157.166.255.18
cnn.com. 287 IN A 157.166.255.19
;; AUTHORITY SECTION:
. 76691 IN NS i.root-servers.net.
. 76691 IN NS j.root-servers.net.
. 76691 IN NS k.root-servers.net.
. 76691 IN NS l.root-servers.net.
. 76691 IN NS m.root-servers.net.
. 76691 IN NS a.root-servers.net.
. 76691 IN NS b.root-servers.net.
. 76691 IN NS c.root-servers.net.
. 76691 IN NS d.root-servers.net.
. 76691 IN NS e.root-servers.net.
. 76691 IN NS f.root-servers.net.
. 76691 IN NS g.root-servers.net.
. 76691 IN NS h.root-servers.net.
;; ADDITIONAL SECTION:
b.root-servers.net. 386178 IN A 192.228.79.201
d.root-servers.net. 402826 IN A 128.8.10.90
d.root-servers.net. 230000 IN AAAA 2001:500:2d::d
f.root-servers.net. 370827 IN A 192.5.5.241
g.root-servers.net. 463754 IN A 192.112.36.4
h.root-servers.net. 374116 IN A 128.63.2.53
h.root-servers.net. 517382 IN AAAA 2001:500:1::803f:235
j.root-servers.net. 185528 IN A 192.58.128.30
j.root-servers.net. 578747 IN AAAA 2001:503:c27::2:30
;; Query time: 26 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Sep 16 12:45:41 2011
;; MSG SIZE rcvd: 512
# dig cnn.com
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_5.3 <<>> cnn.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8277
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 13, ADDITIONAL: 9
;; QUESTION SECTION:
;cnn.com. IN A
;; ANSWER SECTION:
cnn.com. 223 IN A 157.166.255.19
cnn.com. 223 IN A 157.166.224.25
cnn.com. 223 IN A 157.166.224.26
cnn.com. 223 IN A 157.166.226.25
cnn.com. 223 IN A 157.166.226.26
cnn.com. 223 IN A 157.166.255.18
;; AUTHORITY SECTION:
. 76627 IN NS c.root-servers.net.
. 76627 IN NS d.root-servers.net.
. 76627 IN NS e.root-servers.net.
. 76627 IN NS f.root-servers.net.
. 76627 IN NS g.root-servers.net.
. 76627 IN NS h.root-servers.net.
. 76627 IN NS i.root-servers.net.
. 76627 IN NS j.root-servers.net.
. 76627 IN NS k.root-servers.net.
. 76627 IN NS l.root-servers.net.
. 76627 IN NS m.root-servers.net.
. 76627 IN NS a.root-servers.net.
. 76627 IN NS b.root-servers.net.
;; ADDITIONAL SECTION:
b.root-servers.net. 386114 IN A 192.228.79.201
d.root-servers.net. 402762 IN A 128.8.10.90
d.root-servers.net. 229936 IN AAAA 2001:500:2d::d
f.root-servers.net. 370763 IN A 192.5.5.241
g.root-servers.net. 463690 IN A 192.112.36.4
h.root-servers.net. 374052 IN A 128.63.2.53
h.root-servers.net. 517318 IN AAAA 2001:500:1::803f:235
j.root-servers.net. 185464 IN A 192.58.128.30
j.root-servers.net. 578683 IN AAAA 2001:503:c27::2:30
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Sep 16 12:46:45 2011
;; MSG SIZE rcvd: 512
Notice how on the first run, it takes 26 msec to do the lookup, because BIND doesn’t have that address cached yet, whereas on the second run it only takes 1 msec to do the lookup! Could that perhaps improve system performance? I’ll bet it could! And the SERVER line tells us that it is indeed using our BIND server (127.0.0.1) – if it were using, say, our router’s DNS server then that line would show this:
;; SERVER: 192.168.0.1#53(192.168.0.1)
The idea here is that when your Internet connection takes a dive, Asterisk will still be finding a working DNS server and therefore won’t tank. That, at least, is the theory I’ve seen on several web sites. The ONLY thing I am showing here is how to set up BIND using Webmin, and I won’t even guarantee that I’m doing that 100% correctly. I definitely do not guarantee that it will actually work as intended — you’ll have to test that yourself. Doing a real test would mean disconnecting your cable or DSL modem, etc. from your router for several hours or days to see if the phones continue to work, and in most households or businesses that idea will go over like a lead balloon. However, feel free to give it a good test if you like and report the results in the comments.
You may wonder why I selected “Setup nameserver for internal non-internet use only” in the fourth screenshot. Obviously, that description is not entirely accurate. The real difference is that if you select that instead of the default “Setup as an internet name server, and download root server information”, it won’t create a “root” DNS zone, which you simply don’t need for this application. You can use the other option if you want to, but it will download additional information and increase the complexity of your setup. Either way, you should be able to access the Internet, because we set up DNS forwarding. If by some chance this BIND server is going to act as a nameserver for your entire network, and you don’t mind the additional traffic and complexity (and it’s the additional traffic that scares me the most, since I have no idea what it’s actually downloading nor how often it’s doing it), then by all means feel free to use the second option. All I will say is that I used the first. and it works fine, and I’ve seen at least one instance where this same thing is set up using a method other than Webmin, and except for the order of statements it uses an /etc/named.conf file that is identical to what Webmin produces when configured as I have shown here (in other words, no “zones” at all). I’m just waiting for some Linux purist to say this isn’t the “right” way to do this but keep the goal in mind here — all we are trying to do is work around a bug in Asterisk that should have been fixed years ago, not set up a DNS server to feed an entire subnet. But again, you can feel free to use whichever of the options you like — it should work either way.
(By the way, if after reading the above you have “setup remorse” — you know, that feeling you get after you’ve installed something that you should have picked a different option — you can get a “do-over” by simply deleting or moving/renaming /etc/named.conf. If you then exit Webmin’s BIND module and come back in, it should see that named.conf doesn’t exist and start you over at the fourth screen shown above. Of course, you will lose anything you have already configured from within that module. If you originally selected the option to download the root server information, I think that’s at least partly stored in the file /etc/db.cache, so you could move or remove that file to make sure it’s not used, however I’m not sure if any other files are or were also downloaded. That particular file is very small so I’m not worried about that one per se, it’s just that the way things are worded on a couple of pages I read, I don’t know if that’s all it downloads, or if at some point in the middle of the night it rises up and tried to cache all the DNS information for the Internet, or just exactly what it does. Sometimes I wish people would just give a sentence or two of additional information, so you have a better idea of what’s the right thing to do when you’re setting up something like this.)
Now, if you are a True Linux Geek who somehow stumbled across this article, and are disappointed that it isn’t much more complicated, I’ll refer you to this page. If you can figure all THAT out, you should be getting paid the big bucks as the networking expert that you are! 🙂
(Updated July 1, 2011 to include rudimentary test for string returned that doesn’t contain an actual IP address)
One problem faced by Asterisk users (and probably also users of other software PBX’s) is that you want to secure your system by not opening ports up to the entire Internet, but if you have remote users (users not on the same local network as your Asterisk server) you need to make an exception for them to allow them to penetrate your firewall. If all your external users have fixed IP addresses, it’s not a problem — you simply add a specific rule in your firewall to permit access from each user’s IP address. However, if their ISP changes their IP address frequently, or if they are using a softphone on a laptop computer, then you can’t just assume they will constantly be at same IP. And if one of those users happens to be your boss or your mother, they are not going to be happy if they can’t use the phone until they make contact with you, and you enter their new IP address in the firewall. And they’re probably not going to be real happy if they have to go to a web site or take some other action before they can make and receive calls.
This solution will work for many users in this situation, provided that you are using the iptables firewall. Again, the goal is to keep all your ports closed to outsiders, except for your authorized users. But if you can get each user to set up a Dynamic DNS account and then set their router to do the Dynamic DNS updates (as described here for DD-WRT users), OR failing that if you can get them to install a software Dynamic DNS client on their computer (which is a poorer choice because the computer has to be on for updates to occur), then you can run a script on your Asterisk box every five minutes to check to see if their IP address has changed, and if so, update iptables. I have one script that is called as a cron job every five minutes, and looks like this:
#!/bin/bash
/root/firewall-dynhosts.sh someaddress.afraid.org
/root/firewall-dynhosts.sh someotheraddress.afraid.org
/root/firewall-dynhosts.sh someaddress.no-ip.com
In other words it has one line for each Dynamic DNS host I want to check. For each host it calls a script named firewall-dynhosts.sh which in turn contains this:
#!/bin/bash
# filename: firewall-dynhosts.sh
#
# A script to update iptable records for dynamic dns hosts.
# Written by: Dave Horner (http://dave.thehorners.com)
# Released into public domain.
#
# Run this script in your cron table to update ips.
#
# You might want to put all your dynamic hosts in a sep. chain.
# That way you can easily see what dynamic hosts are trusted.
#
# create the chain in iptables.
# /sbin/iptables -N dynamichosts
# insert the chain into the input chain @ the head of the list.
# /sbin/iptables -I INPUT 1 -j dynamichosts
# flush all the rules in the chain
# /sbin/iptables -F dynamichosts
HOST=$1
HOSTFILE=”/root/dynhosts/host-$HOST”
CHAIN=”dynamichosts” # change this to whatever chain you want.
IPTABLES=”/sbin/iptables”
# check to make sure we have enough args passed.
if [ “${#@}” -ne “1” ]; then
echo “$0 hostname”
echo “You must supply a hostname to update in iptables.”
exit
fi
# lookup host name from dns tables
IP=`/usr/bin/dig +short $HOST | /usr/bin/tail -n 1`
if [ “${#IP}” = “0” ]; then
echo “Couldn’t lookup hostname for $HOST, failed.”
exit
fi
if [ ! `expr “$IP” : ‘([1-9])’` ]; then
echo “Did not return valid IP address, failed.”
exit
fi
OLDIP=””
if [ -a $HOSTFILE ]; then
OLDIP=`cat $HOSTFILE`
# echo “CAT returned: $?”
fi
# has address changed?
if [ “$OLDIP” == “$IP” ]; then
echo “Old and new IP addresses match.”
exit
fi
# save off new ip.
echo $IP>$HOSTFILE
echo “Updating $HOST in iptables.”
if [ “${#OLDIP}” != “0” ]; then
echo “Removing old rule ($OLDIP)”
`$IPTABLES -D $CHAIN -s $OLDIP/32 -j ACCEPT`
fi
echo “Inserting new rule ($IP)”
`$IPTABLES -A $CHAIN -s $IP/32 -j ACCEPT`
echo “Changing rule in /etc/sysconfig/iptables”
sed -i “0,/-A\sdynamichosts\s-s\s$OLDIP\s-j\sACCEPT/s//-A dynamichosts -s $IP -j ACCEPT/” /etc/sysconfig/iptables
# sed -i “s/-A\sdynamichosts\s-s\s$OLDIP\s-j\sACCEPT/-A dynamichosts -s $IP -j ACCEPT/g” /etc/sysconfig/iptables
echo “Sending e-mail notification”
`echo “This is an automated message – please do not reply. The address of dynamic host $HOST has been changed from $OLDIP to $IP. You may need to change the dynamichosts chain in Webmin’s Linux Firewall configuration.” | mail -s “IP address of dynamic host changed on machine name“ recipient@someaddress.com,anotherrecipient@someaddress.net`
As always, copy and paste the above script, so you can see where the line breaks are really supposed to be (the last line in particular is quite long, and will likely be broken up into four or five lines on the screen). Also, beware of WordPress or other software changing the single or double quotation marks to “prettified” versions — only the plain text normal quotation marks will work.
Note that prior to the first run of the script you will need to run the three commented-out commands shown near the top of the script, right after “create the chain in iptables”, to create the chain. For your convenience here they all are in one place, without the interleaved comment lines:
/sbin/iptables -N dynamichosts
/sbin/iptables -I INPUT 1 -j dynamichosts
/sbin/iptables -F dynamichosts
The lines in blue in firewall-dynhosts.sh are custom additions by me. Just in case something goes wrong, I suggest you make a backup copy of /etc/sysconfig/iptables in a safe place before running this script. My first addition checks the first character of the string returned in $IP to make sure it is actually a number. This was a quick and dirty addition to keep it from trying to use a string like ;; connection timed out; no servers could be reached as a valid IP address (yes, it really did that). I’m sure that the test there could be improved upon (for example, to do a full check for a valid IP address rather than just checking the first digit) but as I say this was a quick and dirty fix. If you have any suggestions on how to improve it, please leave a comment. I did find this article, Validating an IP Address in a Bash Script, but it seemed like a bit of overkill considering that in this case what I’m really trying to do is simply weed out error messages.
The second set of additions change the address in the dynamichosts chain of /etc/sysconfig/iptables. Please note that this file may be at a different location in some versions of Linux (such as /etc/iptables.up.rules), if so you will need to change this accordingly. This is particularly important if you run both Webmin and fail2ban. If fail2ban is running it will add some lines to the in-memory version of iptables, so you don’t want to do a simple commit to save the in-memory version back to the iptables file. But at the same time, if you use Webmin’s “Linux Firewall” module to maintain iptables, you want any changes in IP addresses to show up the next time you call up Webmin’s Linux Firewall page. So this simply does a search and replace in /etc/sysconfig/iptables on the rule containing the old IP address, and replaces it with the new one. There are two lines in that section that contain the sed command, the first one will replace only the first instance of the old IP address if it’s in iptables more than once, while the second (which is commented out) would replace all instances of the old IP address. Uncomment whichever you prefer and leave the other commented out, but bear in mind that if two or more of your remote extensions might ever be at the same IP address at the same time, you want the first version (the one that is uncommented above) so that when one of those extensions moves to a different IP address it doesn’t change the IP address for all of the extensions.
Note there’s still a possibility of missing a change if you are actually working in Webmin when a change occurs (since you’ll already have loaded a copy of iptables, and if you then make changes and save it out it could overwrite any change made by the script). But, the last two lines of the script send you an e-mail to alert you to that possibility. If you don’t use Webmin and don’t need or want an e-mail notification for some other reason, you can omit those last two lines, otherwise change the parts in red text to sane values for your situation. While editing, pay attention to the backtick at the end of the line (it’s easy to accidentally delete it when editing an e-mail address — don’t do that!).
When you’re all finished, make sure both scripts are executable and the permissions are correct, then create a cron job to call the first script every five minutes.
The only slight drawback to this method is that when an IP address changes it can take up to ten minutes to update (five for the Dynamic DNS to pick it up, and five more for the cron job to fire that gets it from the Dynamic DNS). Fortunately, most ISP’s tend to change IP address assignments in the middle of the night. Note that using the wrong DNS servers can cause the updates to take significantly longer; I set my computers to use Google’s DNS (8.8.8.8 and 8.8.4.4) and that works fairly well. Note that if ALL your Dynamic DNS addresses are from freedns.afraid.org then you may want to change one line in the above script, from
IP=`/usr/bin/dig +short $HOST | /usr/bin/tail -n 1`
to
IP=`/usr/bin/dig +short @ns1.afraid.org $HOST | /usr/bin/tail -n 1`
This change will specify that the afraid.org DNS server is to be used for these lookups (and ONLY for these lookups, not for every DNS request your system makes – don’t want to overload the servers of this free service!). This may be particularly important if the DNS server you normally use is a caching server that doesn’t always do real-time lookups for each DNS request (for example, if you have installed the BIND DNS Server on your system). If some of the Dynamic DNS addresses come from other services then you could use a similar modification that checks a public DNS service that does not cache entries for long periods of time; as I write this Google’s DNS servers seem to update in near real time.
One thing some may not like is that this script basically hands the “keys to the kingdom” to your authorized users, by giving them access to all ports, or at least all ports not explicitly denied by rules higher in priority. It would be easy enough to change the rule that is written to iptables, or even add additional ones, in the above script, so that you could specify access to individual ports. The other problem is it works great for those external users at fixed locations that don’t move around a lot. It might not work quite as well as well for softphone users on laptops due to the delay between the time they turn on the laptop and the time your Asterisk server picks up the new address.
This has actually worked the best for me of anything I’ve tried so far because once you get the external user’s router set up to do the Dynamic DNS updates, they don’t have to think about doing anything else prior to making a call.
EDIT (December, 2015): If it is not possible or appropriate to update the dynamic DNS automatically from the users’ router, there may be another option. If any of your users have Obihai devices (or possibly another brand of VoIP device that includes an accessible “Auto Provisioning” feature that is not currently being utilized), you may want to know that they do not need to run a separate client to update their dynu.com or freedns.afraid.org dynamic IP address, because an Obihai device (and possibly some other brands of VoIP devices) can do that automatically. This is NOT a recommendation for Obihai devices, but if you or one of your users happens to already have one, here is the information as originally found in this thread on the Obihai forum, posted by user giqcass, who wrote:
Rough Draft for hackish DNS updates:
This hack will let your OBi update Dynamic DNS. It isn’t perfect but it works very well. It’s as simple as calling a url to update the DNS at afraid.org. I believe it would be a simple task to add this feature to the OBi firmware directly. So please add this OBiHai. Pretty please. Until then here you go.
Set up a Dynamic DNS host at http://freedns.afraid.org/
Go to the Dynamic DNS tab.
Copy the “direct” update url link.
Open your Obi admin page.
Click the System management page.
Click Auto Provisioning.
Under “ITSP Provisioning” Change the following.
Method = Periodically
Interval = This setting must be greater then 400 so not to over use resources. I use 3667.
ConfigURL = Paste the update link you got from afraid.org (use http://… not https://…)Press Submit at the bottom of the page. Restart you OBi.
If you use choose to use dynu.com instead of freedns.afraid.org (which you might because dynu.com doesn’t force you to visit their web site periodically to keep your domain), the procedure is the same (after the first line), except that for the ConfigURL you would use:
http://api.dynu.com/nic/update?hostname=YOUR_DYNU_DYNAMIC_DNS&username=YOUR_DYNU_USERNAME&password=MD5_HASH_OF_PASSWORD
Replace YOUR_DYNU_DYNAMIC_DNS with your dynamic DNS domain name, YOUR_DYNU_USERNAME with the username you use to log into your dynu.com account, and MD5_HASH_OF_PASSWORD with the MD5 hash of your dynu.com password OR your IP Update Password if you have set one (which is recommended). To get the MD5 hash of the password you can enter it on this page. To set or update your IP Update Password, use this page.
The advantage of this is that if one of your users travels and takes their VoIP device with them, it would be able to change the dynamic DNS each time they plug in at a new location (not immediately, but after several minutes at most), so that if you use the technique outlined in this article your server will recognize their current address and permit access. Remember that it’s okay to use more than one Dynamic DNS service simultaneously, in case you or your user are already using a different one that doesn’t provide a simple update URL like dynu.com and freedns.afraid.org do. Other brands of VoIP adapters that have a similar “Auto Provisioning” feature may be able to do this as well, but we don’t have specific information for any of them. If you do, please feel free to add that information in a comment.
Note that we are not recommending any particular free dynamic DNS service. If you want to know what your options are, there is an article on the Best Free Dynamic DNS Services that will show you some options. You want one that is reliable and that will not disappear in a few months, but since we don’t have a crystal ball, we can’t tell you which ones might fit that criteria.
For many Linux users this will be a “Thank you, Captain Obvious” type of post, but it’s one of those things that some Webmin users might not realize. If you use Webmin’s “Linux Firewall” configuration page to configure the iptables firewall in Linux, and you click “Apply Configuration”, it will remove fail2ban‘s rules from your active iptables configuration. So, you must go to a Linux command prompt and enter service fail2ban restart — UNLESS you make a small change in the Webmin “Linux Firewall” configuration.
From the Webmin “Linux Firewall” main page, click Module Config, then on the configuration page, in the “Configurable options” section, look for the line “Command to run after applying configuration.” Click the button next to the text box on that line, and in the text box enter service fail2ban restart and then click the Save button at the bottom of the page. That’s all you need — now every time you make a firewall change and click “Apply Configuration”, it will automatically restart fail2ban for you.
If you use a recent version of FreePBX, you are familiar with the new and tedious method of entering Outbound Route Dial Patterns and Trunk Dialed Number Manipulation Rules. Fortunately, version 2.9 and above offer a way to import a list of patterns from a CSV file (there’s a way to patch FreePBX 2.8 to get this functionality as well — see Ticket #4691).
What they don’t give you is a way to export a list of patterns once you have them installed. So if you want to clone a route and you’ve lost your original CSV file (or never had one to begin with because FreePBX converted your existing routes and trunks when you upgraded from version 2.7), what do you do? Fear not, because it actually is possible, if not exactly the most straightforward process.
EDIT: Now there is an easy way around all this — see this thread on the FreePBX Swiss Army Knife Module. If you use that module, you don’t need to read the rest of this article (although, you might be interested in the part about editing CSV files). Unfortunately, it is reported that the module does not work with FreePBX 2.10 or above, and the author has said he will not fix it to work with newer versions. It is possible that the ability to export outbound route and trunk data to a CSV file may be present in the newest version(s) of FreePBX.
EDIT: Steps 1 and 2 involve using a Database editor module to export the data to a CSV file. Unfortunately, one commenter says that this module no longer works with FreePBX 2.9. There are other ways to accomplish the same thing — see the edit at the end of this article to use Webmin or phpMyAdmin instead of the Database editor module. If you export the data using one of those other programs, then skip to step 3 below.
Step 1: Go to the FreePBX bug tracker and look for Ticket #4793 — Database editor module (like phpMyAdmin for FreePBX). On that page you’ll find a download link for dbeditor-1.0.tgz which (at the time of this writing) is the only version of this software available. Download and install it as you would any third-party module (download it to your computer, then in FreePBX’s GUI navigate to Module Admin and then click the “Upload Module” link, then upload the module and follow the directions to complete the install).
Step 2: Once you have the Database Editor installed, it will appear under the FreePBX “Tools” tab, in the “System Administration” section. Click on the “Database Editor” link, and you should see a list of database tables used by FreePBX. The two you are interested in are called outbound_route_patterns and trunk_dialpatterns. Near each pattern name you will see two links for “Export” and “Drop” — do not click either of those (especially be careful not to click drop!), because the “Export” here will export the table in MySQL format, which is not what you want. Instead, click on the name of the table (that is, click on either outbound_route_patterns or trunk_dialpatterns) and a new page will open. Near the top of the page you will see a place where it says, “Export to CSV: pipe – tab – comma – semicolon” — click on comma and it should bring up a file save dialog that will let you save the file to your system.
Step 3. Load the downloaded file into any text editor that can deal with Linux/Unix-style line endings and not change them (so, don’t use Notepad!), or better yet, use a CSV editor if you have one (an excellent free one is CSVed, which runs under Windows but will also install and run under CodeWeavers’ CrossOver on a Mac, which tends to make me think it would probably also run under WINE on a Linux or Mac OS X computer). I do NOT recommend opening the file in a spreadsheet application such as Excel, because if you have any patterns that start with one or more leading zeroes, those might be removed, and it’s also possible that any non-numeric characters may be misinterpreted or removed.
The first number in each line is associated with a particular outbound route or trunk, so, you want to cut out the lines not applicable to the route or trunk you want to keep. Don’t erase the top (header) line. If you have many routes or trunks, it may be a bit tricky to figure out which is which, since the numbers don’t tell you the name of the route or trunk they are associated with.
After you do that, you also have to get rid if the first column in each line. So let’s say you are using route 3, and each line starts with 3,. What you want to do is a search and replace on <newline>3, (or expressed as a regular expression: n3,) and replace it with a newline only (n as a regular expression). In a CSV editor you may be able to just delete the first column. For a trunk, the principle is the same except that you will need to remove the first AND last columns, leaving only the middle three.
While you’re at it, it’s also possible to use search and replace in other ways. For example, if you are duplicating list of outbound route patterns but need to change the extension field pattern in all lines, you could do that using search and replace, if you understand what you’re doing.
Step 4. Once you have edited out all the lines except the ones pertaining to the route or trunk you want, you need to change the header line at the top. It’s important to get this right. For an outbound route you want to change it from this:
route_id,match_pattern_prefix,match_pattern_pass,match_cid,prepend_digits
(Note that the route_id may be missing after the previous edit) to this:
prefix,match pattern,callerid,prepend
Visually inspect the lines following the header to make sure you have four fields separated by exactly three commas.
For a trunk, you will need to change the first header line from this:
trunkid,match_pattern_prefix,match_pattern_pass,prepend_digits,seq
(Note that the trunkid and seq may be missing after the previous edit) to this:
prefix,match pattern,prepend
Visually inspect the lines following the header to make sure you have three fields separated by exactly two commas. Also, and this applies to trunks only, if it is important that trunk dial patterns be in a particular order then you will want to check to make sure they are in the correct order in the CSV file, since the “seq” column is not preserved. In many situations this is not an issue but in certain special cases the order of trunk dial patterns can make a difference in how they are processed.
Step 5: Save the modified file to a file with the .csv extension (if using a CSV editor make sure you are saving in comma-delimited format). Again, try to make sure your editor doesn’t change the line endings – I don’t know for certain that it would make a difference, but it might.
Step 6: Now you can create a new route or trunk, and in the “Dial patterns wizards” or “Dial Rules Wizards” dropdown select “Upload from CSV” and select your file to upload. Note that if you are using a beta version of FreePBX 2.9, it may complain if you try to submit an outbound route with no patterns, even if you are uploading a CSV file. In that case, just put a single “X” in the “match pattern” field. After you submit changes, be sure to scroll through the patterns to make sure they appear to be correct. In particular, make sure that all values are in the correct fields.
There are probably other ways to accomplish this, and maybe eventually the FreePBX developers will add an export function on the route and trunk pages (obviously, it would probably not be a good idea for me to request it, and besides, it appears that someone already has).
EDIT: Here is a way to export the data using Webmin or phpMyAdmin (replacing steps 1 and 2 above). Use Webmin if you have it, because it produces cleaner output:
If using Webmin, from the main Webmin page, go to “Servers”, then “MySQL Database Server.” Under “MySQL Databases”, click on “asterisk”, and it should take you to the “Edit Database” page (be very careful from here on out because if you do the wrong thing you could really mess up your system). In the “Edit table” dropdown, select either outbound_route_patterns or trunk_dialpatterns, depending on which you want to work with. That should take you to an “Edit table” page, but at the bottom of that page you should see a button labeled “Export as CSV.” Click on that button, and it will take you to a “CSV export options” page. You want to select the following:
Then click the “Export Now” button. If you exported to a browser window, use Ctrl-A to select all the lines, and Ctrl-C to copy them (⌘A and ⌘C on a Mac), then proceed with Step 3 above (except use Ctrl-V or ⌘V to paste the lines into the text editor). Or, if you prefer to use a CSV editor, then in your browser simply go to File | Save Page As… and save the entire page as a plain text file with a .csv extension to your local machine, and then proceed with Step 3 above.
If using phpMyAdmin, from the main page select “asterisk” in the left-hand column, then (still in the left-hand column) either outbound_route_patterns or trunk_dialpatterns, depending on which you want to work with. Then click the “Export” tab in the main window, and then under “View dump (schema) of table”, in the “Export” section select CSV. The view should change to show an “Options” section, and there you want to change “Fields terminated by:” from a semicolon to a comma, and then check the “Put fields names in the first row” checkbox. Then click the “Go” button and it should display the data in a format that can be copied and pasted into a text editor. Sorry, that’s the best I can advise you with regard to phpMyAdmin, since I seldom use that program (and I may have an older version, so things might have changed slightly).
GiottoPress by Enrique Chavez
Recent Comments