On Mon, 19 Jan 2004 20:11:27 +0100, Steffen Engmann
<steffen@engmann.de> wrote:

<snip>

>Yes, it's working perfectly with gnugk! And even easier to install than
>the netfilter-mods ...
>Only drawback: All my friends have to register at my Gatekeeper first.

Yes. Not that big of a deal though.

>Thanks,
> Steffen
>
>Here's my /etc/gnugk.ini

<snip>

Here's mine.

## /etc/gnugk.ini
#
[Gatekeeper::Main]
Fourtytwo=42
TimeToLive=600
Name=GK1

[RoutedMode]
GKRouted=1
H245Routed=1
CallSignalPort=1721
CallSignalHandlerNumber=2
AcceptNeighborsCalls=1
AcceptUnregisteredCalls=0
RemoveH245AddressOnTunneling=1
DropCallsByReleaseComplete=1
SendReleaseCompleteOnDRQ=1
SupportNATedEndpoints=1
Q931PortRange=20000-20020
H245PortRange=30000-30020

[RasSrv::Neighbors]
GK2=131.210.92.179:1719;*;gk2password

[RasSrv::LRQFeatures]
NeighborTimeout=2

[Gatekeeper::Auth]
NeighborPasswordAuth=required

[Endpoint]
Password=gk1password

[Proxy]
Enable=1
InternalNetwork=192.168.100.0/24
T120PortRange=40000-40020
RTPPortRange=50000-50020

[GkStatus::Auth]
rule=allow
####### END

As you can see, I have a "neighbor". That is so I can connect to my
son through *his* Linux firewall.

>
>And the iptable filter rules:
>$IPTABLES -A INPUT -i $EXT -p UDP -d $MY_IP_EXT --dport 1718:1719 \
> -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A INPUT -i $EXT -p TCP -d $MY_IP_EXT --dport 1721 \
> -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A INPUT -i $EXT -p TCP -d $MY_IP_EXT --dport 30000:30020 \
> -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

No port 1503? I forget what that was even for!

>$IPTABLES -A INPUT -i $EXT -p TCP -d $MY_IP_EXT --dport 40000:40020 \
> -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
>$IPTABLES -A INPUT -i $EXT -p UDP -d $MY_IP_EXT --dport 50000:50020 \
> -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
>

I found I did not need those. I'm glad it worked out so well for you.

--
"Now are you talking about what it is you know
Or just repeating what it was you heard".
Grace Slick
To email use rpiotro(at)wi(dot)rr(dot)com