将 VoIP 电话直接连接到 Asterisk 服务器
VoIP
![](/data/attachment/album/201903/15/103133hay6i1cbda2p41ga.jpg)


在我的 [Asterisk](https://www.asterisk.org/) 服务器上正好有张以太网卡。由于我只用了其中一个，因此我决定将我的 VoIP 电话从本地网络交换机换成连接到 Asterisk 服务器。


主要的好处是这台运行着未知质量的专有软件的电话，在我的一般家庭网络中不能用了。最重要的是，它不再能访问互联网，因此无需手动配置防火墙。


以下是我配置的方式。


### 私有网络配置


在服务器上，我在 `/etc/network/interfaces` 中给第二块网卡分配了一个静态 IP：



```
auto eth1
iface eth1 inet static
    address 192.168.2.2
    netmask 255.255.255.0
```

在 VoIP 电话上，我将静态 IP 设置成 `192.168.2.3`，DNS 服务器设置成 `192.168.2.2`。我接着将 SIP 注册 IP 地址设置成 `192.168.2.2`。


DNS 服务器实际上是一个在 Asterisk 服务器上运行的 [unbound 守护进程](https://feeding.cloud.geek.nz/posts/setting-up-your-own-dnssec-aware/)。我唯一需要更改的配置是监听第二张网卡，并允许 VoIP 电话进入：



```
server:
    interface: 127.0.0.1
    interface: 192.168.2.2
    access-control: 0.0.0.0/0 refuse
    access-control: 127.0.0.1/32 allow
    access-control: 192.168.2.3/32 allow
```

最后，我在 `/etc/network/iptables.up.rules` 中打开了服务器防火墙上的正确端口：



```
-A INPUT -s 192.168.2.3/32 -p udp --dport 5060 -j ACCEPT
-A INPUT -s 192.168.2.3/32 -p udp --dport 10000:20000 -j ACCEPT
```

### 访问管理页面


现在 VoIP 电话不能在本地网络上用了，因此无法访问其管理页面。从安全的角度来看，这是一件好事，但它有点不方便。


因此，在通过 ssh 连接到 Asterisk 服务器之后，我将以下内容放在我的 `~/.ssh/config` 中以便通过 `http://localhost:8081` 访问管理页面：



```
Host asterisk
    LocalForward 8081 192.168.2.3:80
```



---


via: <https://feeding.cloud.geek.nz/posts/connecting-voip-phone-directly-to-asterisk-server/>


作者：[François Marier](https://fmarier.org/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
[Feeding the Cloud](../../)/

[posts](../)/ Connecting a VoIP phone directly to an Asterisk server

On my [Asterisk](https://www.asterisk.org/) server, I happen to have two
on-board ethernet boards. Since I only used one of these, I decided to move
my VoIP phone from the local network switch to being connected directly to
the Asterisk server.

The main advantage is that this phone, running proprietary software of unknown quality, is no longer available on my general home network. Most importantly though, it no longer has access to the Internet, without my having to firewall it manually.

Here's how I configured everything.

# Private network configuration

On the server, I started by giving the second network interface a static IP
address in `/etc/network/interfaces`

:

```
auto eth1
iface eth1 inet static
address 192.168.2.2
netmask 255.255.255.0
```


On the VoIP phone itself, I set the static IP address to `192.168.2.3`

and
the DNS server to `192.168.2.2`

. I then updated the SIP registrar IP address
to `192.168.2.2`

.

The DNS server actually refers to an [unbound
daemon](/posts/setting-up-your-own-dnssec-aware/)
running on the Asterisk server. The only configuration change I had to make
was to listen on the second interface and allow the VoIP phone in:

```
server:
interface: 127.0.0.1
interface: 192.168.2.2
access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.1/32 allow
access-control: 192.168.2.3/32 allow
```


Finally, I opened the right ports on the server's firewall in
`/etc/network/iptables.up.rules`

:

```
-A INPUT -s 192.168.2.3/32 -p udp --dport 5060 -j ACCEPT
-A INPUT -s 192.168.2.3/32 -p tcp --dport 5060 -j ACCEPT
-A INPUT -s 192.168.2.3/32 -p udp --dport 10000:20000 -j ACCEPT
```


# Network time synchronization

In order for the phone to update its clock automatically using [NTP](https://en.wikipedia.org/wiki/Network_Time_Protocol), I installed [chrony](https://chrony.tuxfamily.org/) on the Asterisk server:

```
apt install chrony
```


then I configured it to listen on the private network interface and allow access from the VoIP phone by adding the following to `/etc/chrony/conf.d/asterisk-local.conf`

:

```
bindaddress 192.168.2.2
allow 192.168.2.3
```


Finally, I opened the right firewall port by adding a new rule to `/etc/network/iptables.up.rules`

:

```
-A INPUT -s 192.168.2.3 -p udp --dport 123 -j ACCEPT
```


# Accessing the admin page

Now that the VoIP phone is no longer available on the local network, it's not possible to access its admin page. That's a good thing from a security point of view, but it's somewhat inconvenient.

Therefore I put the following in my `~/.ssh/config`

to make the admin page
available on `http://localhost:8081`

after I connect to the Asterisk server
via ssh:

```
Host asterisk
LocalForward localhost:8081 192.168.2.3:80
```


# Allowing calls between local SIP devices

Because this local device is not connected to the local network
(`192.168.1.0/24`

), it's unable to negotiate a direct media connection to
any other local (i.e. one connected to the same Asterisk server) SIP device.
What this means is that while calls might get connected successfully, by
default, there will not be any audio in a call.

In order for the two local SIP devices to be able to hear one another, we
must enforce that all media be routed via Asterisk instead of going directly
from one device to the other. This can be done using the `directmedia`

directive (formerly
[ canreinvite](https://www.voip-info.org/asterisk-sip-canreinvite/)) in

`sip.conf`

:```
[1234]
directmedia=no
```


where `1234`

is the extension of the phone.