Tony may disagree (see our earlier exchanges) but see below...
Paul DS
"Ed" <a.@.invalid> wrote in message
news:1121203776.26690ab196d5cb1c0ebc59bc7efd462d@t eranews...
> On Tue, 12 Jul 2005 19:33:59 +0100, Tony wrote:
>
> >Was it any good for you Ed?
>
> Yes Tony, it certainly helped to make things a little clearer. Thanks
> to your explanation and doing a bit further reading elsewhere, I've
> now got my ATA fully (fingers crossed) working for 2 lines! Phew what
> a palaver getting all those scores of optional parameters set.
>
> A few queries:
>
> These names (like "RTPLang" or "Voice") I was told to use in my router
> configuration, I had assumed they were some kind of reserved names for
> particular functions. I'm beginning now to think they're not reserved
> names but I can use whatever name for these services that I like, as
> long as I can understand them. Is that right?
>
PDS> Probably but for SIP with STUN you can ignore these. Services such as
Yahoo Messenger and MS Messenger need you to open various holes through your
security (i.e. open ports on your router) which is exactly why I don't use
them. SIP does not require you do anything like this.
> Then regarding DMZ, which my router doesn't have as an option. From my
> reading of DMZ is nothing more than a particular device with an IP
> address on my LAN which has all ports open. If so, can I not achieve
> the identical thing to DMZ by just defining all ports on that IP
> address as open? Is there anything else that the "proper" DMZ function
> does which is over an above my simply opening all ports on that IP
> address?
>
PDS> A DMZ usually an area between a weakened firewall (to the outside) and
a fully hardened firewall (to your internal network) where servers such as
mail or web servers are placed. They have to be in a weakened area because
you have to allow people from the outside world to get to them, but you
don't want these same people into your internal LAN.
So you can do something like...
Internet -- weak firewall -- DMZ -- strong firewall -- Internal network
On the weak firewall you open whatever ports you need to direct traffic to
the machines located in the DMZ.
Now there is sometimes a "DMZ options" which basically says "unless told
otherwise, an inbound connection is sent to this specific machine. This is
fine apart from one problem. If your "DMZ machine" is a WinDoze machine,
odds are it can be compromised and unless it is separated from your internal
network by a good firewall, the WinDoze machine can sometimes be used to
relay attacks to your internal network.
So, the strong firewall is really required although with careful
configuration you might be able to get away with using a software firewall
such as ZoneAlarm _PROVIDING_ you mark the DMZ machine as "I wouldn't trust
it as far as I could throw it"!
Bottom line though - you don't need a DMZ or any specially opened ports.
> Finally relating to STUN. That is configured on my ATA (which has 2
> lines) as a global parameter rather than as a parameter per line. I
> find that a bit confusing, since my 2 lines are attached to 2 totally
> different providers. From your explanation it seems that STUN is a
> provider-specific facility so I would have assumed that I would put a
> separate parameter in for each line.
PDS> I _think_ (and I have to read some more on STUN) that you should be OK.
My understanding is that a STUN server allows your client to find out
answers to "I'm behind a NAT, but what does the outside world think my IP
address is"? The answer won't change between the two SIP service providers
so a single STUN server _might_ be able to satisfy both.
Re: Router settings with VoIP - any explanatory documentation? 
Linear Mode
