3

We are using Zentyal 3.1 (Ubuntu 12.04.2 LTS - kernel version: 3.2.0.38-generic) as proxy/firewall for our location. At the moment the firewall rules are set to allow all, however sip packets are still dropped. This is caused by the module nf_conntrack_sip.

When I manually unload the module + the module nf_nat_sip everything works as expected. The command I used for unloading is either (both work):

    rmmod nf_nat_sip
    rmmod nf_conntrack_sip

or

    modprobe -r nf_nat_sip
    modprobe -r nf_conntrack_sip

After a reboot ofcourse these modules are loaded again, so I added following lines to /etc/modprobe.d/blacklist.conf

    blacklist nf_nat_sip
    blacklist nf_conntrack_sip

But this didn't prevent the modules from loading. I even created a new file, /etc/modprobe.d/blacklist-custom.conf with the same two lines (and a blank new line), but the modules still get loaded at boot.

Then I tried a script that unloads the modules in upstart after the network devices come up, and that works. But after some time the modules do get loaded again by some unknown trigger.

I want these modules unloaded permanently, but kinda clueless atm on any other solutions.

1

1 Answer 1

0

Solution for me

In: /etc/zentyal/firewall.conf Remove from iptables_modules = nf_conntrack_sip, nf_nat_sip

Restart Zentyal

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .