Slashdot Mirror
Asterisk and Linux to Build Secure VoIP Connection
Beave writes "Using Linux and the
Asterisk PBX, it is possible to build a secure, cost effective VoIP (and traditional PSTN) PBX solutions.
This article shows you how to take advantage of various hardware, software and tricks to accomplish this goal within a limited budget."
The Asterisk Wiki
Note: the wiki search is useless. Search with google instead, use "searchterm site:voip-info.org" (without quotes).
The Asterisk Documentation Project
The Asterisk Mailing Lists
Note: to search the lists use google again. "searchterm site:lists.digium.com" (without quotes)" in google.
the #asterisk chat room on irc.freenode.org. Drop by and say hello.
/msg nickserv register mypassword
/join #asterisk
/msg nickserv identify mypassword
Note that due to problems with massive spambot attacks regisitration is required to join the channel. Simply type
The next time you join you will need to type
.sig
It's possible, but the available wireless VOIP handsets are 11b only and don't support WPA (both are showstoppers for me).
In the future I'm sure they'll become available.
I use my asterisk server to record incoming/outgoing numbers (the local telco wants paying for this service, although I have to pay them anyway for the callerid so I'm not sure I'm saving much), and to route calls over the cheapest provider (always analogue, as VOIP providers in this country are still 2-3 times more expensive than analogue ones) - which has saved me a fortune.
Well you could get a PDA with a VOIP app running on it. For example, the Zaurus can have either KPhone/Pi or tkcPhone(demo version on their website). Both of those apps are SIP compatible.
So you get a PDA and a WiFi conectivity and there you go.
Probably not the best or most ideal solution, but it is something that does exist.
" the simplicity of the interfaces found on proprietary systems"
Apparently you've never used Avaya IP Office. I YEARN for the simplicity of text files. 3 freaking different GUIs to manage it and they're interconnected but you have to change things using at least 2 of them in many places.
This guy is way out there
"the telcom admin of a large corporation isn't going to want to look at a text file to figure out his dialplan or use some arcane interface when on a more mature system he can use a simple command like 'display dialplan'."
Hmmm.. You know.. you are absolutely right. Using "display dialplan" on a more mature solution is infinitely easier than using the "show dialplan" command that is found in Asterisk.
asterisk*CLI> help show dialplan
Usage: show dialplan [exten@][context]
Show dialplan
NEXT!
Ok, I'll take next! 'change dialplan', versus what exactly in asterisk? No need to respond, I've read their convoluted explanation of their concept of a dialplan.
All that aside however, this isn't about knocking asterisk! I compared it to a Large Enterprise, and stated the obvious, that's all
If thou see a fair woman pay court to her, for thus thou wilt obtain love
That's really too bad - encrypting VOIP causes extemely annoying overhead problems, because the voice data packets are really small (they're not very big before compressing them, and then they're even smaller), so the minimum overhead for just doing the RTP+UDP+IP headers is several times the size of the voice traffic they carry, and IPSEC adds another two layers of headers, or SSL adds about three, and pretty soon that cute little elegant 8kbps compressed voice stream is looking like 40-80kbps and won't fit on your modem. SIP can use the SRTP protocol as a modification of RTP, so to the extent that anybody implements it, it's basically doing then encryption along with a layer you needed anyway, so it doesn't add much overhead. IAX doesn't appear to have this (which is especially frustrating because the IAX2 trunking protocol makes multiple simultaneous connections much more efficient, though I suppose if you've already done that, the extra overhead of IPSEC or OpenVPN may not bother you as much.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Both Nortel and Avaya PBXs have command line driven user interfaces, which is what I'm referring to. That in itself is only a surface similarity to asterisk. While both are CLI based, the proprietary ones are built not only on simple to recall commands, but it's the TEXT interface where all you have to do is fill out the proper fields that makes them better IMO. asterisk just gives you a blank line. Welcome to your first Linux install. It's the difference between doing 'make oldconfig' and 'make menuconfig'. WTF did you think I was referring to, a GUI? ;-)
If thou see a fair woman pay court to her, for thus thou wilt obtain love
...so the minimum overhead for just doing the RTP+UDP+IP headers is several times the size of the voice traffic they carry, and IPSEC adds another two layers of headers, or SSL adds about three, and pretty soon that cute little elegant 8kbps compressed voice stream is looking like 40-80kbps and won't fit on your modem.
OpenVPN isn't IPsec, and while it uses the OpenSSL library for all the crypto "heavy lifting", it has its own over-the-wire protocol and is much more efficient than the traditional SSL way of doing things.
I use OpenVPN at work, and while I haven't done specific measurements, we've generally found it to be very efficient (not to mention easy-to-use and hassle-free compared to its IPsec-based competitors). Because in UDP mode it doesn't try to guarantee reliability, it also doesn't break protocols (like those used for VoIP data) that expect late packets to just be dropped.
So, in short, I'm not at all convinced that the use of OpenVPN is at all unfortunate or problematic here.
I can speak from experience on this. I work for a company that provides IT services for small companies. We implemented Cisco Callmanager at one of our clients and Asterisk at another. The client running CallManager has about 200 employees and when all was said and done cost about $250k (2 Call Managers, Unity, IPCC, router, switches, 7940s & 7960s). The client running Asterisk has about 15 employees and when all was said and done the cost was about $1000 (Asterisk on a Dell, Digium card, Handytone phones). Both solutions provided nearly identical functionality. CallManager was a PITA to get up and running and is a major PITA to administer and troubleshoot. If a user is going to be in an IPCC queue it can take 30 minutes to set them up. I can setup a new user in Asterisk in about 5 minutes. On average I easily spend 10 hours a week managing the CallManager system and maybe 10 minutes week on the Asterisk system, granted the Asterisk system is being used by a much smaller company. Asterisk is a full blown PBX that can be the best solution for small companies voice needs. It does have its limitations, mainly redundancy and scalability. Even with its limitations it has been a solid solution compared to the Cisco product. Some things are so simple with Asterisk yet nearly impossible with Cisco.
If you want to do SIP/IAX you only need a network card, no fancy $500 T1 cards..You can purchase DID's ( Direct Inward Dial ) from NuFone.net or connect.voicepulse.com to work with Asterisk. They give you a "virtual number" from whatever state you want. You can have multiple calls on the single DID. Basicly you put a statement in your IAX configuration file to register with either of the services ( after signing up with them ) and when you register it tells them what IP address your Asterisk server is to route calls to. Your Asterisk box then routes calls accordingly. You can also pre-pay for outgoing PSTN calls through these services for very cheap. I currently have a DID through Voicepulse and do outgoing through NuFone.net.. works great.
This is incorrect. As one who has dealt with Lucent 5ESS switches, it's as "easy" to turn off as it is to turn on in the first place. It's one of the many line provisioning options.
Now, I say "easy" as the term is certainly relative when working with telco switches. I won't bore people with stories; suffice to say the CLI is very cryptic and the menu interface (from which all real work is done) is a bit complicated to the uninitiated.
news asterisk daily
asterisk news
asterisk daily news
Please don't mod below 0...trying to google bomb to move this awesome site up a bit.
If you're running a UDP protocol, you've still got UDP headers and IP headers and optionally Ethernet headers, wrapped around whatever you're carrying, which already had a UDP header and an IP header, all to carry a payload that's only 10 bytes long, or 20-30 with some codecs. Yes, doing UDP instead of TCP takes care of some problems, but it's still a huge overhead for a protocol that absolutely needs to ship a large number of very small packets every second. By contrast, if you're using it to carry bulky applications like FTP or Email, the overhead's a drop in the bucket, because the data payloads are typically ~1400-1500 bytes. If you're carrying telnet traffic, which often has even smaller data packets than VOIP, you'd think it would be worse, but it's usually not - a 100wpm typist is typing about 15 characters/second (which might each be carried in a their own packet), compared to VOIP with about 50-100 packets/second and much tighter timing concerns.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
the minimum overhead for just doing the RTP+UDP+IP headers is several times the size of the voice traffic they carry
Not necesarily.
The IP header is 20bytes, UDP is not used ontop of RTP as you suggest, RTP is a slight adaption of UDP which has a header size of around 20bytes again iirc (plain udp is 8 bytes) although that can be compressed. IIRC on average a VoIP packet is around 28bytes although that'd depend on the codec in use. That wouldn't push an 8kb/s stream up to 80kb/s, maybe 25 or 30 if you include ipsec.
With a single VoIP connection you're not usually doing anything like 1500byte packets anyway but from TFA it sounds like IAX2 allows multiple VoIP streams to be put into the same packet which decreases the ratio of the header overhead.
You seem to be hinting that it'd be nice if IAX2 supported encryption itself, which it certainly would. I wonder if this would be as fast in practise as just running the entire stream over kernel-level IPSec.
I've started to use Asterisk for various applications, including as a
- PSTN to VOIP gateway: combine a cheap server, asterisk, and a few $50 voicemodem cards and you've got a VOIP gateway that can connect your outside phone lines to any VOIP phone.
- VOIP to PSTN gateway: cheap server, asterisk, open VOIP provider like VoicePulse Connect, and some Digium FXS cards and you can connect every phone in your house to a VOIP network.
- PSTN/VOIP front-end to IVR gateway: cheap server, Asterisk, IVR provider like Voxeo and you can connect all of the above to custom voice recognition applications. (Asterisk has some built in IVR but its limited today.)
Several companies are starting to offer commercial PBX products based on Asterisk, including http://www.signate.com/ and http://www.fonality.com/.
In summary, Asterisk is becoming an amazing "telephony widget" - it can address a variety of telephony solution requirements, depending on how you configure it.