Asterisk ACL Doesn't Seem To Work

Question

I am trying to get Asterisk to allow inbound calls (authed purely on IP) on multiple IPs from the same supplier. The only way that works so far is to create a new sip.conf peer entry for each IP.

ACLs look like they should work, but I cannot work out how to use them properly. That or they don't work as I think they do/should.

For example, if I create the following in my sip.conf (a little stripped down) :

[general]
context=no_default_context_allowed
allowguest=yes
...

[supplier]
type=peer
host=1.1.1.1
context=abc

the calls that arrive from 1.1.1.1 go to the context abc as expected. However, if I have a range of IPs (eg 1.1.1.80/28) I would expect something along these lines to work :

[supplier]
type=peer
host=dynamic
acl=supplier-acl
context=abc

with the acl.conf as :

[supplier-acl]
deny=0.0.0.0/0.0.0.0
permit=1.1.1.80/28

From the Asterisk CLI :

acl show supplier-acl

ACL: supplier-acl
----------------------------------------
0: deny - 0.0.0.0/0.0.0.0
1: allow - 1.1.1.80/255.255.255.240

which looks correct to me, and sip show peers shows A in the ACL column.

In every case, no matter how I try and configure it, the call goes to the default context unless the host contains the precise IP of the inbound call.

I've tried so many config variations I can't honestly remember them all, so what I'm asking is does anyone know how to do this?

EDIT: I'm using Asterisk 13.0.2

MichelV69 MichelV69 · Accepted Answer · 2015-02-15T14:02:33

ACL restricts the network configuration, but does not identify the host.

You will need a separate peer entry per call origin host to ensure that the calls get to the right context. Just make your [supplier] into a template, and then have several [supplier-srv1], [supplier-srv2] each with host=<specific ip> to distinguish them.

Further Reading
+ https://wiki.asterisk.org/wiki/display/AST/Named+ACLs
+ http://www.voip-info.org/wiki/view/Asterisk+config+sip.conf

Asterisk ACL Doesn't Seem To Work

2 Answers