Ctrl K
ring2all.com

Firewall Services Module Documentation

Table of Contents

  1. Module Overview (Technical)
  2. Module Overview (Commercial/Business)
  3. Module Overview (End User/Administrator)
  4. Configuration Sections
  5. Settings Reference
  6. Common Scenarios & Examples
  7. Limitations & Important Notes
  8. Troubleshooting Tips
  9. Glossary

---

1. Module Overview (Technical)

What Are Firewall Services?

Firewall Services is a service definition module that creates reusable protocol/port templates for use in Firewall Rules. Services define the network protocol and port(s) that rules will match against.

Architecture

Plaintext
┌─────────────────────────────────────────────────────────────────┐
│              Firewall Services Architecture                    │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Service Definitions                                            │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                                                          │   │
│  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐       │   │
│  │  │ HTTP        │  │ HTTPS       │  │ SSH         │       │   │
│  │  │ TCP/80      │  │ TCP/443     │  │ TCP/22      │       │   │
│  │  └─────────────┘  └─────────────┘  └─────────────┘       │   │
│  │                                                          │   │
│  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐       │   │
│  │  │ SIP         │  │ SIP-TLS     │  │ RTP         │       │   │
│  │  │ UDP/5060    │  │ TCP/5061    │  │ UDP/16384-  │       │   │
│  │  │             │  │             │  │    32768    │       │   │
│  │  └─────────────┘  └─────────────┘  └─────────────┘       │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ Used by Firewall Rules                                 │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Firewall Rules                                    │   │
│  │                                                          │   │
│  │  Rule: "Allow HTTP"                                      │   │
│  │  ├─ Service: HTTP ← (TCP/80)                            │   │
│  │  ├─ Action: Accept                                      │   │
│  │  └─ Direction: Input                                    │   │
│  │                                                          │   │
│  │  Rule: "Allow SIP from LAN"                             │   │
│  │  ├─ Service: SIP ← (UDP/5060)                           │   │
│  │  ├─ Action: Accept                                      │   │
│  │  └─ Source: 192.168.1.0/24                              │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ Applied to nftables                                    │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Linux Firewall (nftables)                         │   │
│  │                                                          │   │
│  │  chain input {                                          │   │
│  │    tcp dport 80 accept    # HTTP                        │   │
│  │    tcp dport 443 accept   # HTTPS                       │   │
│  │    udp dport 5060 accept  # SIP                         │   │
│  │  }                                                       │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Key Tables

TablePurpose
public.firewall_servicesService definitions

Key Files

FileDescription
modules/firewallServices/Frontend module
---

2. Module Overview (Commercial/Business)

Business Value

Firewall Services provides reusable port definitions:

Without ServicesWith Services
Repeat port numbersDefine once, use many
Prone to errorsConsistent definitions
Hard to maintainEasy updates
No documentationNamed services

Use Cases

  1. Standard Services

- HTTP, HTTPS, SSH

- Named port definitions

  1. Telephony Services

- SIP, SIP-TLS, RTP

- Voice-specific ports

  1. Custom Applications

- Custom port ranges

- Non-standard services

  1. Maintenance

- Change port once

- Update all rules

Feature Highlights

FeatureBenefit
Named ServicesHuman-readable
Port RangesRange support (8000-8010)
Multi-ProtocolTCP, UDP, ICMP, All
ReusableUse in multiple rules
Enable/DisableToggle without delete
DescriptionDocumentation
---

3. Module Overview (End User/Administrator)

What Can You Do?

  • Create service definitions
  • Define protocol (TCP, UDP, ICMP, All)
  • Set port or port range
  • Add descriptions
  • Enable/disable services
  • Use in Firewall Rules

Firewall Services Interface

Plaintext
┌─────────────────────────────────────────────────────────────────┐
│              Firewall Services                                  │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Manage firewall services for nftables (Debian 13)            │
│                                                                 │
│  [+ Add Service]                                                │
│                                                                 │
│  [🔍 Search services...]                                        │
│                                                                 │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │ Name       │ Protocol │ Port        │ Description │ Status│  │
│  ├────────────┼──────────┼─────────────┼─────────────┼───────┤  │
│  │ HTTP       │ TCP      │ 80          │ Web traffic │ ●     │  │
│  │ HTTPS      │ TCP      │ 443         │ Secure web  │ ●     │  │
│  │ SSH        │ TCP      │ 22          │ Remote admin│ ●     │  │
│  │ SIP        │ UDP      │ 5060        │ SIP signal  │ ●     │  │
│  │ SIP-TLS    │ TCP      │ 5061        │ Secure SIP  │ ●     │  │
│  │ RTP        │ UDP      │ 16384-32768 │ Voice media │ ●     │  │
│  │ STUN       │ UDP      │ 3478        │ NAT travers │ ●     │  │
│  │ TURN TLS   │ TCP      │ 5349        │ NAT travers │ ●     │  │
│  │ Custom API │ TCP      │ 8000-8010   │ API ports   │ ○     │  │
│  └───────────────────────────────────────────────────────────┘  │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Add/Edit Service

Plaintext
┌─────────────────────────────────────────────────────────────────┐
│              Add Firewall Service                               │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Service Name: [SIP-UDP                      ]                 │
│    Descriptive name for the service (e.g., HTTP, HTTPS, SSH)  │
│    Must be unique                                               │
│                                                                 │
│  Protocol: [UDP ▼]                                             │
│    Network protocol used by the service                         │
│    TCP | UDP | TCP/UDP | ICMP | ICMPv6 | All                   │
│                                                                 │
│  Port: [5060                                 ]                 │
│    Port or port range for the service                           │
│    Single port (e.g., 80) or range (e.g., 8000-8010)           │
│                                                                 │
│  Description: [SIP signaling over UDP        ]                 │
│    Optional description for documentation                       │
│                                                                 │
│  Enabled: ✓                                                    │
│    Disabled services cannot be used in rules                    │
│                                                                 │
│  [Save] [Cancel]                                                │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Quick Tips

TIP
Port Ranges: Use hyphen for ranges (16384-32768).
TIP
Descriptive Names: Use clear names like "SIP-UDP", "RTP-Media".
NOTE
Used in Rules: Services are referenced by Firewall Rules.

---

4. Configuration Sections

Service Fields

FieldDescription
Service NameUnique identifier
ProtocolNetwork protocol
PortPort or range
DescriptionOptional notes
EnabledActive/Inactive
---

5. Settings Reference

Protocols

ProtocolDescriptionCommon Use
TCPConnection-orientedHTTP, SSH, SIP-TLS
UDPConnectionlessSIP, RTP, DNS
TCP/UDPBoth protocolsDNS
ICMPInternet controlPing
ICMPv6IPv6 controlIPv6 ping
AllAny protocolBroad rules

Port Format

FormatExampleDescription
Single80One port
Range8000-8010Port range
Multiple80,443List (if supported)

Common PBX Services

ServiceProtocolPort(s)Description
HTTPTCP80Web (redirect)
HTTPSTCP443Secure web + WebRTC WSS proxy
SSHTCP22Remote admin
SIPUDP5060SIP signaling
SIP-TLSTCP5061Secure SIP
RTPUDP16384-32768Voice media
STUNUDP3478NAT traversal
TURN TLSTCP5349NAT traversal (TLS)
ProvisioningTCP80, 443Phone config
NOTE
WebRTC Architecture: WebRTC WebSocket (WSS) traffic is proxied through Nginx on port 443 (path /ws). FreeSWITCH plain WebSocket (port 5066) listens only on localhost and is not exposed to the firewall. Port 7443 (direct WSS) has been deprecated.

---

6. Common Scenarios & Examples

Scenario 1: Create SIP Service

  1. Click Add Service
  2. Name = "SIP"
  3. Protocol = UDP
  4. Port = 5060
  5. Description = "SIP signaling"
  6. Enabled = ✓
  7. Save

Scenario 2: Create RTP Range

  1. Add Service
  2. Name = "RTP-Media"
  3. Protocol = UDP
  4. Port = 16384-32768
  5. Description = "Voice/Video media"
  6. Save

Scenario 3: Create Custom API Service

  1. Add Service
  2. Name = "Custom-API"
  3. Protocol = TCP
  4. Port = 8000-8010
  5. Description = "Internal API ports"
  6. Save

Scenario 4: Update Port Range

  1. Edit existing service
  2. Change port range
  3. Save
  4. All rules using this service update automatically
  5. Apply Rules in Firewall Rules module

---

7. Limitations & Important Notes

Technical Notes

NOTE
Unique Names: Service names must be unique.
NOTE
Used in Rules: Services are referenced by Firewall Rules.
WARNING
Disable Carefully: Disabling breaks rules using the service.

Best Practices

  1. Standard Names: Use industry-standard names (HTTP, SSH)
  2. Clear Descriptions: Document what each service is for
  3. Group Related: Create separate services for clarity
  4. Port Ranges: Use ranges for RTP, not individual ports
  5. Enable Check: Ensure service is enabled before use

Pre-defined vs. Custom

Pre-definedCustom
HTTP, HTTPS, SSHCustom-API
SIP, RTPApp-specific
Standard portsNon-standard
---

8. Troubleshooting Tips

Common Issues

SymptomPossible CauseSolution
Service not in dropdownDisabledEnable service
Rule not workingWrong protocolCheck TCP vs UDP
Port not matchingWrong rangeVerify port format
Can't deleteUsed in rulesRemove from rules first

Check Services

Sql
SELECT 
  name,
  protocol,
  port,
  description,
  is_enabled
FROM public.firewall_services
ORDER BY name;

Check Service Usage

Sql
SELECT 
  r.name as rule_name,
  s.name as service_name,
  s.protocol,
  s.port
FROM public.firewall_rules r
JOIN public.firewall_services s ON r.service_id = s.id
ORDER BY r.priority;

---

9. Glossary

TermDefinition
ServiceProtocol/port template
ProtocolNetwork communication type
PortNetwork endpoint number
Port RangeConsecutive ports
nftablesLinux firewall
---

Lua Script Status ℹ️

Security Module

ComponentStatus
Firewall Servicesℹ️ Service definitions - no Lua handler required
Firewall Services is a configuration module. It defines protocol/port templates for use in Firewall Rules. No Lua handlers are used - definitions are stored in the database and referenced when applying rules.

---

Documentation last updated: January 2026
AI Assistant

👋 Hello! I'm your Ring2All documentation assistant. I can help you find information about configuring and using the Ring2All PBX platform.

How can I help you today?