IPBrick Manual - Referencia - ENV5.2

IPBrick
Reference Guide
Version 5.2
iPortalMais
February 2010
2
Copyright iPortalMais
c
All rights reserved. February 2010.
The information in this manual is subject to change without prior notice. The
presented explanations, technical data, configurations and recommendations are
precise and trustful. Nevertheless, they have no expressed or implied guarantees.
Reference Guide - Version 5.2 iPortalMais - 2010

Contents
1 Aim of this document 15
2 Before Starting 17
3 IPBrick.I 21
3.1 Machine Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.2 Machine Management . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.2.1 Mass Operations . . . . . . . . . . . . . . . . . . . . . . . . 24
3.3 User Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.4 Users Management . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.4.1 Mass Operations . . . . . . . . . . . . . . . . . . . . . . . . 31
3.4.2 XML-RPC management . . . . . . . . . . . . . . . . . . . . 33
3.5 Domain Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.5.1 Configure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
3.5.2 Users Management . . . . . . . . . . . . . . . . . . . . . . . 36
3.6 File Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
3.6.1 Individual Work Areas . . . . . . . . . . . . . . . . . . . . . 38
3.6.2 Group Work Areas . . . . . . . . . . . . . . . . . . . . . . . 39
3.6.3 Kaspersky . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
3.7 E-Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
3.7.1 Configure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
3.7.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
3.7.3 Queue Management . . . . . . . . . . . . . . . . . . . . . . . 50
3.7.4 Users management . . . . . . . . . . . . . . . . . . . . . . . 51
3.7.5 Mailing Lists . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.7.6 Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.7.7 Anti-Virus . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.7.8 Anti-Spam . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
3.8 Print Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
3.9 Backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
3.9.1 Remote . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
3.10 Terminal Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
3.10.1 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 74
3.10.2 Client configuration . . . . . . . . . . . . . . . . . . . . . . . 77
iPortalMais - 2010 Reference Guide - Version 5.2

4 CONTENTS
4 IPBrick.C 81
4.1 Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
4.1.1 Available Services . . . . . . . . . . . . . . . . . . . . . . . . 82
4.1.2 Block Services . . . . . . . . . . . . . . . . . . . . . . . . . . 83
4.2 Proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
4.2.1 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 84
4.2.2 Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
4.2.3 Kaspersky Proxy . . . . . . . . . . . . . . . . . . . . . . . . 94
4.3 VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
4.3.1 PPTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
4.3.2 SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
4.3.3 IPSec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
4.3.4 GRE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
4.4 E-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
4.4.1 Advanced relay . . . . . . . . . . . . . . . . . . . . . . . . . 107
4.4.2 Get Mail from ISP . . . . . . . . . . . . . . . . . . . . . . . 108
4.4.3 Mail Copy . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
4.5 SMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
4.5.1 Configure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
4.5.2 Routes Management . . . . . . . . . . . . . . . . . . . . . . 111
4.5.3 Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
4.5.4 Sending a SMS . . . . . . . . . . . . . . . . . . . . . . . . . 113
4.6 Web Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
4.6.1 Creating a new site . . . . . . . . . . . . . . . . . . . . . . . 115
4.6.2 Management . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
4.7 Webmail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
4.8 FTP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
4.8.1 Access log . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
4.9 VoIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
4.9.1 Phone management . . . . . . . . . . . . . . . . . . . . . . . 124
4.9.2 Users Management . . . . . . . . . . . . . . . . . . . . . . . 126
4.9.3 Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
4.9.4 Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
4.9.5 Routes Management . . . . . . . . . . . . . . . . . . . . . . 151
4.9.6 Music on Hold . . . . . . . . . . . . . . . . . . . . . . . . . . 157
4.10 IM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
4.10.1 Enabling / disabling the IM server . . . . . . . . . . . . . . 157
5 IPBrick.GT 161
5.1 Fax Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
5.1.1 Fax2Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
5.1.2 Mail2Fax . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
5.1.3 Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
6 IPBrick.KAV 169

CONTENTS 5
7 Advanced Configurations 171

7.1 IPBrick . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
7.1.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
7.1.2 System Information . . . . . . . . . . . . . . . . . . . . . . . 173
7.1.3 Web Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
7.1.4 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . 177
7.1.5 Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
7.2 Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
7.2.1 Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
7.2.2 Route management . . . . . . . . . . . . . . . . . . . . . . . 184
7.2.3 QOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
7.2.4 Service Routing . . . . . . . . . . . . . . . . . . . . . . . . . 187
7.3 Support services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
7.3.1 LDAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
7.3.2 DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
7.3.3 DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
7.3.4 ENUM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
7.4 Disaster recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
7.4.1 Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . 210
7.4.2 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
7.5 System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
7.5.1 Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
7.5.2 Task Manager . . . . . . . . . . . . . . . . . . . . . . . . . . 214
7.5.3 Date and Hour . . . . . . . . . . . . . . . . . . . . . . . . . 215
7.5.4 System users . . . . . . . . . . . . . . . . . . . . . . . . . . 216
7.5.5 Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
7.5.6 SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
7.5.7 Reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
7.5.8 Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
7.6 Telephony . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
7.6.1 Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
7.6.2 Registered Phones . . . . . . . . . . . . . . . . . . . . . . . 225
7.6.3 Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . 226
7.6.4 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
7.6.5 SIP peers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
7.6.6 IAX peers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
7.6.7 Auto provisioning . . . . . . . . . . . . . . . . . . . . . . . . 238
8 Apply Configurations 243
9 Appendix A - Join in the domain 245

9.1 Windows XP Professional Workstation . . . . . . . . . . . . . . . . 245
10 Appendix B - Configuring a VPN connection 249

6 CONTENTS
11 Appendix C - Configuration of a VPN SSL connection (Open

VPN) 251
11.1 Two or more SSL certificates . . . . . . . . . . . . . . . . . . . . . . 251
11.2 Configuration of a SSL Connection for MS Windows 2000/XP and
higher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
12 Appendix D - Backup Service - Arkeia 253

12.1 Advanced Administration . . . . . . . . . . . . . . . . . . . . . . . 255
13 Appendix E - High availability 259

13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
13.1.1 Advantages . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
13.2 HA Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
13.3 HA Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
14 Appendix F - UCoIP 263
15 Appendix G - MyIPBrick 267

15.1 Personal Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
15.2 Personal area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
16 Appendix H - Contacts 271

16.1 Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
16.2 Creating an Entity . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
16.3 Creating a Contact . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

List of Figures
2.1 IPBrick login interface . . . . . . . . . . . . . . . . . . . . . . . . . 17

2.2 IPBrick main interface . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.1 Machine Groups - List . . . . . . . . . . . . . . . . . . . . . . . . . 22

3.2 Machine Groups - Example . . . . . . . . . . . . . . . . . . . . . . 22
3.3 Machines Management - Machine registration . . . . . . . . . . . . 23
3.4 Machines Management - Options . . . . . . . . . . . . . . . . . . . 24
3.5 Machines Management - List . . . . . . . . . . . . . . . . . . . . . . 24
3.6 Machine Management - Export . . . . . . . . . . . . . . . . . . . . 26
3.7 Machine Management - Mass Operations . . . . . . . . . . . . . . . 27
3.8 User Groups - Group creation . . . . . . . . . . . . . . . . . . . . . 28
3.9 User Groups - Groups List . . . . . . . . . . . . . . . . . . . . . . . 28
3.10 User Groups - Users . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.11 Users Management - Insert . . . . . . . . . . . . . . . . . . . . . . . 30
3.12 Users Management - Extra LDAP parameters . . . . . . . . . . . . 30
3.13 Users Management - List . . . . . . . . . . . . . . . . . . . . . . . . 31
3.14 Users Management - Operations . . . . . . . . . . . . . . . . . . . . 32
3.15 Users Management - Modify . . . . . . . . . . . . . . . . . . . . . . 32
3.16 Domain Server - Definitions . . . . . . . . . . . . . . . . . . . . . . 36
3.17 Domain server - Users Management . . . . . . . . . . . . . . . . . . 37
3.18 Work Areas - Summary . . . . . . . . . . . . . . . . . . . . . . . . . 37
3.19 Work Areas - List . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3.20 Work Areas - Summary of Individual Areas . . . . . . . . . . . . . 38
3.21 Work Areas - List . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.22 Work Areas - Group - Insert with recycle bin . . . . . . . . . . . . . 40
3.23 Work Areas - Group - Insert without recycle bin . . . . . . . . . . . 40
3.24 Work Areas - Group - Management . . . . . . . . . . . . . . . . . . 41
3.25 Work Areas - Group - Users Access . . . . . . . . . . . . . . . . . . 41
3.26 Workareas - Kaspersky Licence . . . . . . . . . . . . . . . . . . . . 42
3.27 Workareas - Kaspersky - Configure 1/2 . . . . . . . . . . . . . . . . 44
3.28 Workareas - Kaspersky - Configure 2/2 . . . . . . . . . . . . . . . . 45
3.29 Workareas - Kaspersky . . . . . . . . . . . . . . . . . . . . . . . . . 45
3.30 Workareas - Kaspersky - Statistics 1/2 . . . . . . . . . . . . . . . . 46
3.31 Workareas - Kaspersky - Statistics 2/2 . . . . . . . . . . . . . . . . 46
3.32 E-mail - Configure . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
3.33 E-Mail - Definitions 1/2 . . . . . . . . . . . . . . . . . . . . . . . . 51
3.34 E-Mail - Definitions 2/2 . . . . . . . . . . . . . . . . . . . . . . . . 52

8 LIST OF FIGURES
3.35 E-Mail - Definitions - Valid internal recipients . . . . . . . . . . . . 52

3.36 E-Mail - Definitions - Invalid senders . . . . . . . . . . . . . . . . . 53
3.37 E-Mail - Queue Management . . . . . . . . . . . . . . . . . . . . . . 53
3.38 E-mail - Users Management . . . . . . . . . . . . . . . . . . . . . . 54
3.39 E-Mail - Alternative addresses, Forwarding and automatic replys . . 55
3.40 E-Mail - Mailing List - Insert . . . . . . . . . . . . . . . . . . . . . 56
3.41 E-Mail - Mailing List - Users . . . . . . . . . . . . . . . . . . . . . . 56
3.42 E-Mail - Mailing List - External users . . . . . . . . . . . . . . . . . 57
3.43 E-Mail - Kaspersky Anti-Virus . . . . . . . . . . . . . . . . . . . . . 58
3.44 E-Mail - Kasp. Anti-Virus - General Configurations . . . . . . . . . 58
3.45 E-Mail - Kasp. Anti-Virus - Groups Management . . . . . . . . . . 59
3.46 E-Mail - Kasp. Anti-Virus - Notification Rules . . . . . . . . . . . . 59
3.47 E-Mail - Kasp. Anti-Virus - Filter . . . . . . . . . . . . . . . . . . . 60
3.48 E-Mail - Kasp. Anti-Virus - Statistics 1/2 . . . . . . . . . . . . . . 61
3.49 E-Mail - Kasp. Anti-Virus - Statistics 2/2 . . . . . . . . . . . . . . 62
3.50 E-Mail - AntiVirus - ClamAV - Main menu . . . . . . . . . . . . . . 62
3.51 E-Mail - AntiVirus - ClamAV - Definitions . . . . . . . . . . . . . . 62
3.52 E-Mail - Kasp. Anti-Spam - Protected Domains . . . . . . . . . . . 63
3.53 E-Mail - Kasp. Anti-Spam - Actions . . . . . . . . . . . . . . . . . 64
3.54 E-Mail - Kasp. Anti-Spam - Rules . . . . . . . . . . . . . . . . . . . 65
3.55 E-Mail - Kasp. Anti-Spam - Statistics . . . . . . . . . . . . . . . . . 66
3.56 E-Mail - AntiSpam - SpamAssassin - Main Menu . . . . . . . . . . 67
3.57 E-Mail - AntiSpam - SpamAssassin - General Options - Reject . . . 67
3.58 E-Mail - AntiSpam - SpamAssassin - General Options - Mark . . . 67
3.59 E-Mail - AntiSpam - SpamAssassin - Created rules . . . . . . . . . 68
3.60 E-Mail - AntiSpam - SpamAssassin - Whitelist . . . . . . . . . . . . 68
3.61 Print Server - Inserting a network printer at IPBrick . . . . . . . . 69
3.62 Print Server - Printer configurations . . . . . . . . . . . . . . . . . . 70
3.63 Backup - Task insertion . . . . . . . . . . . . . . . . . . . . . . . . 71
3.64 Backup - Task list . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
3.65 Terminal Server - General Configuration - 1/2 . . . . . . . . . . . . 76
3.66 Terminal Server - General Configuration - 2/2 . . . . . . . . . . . . 77
3.67 Terminal Server - Boot System configuration . . . . . . . . . . . . . 77
3.68 Terminal Server - Boot Loader configuration . . . . . . . . . . . . . 78
3.69 Terminal Server - Operating System . . . . . . . . . . . . . . . . . . 78
3.70 Terminal Server - Configuration for PXE boot . . . . . . . . . . . . 78
3.71 Terminal Server - Machines . . . . . . . . . . . . . . . . . . . . . . 79
4.1 Firewall - Available Services . . . . . . . . . . . . . . . . . . . . . . 82

4.2 Firewall - Block Services . . . . . . . . . . . . . . . . . . . . . . . . 83
4.3 Firewall - MSN Exceptions . . . . . . . . . . . . . . . . . . . . . . . 83
4.4 Proxy - Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 84
4.5 Proxy - Rules 1/2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
4.6 Proxy - Rules 2/2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
4.7 Proxy - Source groups . . . . . . . . . . . . . . . . . . . . . . . . . 87
4.8 Proxy - Source groups - LDAP filter . . . . . . . . . . . . . . . . . . 87

LIST OF FIGURES 9
4.9 Proxy - Destination groups . . . . . . . . . . . . . . . . . . . . . . . 89

4.10 Proxy - Access Lists . . . . . . . . . . . . . . . . . . . . . . . . . . 90
4.11 Proxy - Remote Proxy . . . . . . . . . . . . . . . . . . . . . . . . . 90
4.12 Proxy - Other configurations 1/2 . . . . . . . . . . . . . . . . . . . 92
4.13 Proxy - Other configurations 1/2 . . . . . . . . . . . . . . . . . . . 93
4.14 Proxy - Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
4.15 Proxy - Kaspersky - Licence . . . . . . . . . . . . . . . . . . . . . . 94
4.16 Proxy - Kaspersky - General Settings . . . . . . . . . . . . . . . . . 95
4.17 Proxy - Kaspersky - Statistics . . . . . . . . . . . . . . . . . . . . . 96
4.18 VPN - PPTP - Users . . . . . . . . . . . . . . . . . . . . . . . . . . 97
4.19 VPN - SSL Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
4.20 VPN SSL - Client certificate configuration . . . . . . . . . . . . . . 100
4.21 VPN SSL - Access policies list . . . . . . . . . . . . . . . . . . . . . 101
4.22 VPN SSL - Access policy configuration . . . . . . . . . . . . . . . . 102
4.23 VPN - IPSec Configuration 1/2 . . . . . . . . . . . . . . . . . . . . 104
4.24 VPN - IPSec Configuration 2/2 . . . . . . . . . . . . . . . . . . . . 105
4.25 VPN - GRE Configuration . . . . . . . . . . . . . . . . . . . . . . . 107
4.26 E-Mail - Advanced relay . . . . . . . . . . . . . . . . . . . . . . . . 107
4.27 E-Mail - Get Mail from ISP - Base menu . . . . . . . . . . . . . . . 108
4.28 E-Mail - Get mail from ISP - Servers Management . . . . . . . . . . 109
4.29 E-Mail - Get mail from ISP - Add Account . . . . . . . . . . . . . . 109
4.30 E-Mail - Mail copy . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
4.31 SMS - Enable configuration . . . . . . . . . . . . . . . . . . . . . . 111
4.32 SMS - Routes management . . . . . . . . . . . . . . . . . . . . . . . 112
4.33 Web Server - Adding sites . . . . . . . . . . . . . . . . . . . . . . . 115
4.34 Web Server - Features . . . . . . . . . . . . . . . . . . . . . . . . . 117
4.35 Web Server - Alias 1 . . . . . . . . . . . . . . . . . . . . . . . . . . 117
4.36 Web Server - Alias 2 . . . . . . . . . . . . . . . . . . . . . . . . . . 117
4.37 Web Server - Alias List . . . . . . . . . . . . . . . . . . . . . . . . . 118
4.38 Web Server - Redirect - Example 1 . . . . . . . . . . . . . . . . . . 118
4.39 Web Server - Redirect - Example 2 . . . . . . . . . . . . . . . . . . 119
4.40 Web Server - Redirections List . . . . . . . . . . . . . . . . . . . . . 119
4.41 Web Server - Reverse Proxy - Example 1 - Empty site created . . . 120
4.42 Web Server - Reverse Proxy - Example 1 - Add . . . . . . . . . . . 120
4.43 Web Server - Reverse Proxy - Example 2 - Add . . . . . . . . . . . 121
4.44 Web Server - Reverse Proxy - Example 2 - List . . . . . . . . . . . . 121
4.45 Web Server - Statistics . . . . . . . . . . . . . . . . . . . . . . . . . 122
4.46 WebMail - Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
4.47 FTP Server - Account definitions . . . . . . . . . . . . . . . . . . . 123
4.48 VoIP - Phones management . . . . . . . . . . . . . . . . . . . . . . 125
4.49 VoIP - Adding alternative addresses . . . . . . . . . . . . . . . . . . 125
4.50 VoIP - Users Management . . . . . . . . . . . . . . . . . . . . . . . 127
4.51 VoIP - Users Management - User VoIP settings . . . . . . . . . . . 127
4.52 VoIP - Users Management - Access classes and call queues . . . . . 128
4.53 VoIP - Call groups . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
4.54 VoIP - Sequence definitions . . . . . . . . . . . . . . . . . . . . . . 130

10 LIST OF FIGURES
4.55 VoIP - Attendance sequences list . . . . . . . . . . . . . . . . . . . 131

4.56 VoIP - IVR attendance configuration . . . . . . . . . . . . . . . . . 132
4.57 VoIP - Simple IVR . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
4.58 VoIP - Call conference insertion . . . . . . . . . . . . . . . . . . . . 133
4.59 VoIP - Call conference list . . . . . . . . . . . . . . . . . . . . . . . 134
4.60 VoIP - Dynamic call conferences . . . . . . . . . . . . . . . . . . . . 134
4.61 VoIP - Call Parking . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
4.62 VoIP - Call Parking - Modify . . . . . . . . . . . . . . . . . . . . . 135
4.63 VoIP - Scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
4.64 VoIP - Scheduling - Insert rules . . . . . . . . . . . . . . . . . . . . 137
4.65 VoIP - Scheduling - Rules list . . . . . . . . . . . . . . . . . . . . . 137
4.66 VoIP - DISA - Insert . . . . . . . . . . . . . . . . . . . . . . . . . . 138
4.67 VoIP - Callback any number . . . . . . . . . . . . . . . . . . . . . . 139
4.68 VoIP - Callback authorized numbers or hangup . . . . . . . . . . . 140
4.69 VoIP - Callback authorized numbers or redirect . . . . . . . . . . . 140
4.70 VoIP - Call queue definitions . . . . . . . . . . . . . . . . . . . . . . 142
4.71 VoIP - Call queue members . . . . . . . . . . . . . . . . . . . . . . 142
4.72 VoIP - Access Classes - Insert . . . . . . . . . . . . . . . . . . . . . 143
4.73 VoIP - Access Classes - Members . . . . . . . . . . . . . . . . . . . 143
4.74 VoIP - Speed Dial . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
4.75 VoIP - Online phones . . . . . . . . . . . . . . . . . . . . . . . . . . 144
4.76 VoIP - Statistics filter . . . . . . . . . . . . . . . . . . . . . . . . . 146
4.77 VoIP - Call recording definitions . . . . . . . . . . . . . . . . . . . . 147
4.78 VoIP - Call recording - Phones configuration . . . . . . . . . . . . . 148
4.79 VoIP - Call Supervision Group . . . . . . . . . . . . . . . . . . . . . 148
4.80 VoIP - Call Supervision - Supervisioned phones . . . . . . . . . . . 149
4.81 VoIP - Call Supervision Group members . . . . . . . . . . . . . . . 149
4.82 VoIP - Call Manager configuration . . . . . . . . . . . . . . . . . . 149
4.83 VoIP - Call Manager . . . . . . . . . . . . . . . . . . . . . . . . . . 150
4.84 VoIP - Routes Management . . . . . . . . . . . . . . . . . . . . . . 151
4.85 VoIP - Local Routes . . . . . . . . . . . . . . . . . . . . . . . . . . 153
4.86 VoIP - Outbound route definition . . . . . . . . . . . . . . . . . . . 155
4.87 VoIP - Prefix definition . . . . . . . . . . . . . . . . . . . . . . . . . 156
4.88 VoIP - SIP server for registering . . . . . . . . . . . . . . . . . . . . 156
4.89 VoIP - Music on hold . . . . . . . . . . . . . . . . . . . . . . . . . . 157
4.90 IM - Enabling Instant Messaging Server . . . . . . . . . . . . . . . 158
4.91 IM - Blocking MSN applications . . . . . . . . . . . . . . . . . . . . 159
4.92 IM - Web messenger sites blocking in firewall . . . . . . . . . . . . . 159
5.1 Fax Server - Configure . . . . . . . . . . . . . . . . . . . . . . . . . 161

5.2 Fax Server - FAX at telephony card . . . . . . . . . . . . . . . . . . 162
5.3 Fax Server - Serial Fax Modem . . . . . . . . . . . . . . . . . . . . 164
5.4 Fax Server - Fax Users . . . . . . . . . . . . . . . . . . . . . . . . . 165
5.5 Fax Server - Fax line definitions . . . . . . . . . . . . . . . . . . . . 165
5.6 Fax Server - Sent Faxes . . . . . . . . . . . . . . . . . . . . . . . . . 167
5.7 Fax Server - Received Faxes . . . . . . . . . . . . . . . . . . . . . . 168

LIST OF FIGURES 11
5.8 Fax Server - Current Faxes . . . . . . . . . . . . . . . . . . . . . . . 168
7.1 Advanced Configurations - Definitions . . . . . . . . . . . . . . . . 174

7.2 Advanced Configurations - Bonding . . . . . . . . . . . . . . . . . . 174
7.3 Advanced Configurations - System Information - 1/2 . . . . . . . . 175
7.4 Advanced Configurations - System Information - 2/2 . . . . . . . . 176
7.5 Advanced Configurations - Web Access . . . . . . . . . . . . . . . . 177
7.6 Advanced Configurations - Language . . . . . . . . . . . . . . . . . 177
7.7 Advanced Configuration - Authentication modes . . . . . . . . . . . 179
7.8 Advanced Configuration - Authentication - IPBrick Slave . . . . . . 179
7.9 Advanced Configuration - Authentication - IPBrick Client . . . . . 179
7.10 Advanced Configuration - Authentication - Servers list . . . . . . . 180
7.11 Advanced Configurations - Update . . . . . . . . . . . . . . . . . . 181
7.12 Network - Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
7.13 Network - Firewall - General settings rule . . . . . . . . . . . . . . . 183
7.14 Network - Firewall - Disable access rule . . . . . . . . . . . . . . . . 184
7.15 Network - Firewall - DNAT rule . . . . . . . . . . . . . . . . . . . . 184
7.16 Network - Firewall - Order . . . . . . . . . . . . . . . . . . . . . . . 185
7.17 Network - Route management . . . . . . . . . . . . . . . . . . . . . 185
7.18 Network - QoS management . . . . . . . . . . . . . . . . . . . . . . 186
7.19 Network - QOS - General Configurations . . . . . . . . . . . . . . . 187
7.20 Network - Service Routing . . . . . . . . . . . . . . . . . . . . . . . 187
7.21 Support Services - LDAP . . . . . . . . . . . . . . . . . . . . . . . . 194
7.22 Support Services - DNS - Name resolution zones . . . . . . . . . . . 198
7.23 Support Services - DNS - SPF basic options . . . . . . . . . . . . . 200
7.24 Support Services - DNS - SPF advanced options . . . . . . . . . . . 201
7.25 Support Services - DNS - Zone Management 1/2 . . . . . . . . . . . 201
7.26 Support Services - DNS - Zone Management 2/2 . . . . . . . . . . . 202
7.27 Support Services - DNS - Reverse zone . . . . . . . . . . . . . . . . 202
7.28 Support Services - DNS - Forwarders . . . . . . . . . . . . . . . . . 204
7.29 Support Services - DNS - Name resolution . . . . . . . . . . . . . . 204
7.30 Support Services - DHCP - Subnets . . . . . . . . . . . . . . . . . . 205
7.31 Support Services - DHCP - General Options . . . . . . . . . . . . . 206
7.32 Support Services - DHCP - Subnets Definition . . . . . . . . . . . . 206
7.33 Support Services - DHCP - Redundancy . . . . . . . . . . . . . . . 208
7.34 Support Services - DHCP - Machines . . . . . . . . . . . . . . . . . 208
7.35 Support Services - ENUM . . . . . . . . . . . . . . . . . . . . . . . 210
7.36 Disaster Recovery - Replace configuration . . . . . . . . . . . . . . 211
7.37 Disaster Recovery - Download configuration . . . . . . . . . . . . . 212
7.38 Disaster Recovery - Upload configuration . . . . . . . . . . . . . . . 212
7.39 Disaster Recovery - Applications - Data backups list . . . . . . . . . 213
7.40 Disaster Recovery - Applications - Data restore confirmation . . . . 213
7.41 System - Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
7.42 System - Task Manager . . . . . . . . . . . . . . . . . . . . . . . . . 215
7.43 System - Date and Hour . . . . . . . . . . . . . . . . . . . . . . . . 216
7.44 System - Date and Hour - NTP . . . . . . . . . . . . . . . . . . . . 216

12 LIST OF FIGURES
7.45 System - System users . . . . . . . . . . . . . . . . . . . . . . . . . 217

7.46 System - Monitoring - System Logs . . . . . . . . . . . . . . . . . . 218
7.47 System - Monitoring - System Logs - Remote server . . . . . . . . . 218
7.48 System - Monitoring - IPBrick logs list . . . . . . . . . . . . . . . . 218
7.49 System - Monitoring - IPBrick current log . . . . . . . . . . . . . . 219
7.50 System - Monitoring - Accesses - Management . . . . . . . . . . . . 220
7.51 System - Monitoring - Accesses - Entries . . . . . . . . . . . . . . . 220
7.52 System - Monitoring - Traffic . . . . . . . . . . . . . . . . . . . . . 221
7.53 System - Monitoring - Alerts . . . . . . . . . . . . . . . . . . . . . . 221
7.54 System - SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
7.55 System - Reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
7.56 System - Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
7.57 Telephony - Cards - Insert . . . . . . . . . . . . . . . . . . . . . . . 224
7.58 Telephony - Card definitions . . . . . . . . . . . . . . . . . . . . . . 225
7.59 Telephony - Cards list . . . . . . . . . . . . . . . . . . . . . . . . . 225
7.60 Telephony - Simple phone register . . . . . . . . . . . . . . . . . . . 226
7.61 Telephony - Configurations . . . . . . . . . . . . . . . . . . . . . . . 227
7.62 Telephony - Analog and ISDN PRI options . . . . . . . . . . . . . . 230
7.63 Telephony - ISDN BRI options . . . . . . . . . . . . . . . . . . . . 232
7.64 Telephony - Configurations - Codecs . . . . . . . . . . . . . . . . . 233
7.65 Telephony - Configurations - Codecs with g729 . . . . . . . . . . . . 233
7.66 Telephony - Configurations - g729 licence . . . . . . . . . . . . . . . 234
7.67 Telephony - IP PBX remote managers . . . . . . . . . . . . . . . . 234
7.68 Telephony - IP PBX remote managers - Configuration . . . . . . . . 234
7.69 Telephony - VoIP domain alias . . . . . . . . . . . . . . . . . . . . . 235
7.70 Telephony - Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . 236
7.71 Telephony - Interface insertion . . . . . . . . . . . . . . . . . . . . . 237
7.72 Telephony - OCS interface . . . . . . . . . . . . . . . . . . . . . . . 237
7.73 Telephony - SIP peers . . . . . . . . . . . . . . . . . . . . . . . . . 238
7.74 Telephony - IAX Peers . . . . . . . . . . . . . . . . . . . . . . . . . 238
7.75 Auto provisioning - Template list . . . . . . . . . . . . . . . . . . . 239
7.76 Auto provisioning - Phone with a specific template . . . . . . . . . 239
7.77 Auto provisioning - Insert a new configuration for a phone . . . . . 240
7.78 Auto provisioning - Full template list with customized ones . . . . . 240
8.1 Apply Configurations and reboot . . . . . . . . . . . . . . . . . . . 244

8.2 Apply Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . 244
12.1 Backup - Arkeia - Main Menu . . . . . . . . . . . . . . . . . . . . . 254

12.2 Backup - Arkeia - Running Jobs . . . . . . . . . . . . . . . . . . . . 255
12.3 Backup - Arkeia - Backups confirmation . . . . . . . . . . . . . . . 255
12.4 Backup - Arkeia - Add Users . . . . . . . . . . . . . . . . . . . . . . 256
12.5 Backup - Arkeia - Directories to save . . . . . . . . . . . . . . . . . 257
12.6 Backup - Arkeia - Levels . . . . . . . . . . . . . . . . . . . . . . . . 258
13.1 HA Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

LIST OF FIGURES 13
14.1 Web Server - UCoIP site . . . . . . . . . . . . . . . . . . . . . . . . 264
15.1 Web Server - MyIPBrick site - Login . . . . . . . . . . . . . . . . . 267

15.2 Web Server - MyIPBrick site - Available options . . . . . . . . . . . 268
15.3 Web Server - MyIPBrick site - Change settings . . . . . . . . . . . . 269
15.4 Web Server - MyIPBrick site - Personal area . . . . . . . . . . . . . 270
16.1 Contacts login interface . . . . . . . . . . . . . . . . . . . . . . . . . 272

16.2 Contacts index page . . . . . . . . . . . . . . . . . . . . . . . . . . 272
16.3 Auxiliary Data Page . . . . . . . . . . . . . . . . . . . . . . . . . . 273
16.4 Entity Types creation page . . . . . . . . . . . . . . . . . . . . . . . 273
16.5 Profiles management page . . . . . . . . . . . . . . . . . . . . . . . 274
16.6 Profiles Management Insert Page . . . . . . . . . . . . . . . . . . . 275
16.7 Users Management Page . . . . . . . . . . . . . . . . . . . . . . . . 276
16.8 Entities Management Association Boxes . . . . . . . . . . . . . . . 277
16.9 Entities Management page with a created Entity . . . . . . . . . . . 278
16.10Entity details page . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

14 LIST OF FIGURES

Chapter 1
Aim of this document
This reference guide gives you a detailed description of the following IPBrick
menus:
• IPBrick.I configuration;
• IPBrick.C configuration;
• IPBrick.GT configuration;
• IPBrick.KAV configuration;
• Advanced Configurations.
In the appendix we present the procedure to deal with the Workstation con-
figurations. You will find there, the following configurations
• Process of joining a workstation (MS Windows) to a domain;
• Procedures for the establishment of a virtual private network (VPN) PPTP

and SSL.

16 Aim of this document

Chapter 2
Before Starting
IPBrick is a complete integrated server system based on a Linux distribution.

When installed you can access IPBrick with an Internet browser. The IPBrick IP
address by default is 192.168.69.199. The address to be inserted on the browser
is https://192.168.69.199 (Figure 2.1).
Figure 2.1: IPBrick login interface
When you open a WEB session with IPBrick you will see a login web page.
After a correct validation, IPBrick allows you access to the main configuration

18 Before Starting
page. Here you can change the domain and the IP network of the private and
public server interfaces.
Attention: If the communication network, where you are trying to install
IPBrick has already a DHCP server you should deactivate this in order to avoid
conflicts.
For more information about installing IPBrick and configuring a workstation,

please consult the Installation Manual.
IPBrick web interface management is divided into five main menus (Figure
2.2):
• IPBrick.I : For the configuration of specific Intranet services;
• IPBrick.C : For the configuration of specific Communication services outside

the LAN;
• IPBrick.GT : Permits an easy way to configure the services normally active

at the IPBrick.GT appliance1 ;
• IPBrick.KAV : Permits an easy way to configure the services normally active

at the IPBrick.KAV appliance2 ;
• Advanced Configurations.
All configurations done by the IPBrick administrator are stored in a Post-

greSQL database. Only when the option Apply Configurations is clicked, will the
database generate all the new system configuration files. Changing the configura-
tions in the following menus:
• Advanced Configurations IPBrick Definitions;
• Advanced Configurations IPBrick Authentication;
• Advanced Configurations System Date and Hour Time zone;
causes a restart of IPBrick (IPBrick needs approximately 1 minute to restart,

depending on the hardware where it is installed).
IPBrick provides an efficient configuration management where, whenever changes

are made to the system, by the web interface, a new configuration will be locally
saved or automatically stored in an USB pen. This way the Disaster Recovery
is guaranteed, this is just one of the surplus values of IPBrick. For example, if
the hard drive crashes down, you can quickly restore the configurations with the
1
It’s an IPBrick hardware appliance for IP telephony with analogic/ISDN telephony cards
integration
2
It’s an IPBrick hardware appliance acting as a security gateway, including Kaspersky licensed
software.

19
IPBrick Installation CD and the USB pen.
On the management interface there are some links that allow you to manage
the services:
• Back : Allows you to turn back to the previous page without saving changes;
• Insert: Allows you to insert new items;
• Modify: Allows you to change item settings;
• Delete: Allows you to delete an item;
Figure 2.2: IPBrick main interface

20 Before Starting

Chapter 3
IPBrick.I
This chapter describes the IPBrick.I menus used to manage the main Intranet
services.
It is divided into the following main sections:
• Machine Groups
• Machines Management;
• User Groups;
• Users Management;
• Domain server;
• File Server;
• E-mail;
• Print Server;
• Backup;
• Terminal Server.
3.1 Machine Groups

In this menu you can manage groups of machines, it lets you create groups
and assign machines to each group. For instance, machine groups can be used to
configure web proxy accesses. To insert a group of machines you have set:
• Group name: The name assigned to the group of machines;
• Group type
– Machines Subnets: Depending on the used IP address, these groups

of machines can be split into defined sizes;

22 IPBrick.I
– Machines: If you choose this option and Insert, it’s possible to assign
existing network machines to the group;
• Machine count: If the group is a subnet of machines, you can choose the
number of machines for the group;
• Subnet: This field defines the subnet for the group of machines. It represents
the range of IP addresses concerning the defined group.
By clicking Insert, the group is created and its settings are displayed. On
that screen you can see three links: Back to go back to the list; Modify to change
the name of the present group; Delete to remove the machine group. We can see
an example of a machine group at Figure 3.2 and the general list at Figure 3.1
Figure 3.1: Machine Groups - List
Figure 3.2: Machine Groups - Example
3.2 Machine Management

This section deals with adding or changing machine registrations in LDAP (e.g.
PC, laptop, printer). A machine is represented by the type, name, group, IP ad-
dress and MAC address, as you can see in Figure 3.3.
There are these machines types:

• Workstation: Workstation in LAN running a Windows operating system;
• Workstation + SoftPhone: Windows workstation in LAN with a softphone
association;

3.2 Machine Management 23
• Linux Workstation: Workstation in LAN running a Linux distribution, so

it will be possible to export the user’s home account by NFS to that Linux
clients;
• Linux Workstation + SoftPhone: Linux workstation in LAN with a soft-

phone association. The name will be the SIP username and it will always be
associated to the IP address;
• Printer: Network printer. Location is a description about the printer loca-

tion. Port will be the port where the print server is running. e.g.: 9100 for
HP’s;
• IP Phone: Hardware IP SIP phone in LAN. The name will be the SIP
username and it will always be associated to the IP address;
• Linux Terminal: Thinclient with remote session to a Linux machine that will
be used with the Terminal Server in IPBrick;
• Windows Terminal: Thinclient with remote session to a Windows machine

that will be used with the Terminal Server in IPBrick;
In order to insert a machine you only have to define the type, introduce the
name and IP Address. In this way the machine is registered in the LDAP and
the DNS server. If you fill in the MAC Address field with the MAC adddress of
the machine to be registered then a record is also created for this machine in the
DHCP server.
Note: The machine MAC address can be obtained from the network connection
icon in Windows XP or by executing the order ipconfig /all in the command line.
Figure 3.3: Machines Management - Machine registration
You can manage a specific machine clicking over its name in the list. You will
get the screen present at Figure 3.4. If you click the link Modify, the form from
Figure 3.3 is displayed and enables you to redefine the machine parameters. If you
click Delete, the machine will be deleted. When all the machines are registered
you can get the list at the main menu (Figure 3.5).

24 IPBrick.I
Figure 3.4: Machines Management - Options
Figure 3.5: Machines Management - List
3.2.1 Mass Operations

The Export feature will export all the data to a .csv file (Figure 3.6). The
Mass operations option permit an import of a .csv file (Figure 3.7). You can edit
a .csv file in a spreadsheet application, choosing the ; to split the columns. When
doing an export we can see all the fields present.
Mandatory fields:
• action: Options available:
– I: To insert a machine in IPBrick;

– U: To update machine information in IPBrick;
– D: To delete a machine in IPBrick;
• machinetype: Options available:
– 1: For Workstation;
– 3: For Workstation + Softphone;
– 14: For Linux Workstation;
– 15: For Linux Workstation + Softphone;
– 16: For Printer;
– 2: For IP Phone;
– 7: For Linux Terminal;

3.2 Machine Management 25
– 4: For Windows Terminal.
• name: Machine single name;
• ip: Machine IP. The format is xxx.xxx.xxx.xxx;
Other fields:
• mac: Machine NIC MAC address. The format is xx:xx:xx:xx:xx:xx;
• password: Password to use if a SIP phone is selected. e.g.: 123;
• computernumber: Machine LDAP ID;
• groupnumber: Machine group number if associated to some group;
• rdpsrvaddress: Remote server IP if a terminal is selected;
• rdpsrvdomain: Remote server domain if a Windows terminal is selected;
• callerid;
• voip_nat;
• voip_disallow;
• voip_allow;
• voip_dtmfmode;
• voip_subscribecontext;
• voip_pickupgroup;
• voip_callgroup;
• voip_canreinvite;
• voip_insecure;
• voip_athuser;
• voip_fromuser;
• voip_fromdomain;
• voip_mailbox;
• voip_quality;
• voip_call_limit;
• phonedescription;
• idphonetemplate;

26 IPBrick.I
• printerdescription;
• printerlocation;
• printerport.
Example of a .cvs file content for mass operations import option:
action;computernumber;machinetype;name;groupnumber;ip;mac;password
I;;1;wrk03;;172.29.1.52;00:E0:98:9B:45:06;
I;;1;wrk04;;172.29.1.54;00:E0:98:9B:45:04;
I;;3;softphone04;;172.29.1.57;00:E0:98:9B:45:54;1234
! Attention !:
• The computer’s name has to alphanumerical. Exceptions are the characters

_ and -;
• The computer’s name shouldn’t contain spaces nor diacritical marks on char-
acters neither punctuation. Its maximum length should be 15 characters;
• It is not allowed to register neither machines with the same name nor ma-
chines whose names are identical with a registered user log in;
• For a registration of a Windows station, the name as to be always in small

letters and if necessary change the Computer name to small letters, too.
Figure 3.6: Machine Management - Export

3.3 User Groups 27
Figure 3.7: Machine Management - Mass Operations
3.3 User Groups

A group is a set of users generally created when you wish that all people in that
group share the same permissions to a set of files. In this section you’ll manage
IPBrick user groups.
• To create a new group:
– Click on Insert (Figure 3.8);

– Choose the group name.
• To add or remove users from a group:
– Click on the group name (Figure 3.9);

– In the generated page (Figure 3.10) choose the users that should be
added or removed from the defined group.
There are two pre-defined groups that cannot be deleted or changed. These
groups are:
• Administrators;
• General.
Users that belong to the Administrators group have administrator permissions

in the domain served by IPBrick. You may add or remove users of this group with
the exception of the pre-defined Administrator. The General group is a common
group for all users created in IPBrick.
! Attention !:
• When inserting new groups their name can be in capital and/or small letters.
• The group name can contain spaces, but can’t have more than 32 alphanu-
merical characters without accents.
• When the user is created, there shouldn’t be other group with the same
name, including domains.

28 IPBrick.I
Figure 3.8: User Groups - Group creation
Figure 3.9: User Groups - Groups List
3.4 Users Management

In this section you learn how to register new users, change the information of
already existing users and delete users. When creating a new user, IPBrick creates
automatically an e-mail account and an individual work area (user drive space in
the server) and a net logon in order to identify the user in the domain. After being
installed, IPBrick creates by default one user and two groups. The created user
has the login Administrator, this login can’t be altered and the two groups are
the Administrators and the General. The user with the Administrator login
has a work area created in the Work Area 1. This user has special characteristics
because he belongs to the Administrators group and is responsible for the man-
Figure 3.10: User Groups - Users

3.4 Users Management 29
agement of some of the system’s included sites and functions. Therefore he can
never be removed.
The user registration is composed of the following fields:
• Name: User’s name. Usually it’s his first and last name;
• Login: User’s identification to be used for any IPBrick authentication pro-

cess.
• Server: Selection of the server where the user account shall be created. The
user account stands for the hard drive space in the server where various
user contents are stored, including an email folder, Windows profile and
documents. If there are slave servers they are also listed.
• Work Areas: Partition of the server drive selected to create the account.
The users should be distributed in an equitable way, in order to efficiently
use the available space.
• Password: Password definition;
• Retype Password: Confirmation of the password;
• Quota: Value that limits the user hard drive space in the system. The unit
os measurement is kilobytes. If you don’t indicate a limit value, the user will
have unlimited space to occupy.
At option Extra Options we can define other LDAP parameters for the users
like :
• Employee Number;
• Department Number;
• Room Number;
• Phone extension;
• Employee type;
• Business category.
An example is present at Figure 3.11 and Figure 3.12

! Attention:
• When inserting users, only use characters without accents for their name,
login and e-mail address.
• Spaces, brackets, full stops, small and capital letters are possible in the Name
field.

30 IPBrick.I
Figure 3.11: Users Management - Insert
Figure 3.12: Users Management - Extra LDAP parameters
• You are not allowed to use spaces in the Login field. Avoid using capital
letters.
• Every login has to be unique. There cannot be a login with the same name
of a machine registered in IPBrick.
In order to modify some user information you have to click over the name (Fig-
ure 3.13).
In the form where you change the user (Figure 3.15) you can see all fields
that were defined when the user account was created. The only exception is the

Figure 3.13: Users Management - List
uidNumber which is an IPBrick user identification number. The password is

not shown. All defined fields are editable with the exception of the login and
uidNumber.
To remove a IPBrick user record:
• Click on the user name;
• In the generated page, besides from displaying user properties, you can also
delete the user (Figure 3.14).
⇒ Note: The user’s contents (personal files, profile, e-mails) are not elimi-
nated when deleting his registration. They are moved to an administrative share
called BackupX (X representing the number of the work area where the user was
registered, 1 or 2). Only members of the Administrators group have access to
this share from any Windows station. Therefore they have to do the following:
• Press the keys [Win]+[R] at the same time
• Write \\ipbrick\backup1 and press the ”OK” button.
All folders and files deleted in these administrative shares are finally eliminated
in IPBrick.
3.4.1 Mass Operations

The Export feature will export all the data to a .csv file. The Mass operations
option permits an import of a .csv file. You can edit a .csv file in a spreadsheet
application.
Mandatory fields:
• actionuser: Options available:
– I: To insert a user in IPBrick;

32 IPBrick.I
Figure 3.14: Users Management - Operations
Figure 3.15: Users Management - Modify
– U: To update user information in IPBrick;

– D: To delete a user in IPBrick;
– N: Make no action to that user;
• usernumber: User LDAP ID. It begins at 10000 to administrator, so the

value can be incremented in 1 for the other LDAP users;
• login: User login;
• name: User name. If more than one word is used the " is necessary;
• email: User email;
• accountquota: Quota for the user account. The 0 is unlimited;
• idworkarea: User work area number;
• password: Insert a user password. Later the user can change it at the
myipbrick site. Note that this field is not present when we export a .cvs file,
so it must be created;

Other fields:
• groupnumber: Group LDAP ID of user;
• idserver: Slave server IP where to create the account. The 0 is for local;
• randompassword: Used to generate random password’s for users;
• sipurl: User’s SIP url, representing the phone near the user;
• mailaccountstatus: 1 for active, 2 for inactive;
• mailalias: User alternative mail address;
• mailquota: Maximum mail account quota in MBytes;
• mailmaxsize: Maximum received message size in MBytes;
• mailforward: It’s a forward mail for the user;
• mailoutoreply: It’s the automatic reply message. The use of " is needed;
• homedrive: Represents the account network drive. The default is Z;
• roamingprofile: 1 for a roaming profile, 2 for a local profile.
• employeenumber: Field that represents the employee number;
• departmentnumber: Represents the employee department number;
• roomnumber: User’s room number;
• pager: User’s page number;
• employeetype: Represents the category for the employee;
• businesscategory: This field represents the employee’s business category
actionuser;usernumber;login;name;email;accountquota;idworkarea;password
I;10001;jdomingues;"Joao Domingues";jdomingues@domain.com;0;;2;123456
I;10002;jsmith;"John Smith";jsmith@domain.com;0;;1;123456
3.4.2 XML-RPC management

It’s possible to manage the IPBrick LDAP users using XML-RPC. So using a
client and calling the url:
https://IPBRICK_IP/xmlrpc/server.php
you can send specific .xml messages to:
• Add users;
• Modify users;
• Delete users.

34 IPBrick.I
Add user message

<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
<methodName>adduser</methodName>
<params>
<param>
<value><string>login</string></value>
</param>
<param>
<value><string>md5_password</string></value>
</param>
<param>
<value><string>login:userlogin</string></value>
</param>
<param>
<value><string>name:username</string></value>
</param>
<param>
<value><string>email:user@domain.com</string></value>
</param>
<param>
<value><string>password:12345</string></value>
</param>
<param>
<value><string>mailalias:useralias1@domain.com;useralias2@domain.com
</string></value>
</param>
</params>
</methodCall>
Modify user message

<methodCall>
<methodName>modifyuser</methodName>
<params>
<param>
</param>
<param>
</param>
<param>
</param>
<param>

3.5 Domain Server 35
<value><string>name:username</string></value>
</param>
<param>
<value><string>email:user@domain.com</string></value>
</param>
<param>
<value><string>password:12345</string></value>
</param>
<param>
<value><string>mailalias:useralias1@domain.com;useralias2@domain.com
</string></value>
</param>
</params>
</methodCall>
Delete user message

<methodCall>
<methodName>deluser</methodName>
<params>
<param>
</param>
<param>
</param>
<param>
</param>
</params>
</methodCall>
Note: The first two parameters must be replaced with the IPBrick web inter-
face credentials.
3.5 Domain Server

IPBrick, as a Intranet server, manages all the network resources belonging to
a certain domain and provides important network support services as DNS and
DHCP. A relevant feature to consider in the domain server 1 is that it works with
the authentication server, where all the users have a username/password match
defined in the LDAP database of IPBrick. PDC is checked whenever there is a
authentication demand in a workstation.
1
Primary Domain Controller

36 IPBrick.I
3.5.1 Configure
In this section you define the name of the domain served by IPBrick as well as
this fields (Figure 3.16):
• Domain Login:
– YES: IPBrick will be a Primary Domain Controller in the chosen do-
main;
– NO: IPBrick will not operate as a domain server.
• Default account network drive: The drive where the users account will be
mapped in the workstations side. The default setting is Z;
• Default type of profile: The profile in a Windows workstation is a group of
folders that are stored normally at c:\Documents and Settings\user_login;
– Roaming: In this case, when the user logs out from the workstation,
all the profile folders are synchronized to the user personal account in
IPBrick, located at \\ipbrick\user_login\.profiles. When he logs
in again at the same workstation or at a different one, the profile will
be synchronized back to the workstation;
– Local: The profile will never be synchronized to IPBrick.
⇒ Note: The information on this page is only valid for the MS Windows
environment. The IPBrick Domain Name field is related to the Workgroup or
Domain Name in the MS Windows environment.
Figure 3.16: Domain Server - Definitions
3.5.2 Users Management

For each user it’s possible to specify:
• Account network drive: Z: by default;
• Type of profile: Roaming or local;
Clicking on that option the user’s list is presented. Choosing a specific user as
shown at Figure 3.17, we can configure the domain server definitions for him.

3.6 File Server 37
Figure 3.17: Domain server - Users Management
3.6 File Server

A work area corresponds to a physical partition in the drive with the denomi-
nation /home1 or /home2. When a new user is created, the system also creates its
personal account that represents a folder structure that supports the user account.
1. Personal Accounts: Located in the MS Windows environment, it contains

e-mail files and the user profile;
2. Group Sharing: Responsible for storing user group files
3. Administrative Sharing: Responsible for sharing user accounts and elim-
inated group sharings. These areas are only available for Administrators.
IPBrick has two Work Areas by default: Work Area 1 and Work Area 2.
When you click on Work Areas you are given a list of all users and sharing groups
classified by Work Area as well as information about the occupied space in the
system of each individual Work Areas (Figure 3.18).
Figure 3.18: Work Areas - Summary

38 IPBrick.I
3.6.1 Individual Work Areas

When you select Individual Work Areas, IPBrick shows you a list with the
existing Work Areas and a schedule of the occupation rate for each Work Area
(Figure 3.19). These Work Areas correspond to the hard drive space where the
users data is stored. At Configurations we can enable or disable the recycle bin
folder for the users. It’s possible to enable for all or to disable for all.
Figure 3.19: Work Areas - List
Figure 3.20: Work Areas - Summary of Individual Areas
When you click on a Work Area, e.g.: Work Area 1, you are given a list of all
users introduced in this area as well as the occupied space of each user (Figure
3.20). Each user area is created in the moment you make the IPBrick registration
in IPBrick.I Users Management. In individual workareas we also have the list
of FTP accounts created in FTP menu at IPBrick.C.
! Attention !: If the occupied space in the Work Areas reaches 100%, users
can longer save their data in IPBrick. More over, e-mails are no more delivered to
the users. They stay in the queue until some space is released in the Work Areas.
It is recommended to keep the occupation rate of each Work Areas under 95%.

3.6 File Server 39
! Attention !: Enabling the recycle bin for the users is not recommended in
case of small disk capacity.
3.6.2 Group Work Areas

The group work areas are network shares that can be accessed by SMB or by
NFS clients. You can create network shares in any Work Area. After creating a
network share you have to define the correspondent access permissions.
When inserting a Group Work Area you have to first choose the workarea were
the share will be created (Figure 3.21) and fill in the following fields:
• Name: Name of the share folder. Try to avoid spaces, characters with accents
and punctuation;
• Description: Share description. It’s an optional field;
• Administrator: Share administrator’s email. It’s a optional field;
• Browseable: If Yes it will appear in the server browse list. If No the share
will became hidden;
• Recycle bin: Enables the use of a recycle bin;
• Name of the recycle bin folder: If you have chosen to enable the pre-
vious option, you can set in here the folder that will be used as a recycle
bin.
Figure 3.21: Work Areas - List
Two examples can be viewed at (Figure 3.22) and (Figure 3.23).
Access Permissions
After creating a Group Work Area you have to give permissions to the users
in order to have access to the network share. This is done by first clicking at the
share name as shown at Figure 3.24.
There are 3 different types of permissions:
• None: No access to the share. Users have no access to open a share folder
on a workstation;

40 IPBrick.I
Figure 3.22: Work Areas - Group - Insert with recycle bin
Figure 3.23: Work Areas - Group - Insert without recycle bin
• Read Only: Users have access to share folders and its files. Nevertheless,
they are not allowed to change these files;
• Read/Write: Users have access to share folders and its files and are allowed
to change files and save changes.
Permissions are given to individual users or user groups (Figure 3.25). Users
groups are defined in IPBrick.I Group Management.
For example, in order to create a share folder for users belonging to a commer-
cial department you have to take the following steps:
• Create group ”Dept Financeiro”, in Group Management and add the users
of this department to the group.
• Create an area called ”Financeiro” in Work Areas Group Work Areas.
• Give read and write permissions to the group ”Dept Financeiro”. The other
groups have either reading permissions or no access to this area.
⇒ Note: When defining user group permissions any change in the General
group leads to changes for all the other groups. This happens because all users

3.6 File Server 41
Figure 3.24: Work Areas - Group - Management
Figure 3.25: Work Areas - Group - Users Access
introduced in IPBrick are part of General group.
⇒ Note: A deleted share is no longer available to users. All files in this share
are moved to an administrative share called BackupX (X representing the number
of the work area where the share was created, 1 or 2) that you can find in the
same Work Area. Only users belonging to the IPBrick Administrators group
can access this folder. It’s possible to access this share from a Windows station, if
you take the following steps:
• Press the keys [Win]+[R] at the same time
• Write \\ipbrick\backup1 and press ”OK” (share that exist in Workarea 1)
All files and folders deleted in these administrative share are permanently
deleted in IPBrick.

42 IPBrick.I
3.6.3 Kaspersky
Kaspersky Antivirus for Samba Server (file server) is already installed in IP-
Brick. After inserting a valid license (Figure 3.26), Kaspersky Antivirus for Samba
Server is activated and displays the interface with the following links:
• Update: After the license expires you should renew it with a new license file;
• Delete: Removes the license;
• Configure: It provides you a general Anti-Virus configuration option;
• Work areas: Antivirus behavior in work areas;
• Statistics: Interface with specific statistics about the file server’s Anti-
Virus.
Figure 3.26: Workareas - Kaspersky Licence
Configuration
General settings:
• Notify from the address: Sender that will make the notifications;
• Notify to the address: Email address that will receive notifications.
Object settings:
• Directory exclusion mask: Directories that will be analyzed;
• File exclusion mask: Files that will be analyzed;
• Packed Files: If you choose this item, this type of file will be analyzed;
• Archives: If you choose this item, this type of file will be analyzed;
• Auto-extraction files: If you choose this item, this type of file will be
analyzed;

3.6 File Server 43
• Email database: If you choose this item, this type of file will be analyzed;
• Text format email: If you choose this item, this type of file will be ana-
lyzed.
Scan settings:
• Cure: If activated, detected virus will be automatically removed;
• Use heuristic: If activated, virus can be detected through the analysis of

the code with characteristics and behavior similar to a virus;
• Usar IChecker: If the file was not modified since the last time that was
checked, there will be no new analysis for this file.
Actions Settings: Defines what the Anti-Virus will do with infected and sus-
pecting files or with warnings
• Remove: Removes the file;
• Inalterable: Doesn’t make any action on the file;
• Move: Moves the file.
Notification settings: Defines what notifications the Anti-Virus will do about

infected and suspecting files or with warnings.
• Notify user through winpopup: Notification using the Windows net send
command;
• Notify user through email;
• Notify administrator through email.
To change settings click on Modify. You can see the configuration interface at
Figure 3.27 and Figure 3.28.
Workareas
By default, work areas are verified when they are opened and closed. You can
set for each share if it will be protected, or not, and if it will be verified when users
open and/or close files, like shown at Figure 3.29.
Statistics
Several statistics are displayed in this interface:
• Virus Statistics in period: Options of displaying Virus Statistics (Fig-

ure 3.30):
– Start: The starting date for statistics;

44 IPBrick.I
Figure 3.27: Workareas - Kaspersky - Configure 1/2
– View: Can be set to hours, days, months or years;

– Repetition: Scale of the graph’s horizontal axis;
– Group: It enables you to group data, depending on the chosen view
• Vı́rus statistics: The display can be filtered by: Infected files, protected,
corrupted, errors and files where disinfection failed;
• Virus list: Can be organized by Virus name/Number of occurrences (Fig-

ure 3.31).
3.7 E-Mail
Email is the most used network service in Internet, gradually replacing tradi-
tional mail and fax. The protocol used to send electronic messages is SMTP (Sim-
ple Mail Transfer Protocol) that runs on gate 25 TCP. It enables email sending
for one or several recipients and is implemented by MTA (Mail Transfer Agents).
IPBrick’s MTA is Qmail2 .
SMTP is only capable of sending messages, therefore, users need the POP3/IMAP
protocol to retrieve messages from the servers, these protocols are supported by
all email clients.
2
http://cr.yp.to/qmail.html

3.7 E-Mail 45
Figure 3.28: Workareas - Kaspersky - Configure 2/2
Figure 3.29: Workareas - Kaspersky
IPBrick’s Email section is composed of:
• Configure;
• Queue Management;
• Users Management;
• Mailing Lists;
• Statistics;
• Kaspersky Anti-Virus;
• Kaspersky Anti-Spam.

46 IPBrick.I
Figure 3.30: Workareas - Kaspersky - Statistics 1/2
Figure 3.31: Workareas - Kaspersky - Statistics 2/2
3.7.1 Configure
An important concept about the email server configuration is open relay. A
server that works in open relay processes messages between senders and recipients
out of the server’s domain, that actually can even be non-existent. Obviously,
IPBrick doesn’t work as an open relay, it only forwards Internet emails to domains
that are explicitly indicated.

3.7 E-Mail 47
It is important to mention four very simple and decisive concepts in E-mail

configuration:
1. Locally delivered domains: E-mail addresses with destination to the IP-

Brick server itself, that is, the associated e-mail accounts are in the local
network. E-mails that are in the queue and whose recipient is one of these
domains are not sent to another server in order to be delivered. The domains
served by the machine have to be correctly configured in each DNS domain
server. That is, the ”E-mail servers” of these domains have to be configured
to this machine.
2. Authorized relay domains: IPBrick forwards all the messages that have
their domains in this list and will be accepted by the server to a queue list.
Messages to other recipients that don’t belong to this domains won’t be
accepted by the server (please see 3 .
3. Relay networks definitions: IPBrick relays to any domain as long as the

e-mail is sent from his corresponding internal network. If there are different
internal IP networks it is necessary to add these networks to the list. This
way all machines in the networks are able to send e-mails to other domains
using IPBrick as a relay server. The Other networks (Internet IP’s) could
use this SMTP server but only with TLS authentication. So someone in
Internet that want to use the IPBrick’s SMTP to send email is forced to
authenticate with his LDAP username/password;
4. SMTP Routes: SMTP routes are configured when you want e-mails to follow
a certain way (server) in order to find their recipient. Normally, a SMTP
route is defined by default (showing the SMTP route and leaving the Domain
empty).When the server is not correctly registered with the IP name in the
Internet DNS, you have to define a SMTP route. In this route it should be
either the server responsible for the forward of company e-mails or the SMTP
server of the ISP used by firms to access the Internet. This configuration is
necessary because certain e-mail servers make additional verifications of the
sending server authenticity. If they can’t resolve the server name into the
corresponding IP address (reverse DNS check), the mail may be deleted or
sent back as SPAM. In case no SMTP route is used the server tries to send
the mails in the queue by his own. With the help of the DNS registrations
he tries to find the recipients directly in the Internet.
Each e-mail configuration option has a link to Insert new entries (Figure 3.32).
The domains for local delivery (domains with IPBrick serves) and relay (do-
mains which IPBrick forwards) can be edited and/or deleted. The exception is
3
Only e-mails from the Internet respecting these rules are processed. IPBrick is not configured
as open-relay.

48 IPBrick.I
Figure 3.32: E-mail - Configure
the domain whose name is the same as that of the machine in the local networks
or that of the local domain in the relay.
⇒ Note: To make IPBrick relay e-mails to another server holding the ac-
counts, the firm base domain has to be retreated from the domains served by
IPBrick, since it is a domain served by IPBrick by default.
By default IPBrick only forwards email messages that come from its private
network. If there are different internal IP networks, they should be added to allow
them to send messages.
There are two different types of SMTP routes:
1. FQDN4 of the route server. For example: smtp.exchange.telepac.pt.
2. IP address of the route server. Please give attention to the brackets 195.22.133.45.
In the following you are given two examples of configurations, one with an
IP for a specific domain and another configuration for the same domain with the
FQDN:
First Example:
Domain : abzas.miz
SMTP route : 195.22.133.45
Second Example:
4
Fully Qualified Domain Name

3.7 E-Mail 49
Domain : abzas.miz
SMTP route : smtp.exchange.telepac.pt
An important configuration is that of a machine relaying e-mails. Whenever

you add in this situation a SMTP route by default (without indicating the domain)
you have to add another SMTP route to forward e-mails do the internal e-mail
server. In the following you can see an example of such a configuration.
In this configuration IPBrick is relaying all the e-mails comming to an internal

e-mail server called accounts. IPBrick have a second route to deliver all the mail
to the Internet by the smarthost smtp.isp.pt:
Domain: domain.com
SMTP route: accounts.domain.com
Domain:
SMTP route: smtp.isp.pt
3.7.2 Definitions
There is a link called Definitions (see Figure 3.33 and Figure 3.34) to define
characteristics of the e-mail server:
• Message maximum size: It’s the global message maximum size of a re-
ceived/sended message
Value by default: unlimited.
• Maximum time to hold the message in the server: Maximum time the
message will be in mail queue
Value by default: 604800 seconds (7 days)
• Maximum number for simultaneous SMTP connections: Number of con-
nections that the server can support
Value by default: 20
• Incoming message timeout: Maximum time to receive a single message in
server. If reached it will timeout
Value by default: 1200 seconds
• Outgoing message timeout: Maximum time to send a single message. If
reached it will timeout
Value by default: 1200 seconds
• Reject emails from invalid domains: The server will reject incoming
mail if the sender’s domain MX record don’t exist, so it will be invalid.
Default value: Yes
• Reject emails from invalid servers: The server will reject incoming
mail if the sender’s FQDN don’t have a reverse DNS record.
Default value: No

50 IPBrick.I
• Approaching quota limit warning message: Message to send to the user

when the mail quota is approaching the limit. The default is Quota Warning!;
• SPF (Sender Policy Framework): It’s disabled by default. If active, for

each incoming mail, the sender will be asked about the mail authenticity.
The mail rejection will depend of the sender answer and protection level de-
fined here. The SPF mechanisms, qualifiers and modifiers can be found at
SPF site (http://www.openspf.org/SPF_Record_Syntax).
These are the protection levels defined at IPBrick mail server:
– Standard protection: The mails will be rejected if the answer is Fail;

– Medium protection: The mails will be rejected if the answer is Fail or
SoftFail;
– High protection: The mails will be rejected if the answer is Fail,
SoftFail or Neutral;
• Blacklist (RBL): Enable or disable the RBL (Realtime blacklist) or DNSBL

verification. That verification is made to all incoming mails from the Internet
and before the KAV filter. The following are used by default:
– http://www.spamhaus.org/SBL
– http://0spam.fusionzero.com
– http://www.uceprotect.net/en
– http://www.spamsources.fabel.dk/
In this interface it is even possible to define permissions of sending and receiving

e-mails:
• Valid internal recipients: This list is important to fill in order to pro-

tect the server from a mailbomb attack. Here should be listed all the internal
valid email addresses. If the list is empty all the internal recipients will be
accepted (Figure 3.35);
• Invalid senders: A list with e-mail addresses that are not allowed to send
email (Figure 3.36).
3.7.3 Queue Management

The Queue Management (Figure 3.37) allows you to manage and visualize e-
mails that are in the e-mail server queue waiting to be delivered to their local or
remote recipient.
You can see the number of e-mails that are in the queue waiting to be delivered
to their local or remote recipient as well as the total number of e-mails in the queue.
The list presents the following fields:

3.7 E-Mail 51
Figure 3.33: E-Mail - Definitions 1/2
• ID: The only message identification added by IPBrick ;
• Date: E-mail sending date;
• From: E-mail sender;
• To: e-mail recipient;
• Subject: Message subject;
• Size: Message size displayed in Kbytes.
You can delete several e-mails at the same time by selecting the corresponding
checkboxes and clicking in the Delete Mails option. You have to confirm this
action in order to eliminate the chosen mails.
When selecting a mail you can see its complete source. This operation is done
in real time. Therefore is not necessary to Apply Configurations.
! Attention !: E-mails deleted in the queue are eliminated definitely. A email
can stand in queue for a default value of 7 days.
! Attention !: When a message in queue is deleted the qmail service is restarted.
3.7.4 Users management

This option provides a centralized management for each user email account of
the system and it’s possible to configure:
• State: The user email account can be enable or disabled;

52 IPBrick.I
Figure 3.34: E-Mail - Definitions 2/2
Figure 3.35: E-Mail - Definitions - Valid internal recipients
• Default mail: The user default mail address. It’s not mandatory to be equal
to login@domain;
• Alternative addresses;
• Mail quota;
• Message maximum size: Maximum size of a received message;

3.7 E-Mail 53
Figure 3.36: E-Mail - Definitions - Invalid senders
Figure 3.37: E-Mail - Queue Management
• Forward to;
• Automatic reply message.
Configuration example at Figure 3.39.
Alternative Addresses
Alternative addresses (Figure 3.39) allows you to on the one hand to have
practical logins which are easy to manage and on the other hand the confort in
using more personalized e-mail addresses. This way the user can have an e-mail
address with which he identifies himself more.
All mails that are sent to any defined alternative e-mail user address are deliv-
ered to the inbox respectively.
Example: name : John Smith

login : jsmith
email : jsmith@domain.com
Alternative Addresses:

54 IPBrick.I
Figure 3.38: E-mail - Users Management
john_smith@domain.com
john.smith@domain.com
john@domain.com
To Insert a new email address:
• Select the account (user);
• In the Alternative Addresses field: Set the alternative email address(es).
Whenever you want to you can access the e-mail address list (IPBrick user
e-mail address arranged in groups) and change the names or the user of an e-mail
address. Is it obvious that when you change the user of an alternative e-mail
address new mails will be delivered to the new user while the other alternative
addresses stay with the old user.
Mail Forward
Mail forward allows delivered mails to be sent to the user’s email and other
internal or external e-mail addresses.
To insert a new mail forward (Figure 3.39):
• In the Forward to field: Set the recipient email address(es).

3.7 E-Mail 55
Figure 3.39: E-Mail - Alternative addresses, Forwarding and automatic replys
Automatic reply message

A automatic reply message is an e-mail automatically sent by IPBrick to answer
other e-mails. When an e-mail arrives at mailaccount with auto reply configured,
IPBrick send a mail to sender with the personalized message.
In order to Insert a new auto reply you need to (Figure 3.39):
• Insert in the Automatic reply message text area, insert the content you
want. Ex: I’m not at office. Please contact my coleague John Smith.
3.7.5 Mailing Lists

A mailing list provides the feature of sending email from one to many.
To add a mailing list:
• Click on Insert;
• Write the address you want in the mail field (Figure 3.40);
• Click on Insert.
After you add a mailing list (Figure 3.41), you have to configure:

56 IPBrick.I
• Internal Users List: Set the IPBrick Users that will be part of the mailing
list;
• IPBrick Contacts address list: Set if any contact present at IPBrick

Contacts site will be part of the mailing list;
• External Users List: Set the email addresses that don’t belong to the
LAN (Figure 3.42).
In both cases you only have to click Modify to add members to the list.
Figure 3.40: E-Mail - Mailing List - Insert
Figure 3.41: E-Mail - Mailing List - Users

3.7 E-Mail 57
Figure 3.42: E-Mail - Mailing List - External users
3.7.6 Statistics
Like proxy and web service the Advanced Web Statistics is used for mail service
too. That generates important statistics for the network administrator like:
• Time statistics: Sended mail by month, week, days or even hours;
• Senders statistics: By top level domain, hosts, received mail and incoming
mail;
• Other information like SMTP errors;
3.7.7 Anti-Virus
Kaspersky
The Kaspersky Anti-Virus is already installed in the Email section. You only
have to acquire a license from Kaspersky to activate its management interface.
After inserting the license, the interface displays the following links (Figure 3.43):
• Update: After the license expiration, you need to renew with a new license
file;
• Delete: Removes the licence;
• Configure: Provides a general configuration of notifications;
• Groups Management: Provides personalization of Kaspersky Antivirus con-

figuration and filtering;
• Statistics: Interface with specific statistics about the Anti-Virus use.

58 IPBrick.I
Figure 3.43: E-Mail - Kaspersky Anti-Virus
General configurations
Click in Modify to configure email address of notifications (Figure 3.44).

General Settings:
• Notify from address: Sender will make the notifications;
• Notify to address: Email address that will receive notifications.
Limits:
• Do not send notification to: Address that won’t be able to receive no-
tifications (the notification sender).
Figure 3.44: E-Mail - Kasp. Anti-Virus - General Configurations
Groups Management
The group default is already created. If you click on the group, the default
general settings are displayed. If you click on Modify, you can personalize the
following options (Figure 3.45):

3.7 E-Mail 59
• Enable: Kaspersky Anti-Virus State;

• Group administrator address: Group administrator email;
• Quarantine path: The files in the quarantine state are stored in this direc-
tories;
• Sender mask: You may add this item if a new group is created;
• Recipient mask: You may add this item if a new group is created;
Figure 3.45: E-Mail - Kasp. Anti-Virus - Groups Management
The notification rules for any type of object can be changed in Notification Rules
menu, as you can see in Figure 3.46.
Figure 3.46: E-Mail - Kasp. Anti-Virus - Notification Rules
In the Filter menu (Figure 3.47), you may set the filter rules/exceptions by the
name of the files or by mime-type.
Statistics

60 IPBrick.I
Figure 3.47: E-Mail - Kasp. Anti-Virus - Filter
• Virus Statistics in period: Options of displaying the graphic in Virus

Statistics:
– View: Can be set in hours, days, months or years;
– Repetition: Scale of the graphic horizontal axis;
• Virus statistics: The display can be filtered by: Infected files, protected,
corrupted, errors and files where disinfection failed;
• Virus List: Can be organized by Virus name/Number of occurrences;
• List of email senders: Shows some statistics about files by sender ad-
dresses;
• List of email recipients: Shows some statistics about files by IPBrick
recipients addresses;
An example can be seen at Figure 3.48 and Figure 3.49.
ClamAV
ClamAV5 is included in IPBrick. By default the service is inactive (Figure
3.50), to activate it just hit Modify and choose Yes at Enable configuration.
When activated, ClamAV will filter all he incoming mail through its engine. When
ClamAV detects a virus one of these possibilities may occur, and you can configure
what to do (Figure 3.51):
• Reject E-Mail: The message is rejected and will not enter the mail queue.
The sender will receive a notification;
5
http://www.clamav.net

3.7 E-Mail 61
Figure 3.48: E-Mail - Kasp. Anti-Virus - Statistics 1/2
• Mark E-Mail as virus: The message is marked and enter the mail queue
normally;
• Mark and Redirect E-Mail: The message is marked and redirected to a

mail address;
• Delete E-Mail: The message is deleted, will not enter the mail queue and
no notification is sended.
Note: ClamAV will automatically update its database in a transparent way to

the user.
3.7.8 Anti-Spam
Kaspersky
Like Kaspersky Anti-Virus, Anti-Spam is already installed, you only need to
apply a license to activate this feature at the communications IPBrick. After the
activation, the following options are displayed:
• Update: After the license expiration, you need to renew with a new license
file;
• Delete: Removes the licence;

62 IPBrick.I
Figure 3.49: E-Mail - Kasp. Anti-Virus - Statistics 2/2
Figure 3.50: E-Mail - AntiVirus - ClamAV - Main menu
• Configure: Provides a general configuration of notifications;
• Statistics: Interface with specific statistics about the Anti-Spam use.
Figure 3.51: E-Mail - AntiVirus - ClamAV - Definitions

3.7 E-Mail 63
The most important Anti-Spam configuration features are:
• To add every email domains of the company that the Anti-Spam should filter
(Figure 3.52);
• To set Kaspersky Anti-Spam detection level. Standard is the default level.

If the spam reception rate is high, the level of detection should be increased
(Figure 3.54);
• To redirect all the emails classified by KaspersKy Anti-Spam to a email

account (At Figure 3.53: kaspersky@domain.com). This enables the network
administrator to analyze all the emails classified as Spam - if there is any
misclassified email, the administrator may forward this email to his recipient.
In a Intranet and a Communications IPBrick topology we can use a local
mailbox from the Communications IPBrick (ex: spam@com.domain.com),
because all the spam must stay at the com. server;
• Email and IP addresses Whitelists and Blacklists should be added - if there

is any (menu on Figure 3.52).
Figure 3.52: E-Mail - Kasp. Anti-Spam - Protected Domains
Statistics

64 IPBrick.I
Figure 3.53: E-Mail - Kasp. Anti-Spam - Actions
• Spam Statistics in period: Options to display present graphic in Spam

Statistics:

– Group: It enables you to group data, depending on the chosen view.
• Spam statistics: The display can be filtered by: Clean files, Spam, prob-
able and blacklists;
• List of email recipients: Shows some statistics about files by IPBrick

recipients addresses.
An example is present at Figure 3.55.
SpamAssassin
SpamAssassin6 is included in IPBrick. By default the service is inactive (Fig-
ure 3.56), to activate it just hit Modify and choose Yes at Enable configuration.
6
http://spamassassin.apache.org

3.7 E-Mail 65
Figure 3.54: E-Mail - Kasp. Anti-Spam - Rules
Note: SpamAssassin will keep its database automatically updated in a transpar-

ent way to the user.
The General Options are Figure 3.57:
• Required Score: For each message arriving, the SpamAssassin filter will
apply rules in order to know if it’s spam or not. The final value will be a
score number. In this field we are going to define the required general score.
The default is 10, so only mail messages that match ¿= 10 will be considered
SPAM;
• Action when it is detected SPAM:
– Reject E-Mail: The message is rejected and will not enter the mail
queue. The sender will receive a notification;
– Mark E-Mail as SPAM: The message is marked and enter the mail queue
normally;
– Mark and Redirect E-Mail: The message is marked and redirected to
the mail address spam@domain.com (Figure 3.58);
– Delete E-Mail: The message is deleted, will not enter the mail queue
and no notification is sended.
• Body Message Struct: Active for mark’s only. The original message can be
keeped or we can choose to send the original message in attachment, as .txt

66 IPBrick.I
Figure 3.55: E-Mail - Kasp. Anti-Spam - Statistics
or .eml. If it goes in attachment it’s possible to define a specific description

at Body Message Description.
After configuring the General Options, no further alterations are mandatory.
These following definitions, regarding specific score rules, are completely op-
tional.
To insert a score rule, we need to hit Insert. The following options are avail-
able:
• Rule name: Name that will identify the rule;

• E-Mail Field: Specific e-mail field to filter. Options:
– Body;
– From;
– Subject;
• Filter: Type of filter and what word or expression to filter. Options:
– Contains this word/phrase: It filters the choosed field containing
the word/phrase defined;
– Exactly match this word/phrase: It filters the choosed field when
exactly match the word/phrase defined;

3.7 E-Mail 67
• Score: Score number to attribute to the rule. Let’s imagine that Required Score
is set to default (10). A rule for example defined with score -1 will be a pass
result. A rule defined with score 20 will be considered SPAM. An example
is presented at Figure 3.59.
At top menu the options Whitelist and Blacklist are presented. At whitelist
we can define authorized domains and emails (example at Figure 3.60). Mail
comming from these origins have a score of -100. At blacklist we can define
forbidden domains and emails. Mail comming from these origins have a score of
100.
Figure 3.56: E-Mail - AntiSpam - SpamAssassin - Main Menu
Figure 3.57: E-Mail - AntiSpam - SpamAssassin - General Options - Reject
Figure 3.58: E-Mail - AntiSpam - SpamAssassin - General Options - Mark

68 IPBrick.I
Figure 3.59: E-Mail - AntiSpam - SpamAssassin - Created rules
Figure 3.60: E-Mail - AntiSpam - SpamAssassin - Whitelist
3.8 Print Server

This section deals with the interface management of printers intended to be
available in the network. When you define a printer you are asked to define that
fields (Figure3.61):
1. Name: Printer name;

3.8 Print Server 69
2. Description: Simple description about the printer. This field is not manda-
tory;
3. Location: Physical location in the company. This field is not mandatory;
4. Interface: Interface type used between the printer and the server. There
are 4 options:
• Parallel port;
• Serial port;
• USB port;
• Network printer: Connected to a LAN switch.
5. Device: Used by the printer. This is directly related to the interface. (This
option is only available for interfaces with parallel port, series port and USB
port) (e.g. Interface–>Parallel Port, Hardware ->Parallel Port 1)
6. In case of a network printer, the following information is necessary:
• Address: Network printer address. (this option is only available for

network printers) (e.g. 192.168.1.1)
• Port: The network printer’s port. This field is not obligatory. (This
option is only available for network printers) (e.g. for a HP printer:
9100)
Figure 3.61: Print Server - Inserting a network printer at IPBrick
After inserting a printer, IPBrick has to put the drivers available for the client
stations in order to finish the configuration. Therefore the printer drivers have to
be transferred to the server:
1. Log on in a Windows station with a user of the Administrators group (the

workstation has to be already registered in the IPBrick domain);
2. Press the keys [Win]+[R] at the same time and type \\ipbrick;

70 IPBrick.I
3. Select Printers and Faxes

Verify if the added printer to the IPBrick Web interface is shown.
4. Right click inside the window Printers and Faxes and select Server Properties;
5. Select the Drivers option in the presented window.
6. Choose ”Add”, set the manufacturer and the printer model and click Next;
7. Select the Windows version which the drivers have to correspond with.
8. Click Finish
Now the printer’s drivers are transferred to IPBrick.

9. At share named Printers and Faxes on IPBrick, right click at the printer
and choose Printer Properties. You’ll be prompted with a message like
the one in Figure3.62. Choose ”No”.
10. Enter in ”Advanced”, select the new driver just added and click ”Apply”.
Figure 3.62: Print Server - Printer configurations
To configure the printer on the client side, you must:
• Press the keys [Win]+[R] at the same time;

• Type \\ipbrick at the new window;
• Right click on the printer and choose ”Connect”.
Now the printer is listed at ”Printers and fax’s” on the client side.
3.9 Backup
Backup consists of copying data from one device to another so that these ad-
ditional copies may be used to restore the original after a data loss event. Usually
this is made from hard disk to tape, DVD or to another disk. Nowadays, paper
is being rapidly replaced by digital files, so organizations need to be aware of the
importance of having a reliable backup system.

3.9 Backup 71
3.9.1 Remote
This option enables the possibility of configuring scheduled backups to a NAS7
device or to a rsync server. Rsync is a powerful backup tool included in IPBrick,
that does incremental copies of files/directories to another rsync server.
To add a backup task you must click Insert (Figure 3.63). You will have the
following fields:
Backup definitions:
• Backup Name: It’s the backup’s name.
• Notification E-mail: Recipient that will receive all the backup notifications;
• Job to do: There are two options:
– Copy: It will copy all work areas to the backup device(/home1, /home2,
/home3...);
– Restore: It will restore all work areas from the backup device;
• Periodicity: The backup is always made daily;
• Time to start: Time when the ’Copy’ will start;
Figure 3.63: Backup - Task insertion
Destination Data Definitions:

• Data Location: The only option is remote. It will always be to a remote
machine.
• Backup Device
– NAS (SMB): The backup device is a NAS8 with a SMB share created.
7
Network Attached Storage
8
Network-attached Storage

72 IPBrick.I
The backup method is done using the archiving utility tar. Options
available:
∗ IP address: Backup device’s IP address;
∗ Login: Username that has access to the share;
∗ Password: Share password;
∗ Share Name: Name of the share created in the NAS.
– NAS (NFS): The backup device is a NAS9 with a NFS share created.
The backup method is done using the incremental backup utility rsync.
Options available:
∗ IP address: Backup device’s IP address:
∗ Share Name: Name of the share created in the NAS.
– Rsync Server: The backup device is a machine running a rsync server.
You can see an example of a rsync server configuration in the next
section;
∗ IP address: The rsync server’s IP address.
When a backup task is inserted, we have a Backups List with the following
options (Figure 3.64):
• Name: Clicking on the Backup Name you will have access to these options:
– Back: Go to backups list;

– Modify: Modify the current backup task definitions;
– Delete: Delete the current backup task;
• Start copy: Starts the backup immediately;
• Statistics: Backup statistics;
• LOG: Backup log messages.
Note: If using the NAS(SMB) backup, the restore option will restore all the
files included, but from the beggining. Note: If using NAS(NFS) or rsync server,
the remote filesystem should be the same that IPBrick is using (Ex: ext3);
Figure 3.64: Backup - Task list
9
Network-attached Storage

3.10 Terminal Server 73
Rsync server configuration

If the backup device is another IPBrick, the server must be prepared to act
as a rsync server. First let’s suppose that the client IPBrick machine has that
configurations:
• IP: 192.168.69.199;
• FQDN: ipbrick.domain.com;
At IPBrick rsync server we need to:
1. Create a group workarea (share) using the Workarea 1, with the FQDN as
the share name: ipbrick.domain.com;
2. Connect by SSH to the IPBrick server and type the following command in
order to put rsync allways running when the server reboots:
update-rc.d rsync defaults 20
3. Create the configuration file for rsync by typing: nano /etc/rsyncd.conf

4. Fill the following content:
uid = nobody
gid = nogroup
use chroot = yes
[ipbrick.domain.com]
path = /home1/_shares/ipbrick.domain.com
hosts allow = 192.168.69.199
read only = false
write only = false
5. Save the file and exit from the file editor nano;
6. Start rsync using this command: /etc/init.d/rsync start
Note: A complete network backup solution is also included at IPBrick, sup-
porting tape and disk backup. Link: http://www.bacula.org.
3.10 Terminal Server

IPBrick’s terminal server provides an Operating System to terminal stations
that have no disk (thin clients). Usually a thin client is a low-end computer
terminal which only provides a graphical user interface (GUI) to the end-user.
The operating system is loaded through the network and provided to the terminal,
that will have available, for example, a browser or the login console of a Windows
server. ⇒ Note: IPBrick must be working as a DHCP in the network (and has
to be the only DHCP server). The client of terminal server receives from IPBrick
the necessary information to boot from the network.

74 IPBrick.I
3.10.1 Configuration
First, you have to activate Terminal Server in IPBrick’s web interface. To
proceed with this operation go to IPBrick.I - Terminal Server. To activate,
click Modify and choose Yes;
After the activation, you may configure terminal server in this fields:
• Display [2 to 5]:
– Server Remote Desktop: The connection is made by the terminals to

IPBrick. IPBrick is responsible for the connection with the Windows
Server:
∗ Server: Address to connect by remote desktop;
∗ Domain: Indicate the Windows domain that is going to connect (ex:
iportal2003).
– Terminal Remote Desktop: The connection to the server is directly
made by the terminal:
∗ Server: IP Address of the server to connect by remote desktop;
∗ Domain: Indicate the Windows domain that is going to connect (ex:
iportal2003).
– Mozilla-Firefox: Open a Firefox browser session;
– Telnet Session:
∗ Server: IP Address of the telnet server. It is possible to connect to
other service by indicating a specific gate. Syntax: ip_address:port;
– Linux Remote Desktop: Remote connection to a Linux machine;
– Others: It presents a command line
• Keyboard model: It depends on the number of keys. These are the available
options:
– pc101;
– pc102;
– pc103;
– pc104;
– pc105.
• Keyboard layout:
– de: german;
– es: spanish;
– fr: french;
– pt: portuguese;
– us: english.

• Mouse protocol: Type of protocol used by the mouse in the client station;
• Mouse device: System Device that will be used (/dev/...);
• Mouse resolution: The Resolution mode used by the mouse;
• Mouse buttons: Number of mouse buttons;
• X Server: Specific commands to run the graphic environment. auto is the

default mode;
• Printer [0...1] type: Sets the printer type you want to use;
• Printer [0...1] device: Specific device for the printer (/dev/...);
• Local Device [0...2]: Other devices you want to use (/dev/...);
• Mode [0...2]: Possible image resolutions..
– 1768x1024;
– 1024x768;
– 800x600;
– 640x480;
• Module 01...02: Makes possible the loading of two Kernel modules.

You can see a first configuration example in Figure 3.65 and Figure 3.66
Boot and Operating System

If using thin clients, after the first terminal configuration here, IPBrick will
need a LTSP boot system and an operating system. The boot system (kernel) will
be loaded into the thin clients memory.
Boot Systems
To load Boot systems (Kernel) click on kernel link (Figure 3.67). The following
fields are displayed:
Boot system configuration:
• Description: Kernel text description;
• Boot loader: It will be selected later;
• Kernel: If you click Archive you should select the Kernel file from the above
link.
In the next step you have to choose the boot loader. If the thin clients support
PXE boot, choose the following boot loader /pxelinux.0 (Figure 3.68).
Operating Systems
To load the Operating System you have to click in top menu on OS (Figure
3.69), and after that click insert to display the following options:

76 IPBrick.I
Figure 3.65: Terminal Server - General Configuration - 1/2
• Description: Description of the operating system;
• Operating system: If you click Archive you should select the OS version
to run.
The Kernel and Operating System files should be downloaded at:

http://downloads.ipbrick.com/IPBrick/download/ltsp/
For IPBrick 5.0 you need to download the files:
debian_ltsp5_BOOT_final.tgz
debian_ltsp5_OS_final.tgz
For older versions of IPBrick you need the files root.tgz (OS) and 2.6.9-ltsp-3.tgz
(Boot system). A full configuration example to boot from a PXE thinclient can
be viewed at Figure 3.70.
Machines
If the terminals are registered in IPBrick (IPBrick.I - Machines Management)
you may personalize configurations for a terminal in the machines link (Figure
3.71) by selecting if the default options set in the top menu of configuration are
going to be used.

Figure 3.66: Terminal Server - General Configuration - 2/2
Figure 3.67: Terminal Server - Boot System configuration
After loading the boot system(s) and the operating system(s), you should click
Back and Terminal OS and choose the Kernel and the Operating System you want
to use.
3.10.2 Client configuration

You should boot from network to make available for the clients the Terminal
Server. For example if you use a Book PC, the machine should be booted and the
access to BIOS is made with the keys Shift + F10. The configuration should be
(it is possible to modify the values through the directional keys (<- and ->)):

78 IPBrick.I
Figure 3.68: Terminal Server - Boot Loader configuration
Figure 3.69: Terminal Server - Operating System
Network Boot Protocol : PXE

Boot Order : Int 19h
Show Config Message : Enable
Figure 3.70: Terminal Server - Configuration for PXE boot

Figure 3.71: Terminal Server - Machines
Show Message Time : 3 Seconds
After this configuration, an orange window appears with this message:
Always boot network first, the local devices.
After making these changes you have to confirm them by clicking the F4 key.
This procedure makes sure that the client machine will boot from the network.
After the client machine rebooting, this machine will boot through IPBrick.
Note: If the login screen of Linux graphic interface appears after the booting
, you have to restart X Server with the keys [CTRL] + [ALT] + [BACKSPACE].
If the same window appears even after the restart, it is possible to validate with
user ltsp and password ltsp.
Several screens may be active for the same client (depending on what was set
in the Number of Displays field of IPBrick). Browsing across screens can be made
with these key combinations: [CTRL] + [ALT] + [F2] for screen 1, [CTRL] +
[ALT] + [F3] for the screen 2, and so on.

80 IPBrick.I

Chapter 4
IPBrick.C
This chapter describes the IPBrick menus used to manage the main communi-
cation services between your organization and the Internet. The menu IPBrick.C
like the one in IPBrick.I is a menu of functional configuration. The IPBrick
Administrator ’says’ what he wants and the software makes the configurations
accordingly and maintains their consistence. This chapter is divided into the fol-
lowing sections:
• Firewall;
• Proxy;
• VPN;
• E-Mail;
• SMS;
• Web Server;
• FTP Server;
• Webmail;
• VoIP;
• IM.
4.1 Firewall
Note: Any rule change done to the firewall implies its reactivation. Even if
the firewall has been expressively stopped a change in one of its rules implies the
restart of the firewall.

82 IPBrick.C
4.1.1 Available Services

IPBrick firewall is controlled by a user-friendly interface that permits, based
upon a list of rules and other criteria, to deny unauthorized access while accepting
authorized communications. Traffic to or from any of the more common services
accessed via Internet, listed below, is supervised by the firewall and configured in
a simple way, by just activating or deactivating the service. For more in depth
changes please access the Advanced Configurations menu.
These are the services:
• Web Server;
• E-mail server;
• SSH;
• FTP.
The list, Firewall - Available Services (Figure 4.1), indicates the service status
- whether the firewall is configured to let that service work (Active) or it is con-
figured to block those service ports (Inactive).
Note that defining here a service as active doesn’t start the service or stops it.
The single change implemented in the Definitions Update only affects the firewall
service (first it stops, reconfigures and then restarts). In other words, here you can
only configure the firewall to open or to shut the Internet port for a defined service
(whether the service is working is another configuration besides this section).
Figure 4.1: Firewall - Available Services

4.2 Proxy 83
4.1.2 Block Services

Like the situation mentioned before, the option to block services only Enable
(unlocked) or Disable (locked) the normal operation of MSN, ICQ and mIRC
services, so LAN users can have or not Internet access to that services (Figure
4.2). For MSN Messenger it’s possible to make exceptions for some specific IP’s
or subnets. In example at Figure 4.3 the machine 192.168.1.150 and machines
from 192.168.1.96 to 192.168.1.110 will have MSN access.
Figure 4.2: Firewall - Block Services
Figure 4.3: Firewall - MSN Exceptions
4.2 Proxy
The proxy service acts as an intermediary for requests from clients seeking re-
sources in other servers. A client connects to the proxy, requesting a file, a web
page or any other resource. A Proxy is commonly used as way to achieve a better
network management; it caches web pages, providing a better bandwidth manage-
ment and enforces an access policy to network services or content, e.g. to block
undesired sites. the possibility to customize web access, etc.
The software that implements the IPBrick proxy service is named squid and
runs on gate 3128.
The section is subdivided into three parts, namely:
• Configuration;

84 IPBrick.C
• Statistics;
• Kaspersky Proxy.
4.2.1 Configuration
The presented main proxy configuration (Figure 4.4) determines the normal
operation of the Internet browsers. Therefore it is recommendable to define each
Proxy type first:
Figure 4.4: Proxy - Configuration
1. Standard Proxy: It is not obligatory to use the proxy to access the Internet.
The proxy is only used by those who configure the browser to use the proxy
from the IPBrick port 3128. Users without any additional browser configura-
tions continue to access the Internet without any problems.The web accesses
are registered by IP’s for statistical purposes.
2. Transparent Proxy: Every Internet access is done through the proxy. The
firewall has to be activated. Users may configure their browsers to use the
indicated proxy. They may also continue to access the Internet without any
proxy configurations in their browsers. Here the firewall makes the traffic
routing to the proxy. The web accesses are registered by IP’s for statistical
aims.
3. Proxy with authentication: Internet access is only possible by using this

proxy. In order to have access to the web, users have to configure their
browser with this proxy. Once the browsers are configured, a valid authenti-
cation is asked whenever a user opens the browser. The user authentication
is done by login and password. The firewall has to be activated. All web
accesses are registered for each user purely for statistical purposes (NOTE:
You have to select this option, if you want to create access permissions by
using LDAP users and groups).
Configurations
Link to the proxy rules settings. This interface (Figure 4.5) has the following
options:

4.2 Proxy 85
• Source groups list: Sets an origin group with access to proxy. After this
group creation, the accesses can be set by: Machine group, Machine, IP
Subnets, IP Machines and IP ranges.By default IPBrick has a LAN group
with its own defined IP Subnet.
• Destination groups list: Sets destination groups (Web servers). You

can set Domains, Extensions or Words in the URL each created destination
group. By default the created group is named INVALID;
• Blacklists: Displays the set of blacklists that were configured at Other

configurations;
• List of time spaces: Sets specific periods based on hours and week days;
• Access Lists: Sets access permissions from the created origin and desti-
nation groups, as well as defined blacklists and periods. For instance, you
can set that all destinations can be accessed by the LAN group, with the
exception of INVALID destination group and blacklist porn, in an undefined
period (always).
Figure 4.5: Proxy - Rules 1/2
Source groups list

To modify the LAN group you just have to click on the name. You can insert
a new origin group clicking on Insert link. Settings:

86 IPBrick.C
Figure 4.6: Proxy - Rules 2/2
• Machine groups: You can associate to this group an existing machine group;
• Machines: Lists the machines that are registered in IPBrick and provides
direct association to the origin group;
• IP subnets: Provides subnets association, defining the network IP and its

mask;
• IP machines: Provides machine association to the group by IP;
• IP ranges: You can set IP ranges with proxy access.
By default the proxy has a source group called LAN where only the IP Subnet
is used (Figure 4.7).
If you choose the proxy with authentication mode, it’s possible to filter the
web access’s not only by the machines IP but also using LDAP. In Figure 4.8 we
can see an example of a source group represented only by a LDAP group.
Destination groups
Destination groups (Figure 4.9) are groups of web content (e.g. domains, file
extensions, etc.) that will be defined to be blocked or allowed. This destinations
are configurable by:

4.2 Proxy 87
Figure 4.7: Proxy - Source groups
Figure 4.8: Proxy - Source groups - LDAP filter
• Domains: You may configure FQDN1 access, by domain or by TLD2 acces-

sadding a record to each line. Some possible denial examples:
FQDN example:
www.sapo.pt
www.marca.es
1
2
Top Level Domains

88 IPBrick.C
Domain example:
sapo.pt
marca.es
TLD example:
pt
es
• Extensions: In order to prevent certain files download through web pages you
need to deny access to some file extensions. The following example shows
that the download of three file extensions won’t be possible.
Example of extensions denial:

mp3
mov
mpg
• Words in URL: You can deny in this field the access to pages that contain
certain words after the domain (after the slash). An example for two words:
Denial example for word in the URL:

video
jokes
The following sites would be denied:

http://www.mtv.com/music/video/
http://en.wikipedia.org/wiki/Video
http://kids.yahoo.com/jokes
List of time spaces

This option lets you specify periods to be used afterwards in Access Lists. This
periods could be week days or hours.
Access Lists
There’s already a pre-configured access list in IPBrick specifying this: Attempts
to access sites made from LAN’s origin which aim sites not included in the desti-
nation group INVALID nor the porn blacklist, in an undefined period (24 hours)
are accepted. Because there are no more lines created, all the remaining will be
blocked (Figure 4.10).
Access lists have the following structure:
• Source: Identification of the origin group that is governed by the rule (i.e.:
a group of users or a list of machines by IP);

4.2 Proxy 89
Figure 4.9: Proxy - Destination groups
• Destination: Identification of the Destination Groups that are governed by

the rule (i.e.: name of the configured group of sites, domains, file extensions
and words in an URL);
– Available Groups: For the created destination groups you can enforce
a certain set of rules:
∗ ONLY ON - Access is granted exclusively to the contents included
in a given destination group, access to any other web content is
denied;
∗ NOT IN - Access is denied to that designated destination group;
∗ ALLOW IN - This is used in special cases, for example, you can
authorize an exception to a blacklisted word that you may find in
a site or any other content that has no innapropriate content, (e.g.
The site www.testdomain.com is in a blacklist named ”gambling”,
this blacklist is active. Even so, you can create an exception to
that blacklist by creating a destination group called, for example,
”BLBYPASS” and typing in Domains the URL, www.testdomain.com);
– Blacklists: Lets you select which blacklists are going to be activated
(e.g: If the porn list is selected, all sites that are out of the porn list
can be accessed).
• Period: The time period (already inserted) that the rule is active;
• Policy: This is not configurable, the value is always to deny all that is not
set in the access lists.
Access lists should be ordered by rules from generic to specific. The generic
rules should be placed at the top and more specific rules should be placed at the

90 IPBrick.C
bottom (as in the firewall case). If there are several access lists you can order them
clicking on Order by.
Figure 4.10: Proxy - Access Lists
Remote Proxy
In this option you can indicate a list of remote proxy servers. These servers
should provide web access because they usually have a huge cache, increasing the
speed of web access (Figure 4.11).
• List of remote proxy servers: You can use several web proxy’s and after
that order that list;
• Dont use remote proxy for the following sites: If you don’t want to
use remote proxy for certain sites, you must indicate them here.
Figure 4.11: Proxy - Remote Proxy

4.2 Proxy 91
Other configurations
Redirect page in case of denied access
If the access for some site is blocked, the user can be automatically redirected
to the web site configured at URL address;
Blacklists
In this context, blacklists are set as site lists organized by several categories
that are considered inconvenient. You can find here the following options (Figure
4.12):
• Url for update: That URL provides a default blacklist base file that is au-
tomatically decompressed by IPBrick. Each category will have a list of sites
that is automaticaly updated, but it’s possible to do a update clicking at
Update. The proxy service can use other blacklist bases, some with other cat-
egories. Some blacklists can be found here: http://www.squidguard.org/blacklists.html.
• Current file MD5SUM: MD5 Hash of the file if it’s calculated. It lets you
check file integrity;
• Available categories: Categories list present in that compilation (usually

they are considered unsuited to LAN use)
– ads: List of advertisement sites;

– aggressive: List of violent content sites;
– audio-video: List of music and video content sites;
– drugs: List of drug related content sites;
– gambling: List of gambling sites;
– hacking: List of hacking sites;
– mail: List of sites that provide free webmail services;
– phishing: List of sites about phishing;
– porn: List of sites with pornographic content;
– proxy: List of sites that provide anonymous proxy service;
– warez: List of sites with pirate software content.
Content access management

Sets the number of simultaneous filtering processes that depends on the ma-
chine performance and the present CPU load. The default is five processes.
Proxy cache options
• Cache enabled: Activates the Proxy cache service. If the cache is activated,
every page accessed by the origin groups are stored in the server. Example:
If the page www.google.com is in the cache, the browser will only access to
IPBrick, instead of accessing the google web server, providing a better band
width management.

92 IPBrick.C
• Cache size: Maximum cache size. If the limit is reached, the older cache
files are removed.
• Cache location: The default is the /var partition. If you choose a big
cache size it’s a good option to choose the /home1 or /home2 partition.
Allowed connections
This list presents all the ports that are accepted by proxy. So all traffic com-
ming from LAN machines with destination ports in Internet listed here will match
proxy defined ACL’s. It’s possible to configure witch ports are accepted or not by
proxy with Remove and Add option.
Ignore rules for the following destinations
In this section we can define whitelists for any destinations, including domains
and networks. So for that destinations no proxy ACL’s will be matched.
All this settings can be viewed at Figure 4.12 and Figure 4.13.
Figure 4.12: Proxy - Other configurations 1/2
4.2.2 Statistics
Advanced Web Statistics is the software that generates several important statis-
tics for the network administrator, like detailed cache statistics, accesses (Figure
4.14).
There are different statistics types:
• Global statistics: Global network statistics;

4.2 Proxy 93
Figure 4.13: Proxy - Other configurations 1/2
• Statistics by machine: You have to select the machine you want from a
list of LAN machines. The purpose is to give individual statistics for each
machine;
• User statistics: If proxy configuration has authentication, it’s displayed

here a user list. You have to select the user from this list to have their
individual statistics.
Figure 4.14: Proxy - Statistics

94 IPBrick.C
4.2.3 Kaspersky Proxy

In this section you may activate Kasperky license for the proxy. With this
procedure all the web accesses made from the browser are filtered by the Anti-Virus
that is running on the proxy to provide an effective protection against Trojans,
Spyware, Dialers, etc.
After inserting the license, the interface displays the following links (Figure
4.15):
• Update: After the license expiration you should renew with a new license
file;
• Delete: Removes the license;
• Configure: It provides you a general Anti-Virus configuration option;
• Statistics: Interface with specific statistics about proxy Anti-Virus.
Figure 4.15: Proxy - Kaspersky - Licence
Configure
General settings:
• Notify from the address: Sender that will make the notifications;
• Notify to the address: Email address that will receive notifications.

Object settings:
• Objects to analyse:
– Compressed files;
– Archives;
– Mail databases;
– Plain mail format.

4.2 Proxy 95
Scan settings:
• Cure: If activated, detected virus will be automatically removed;
• Use heuristic: If activated, virus can be detected through the analysis of

the code with characteristics and behavior similar to a virus.
To modify that configurations (Figure 4.16) you need to click Modify.
Figure 4.16: Proxy - Kaspersky - General Settings
Statistics
• Virus Statistics in period: Options to display present graphic in Virus

Statistics:

• Vı́rus statistics: The display can be filtered by: Infected files or pro-
tected;
• Virus list: Can be organized by Virus name/Number of occurrences.
An example can be viewed at Figure 4.17

96 IPBrick.C
Figure 4.17: Proxy - Kaspersky - Statistics
4.3 VPN
VPN3 is a way of extending any network by providing a remote access (usually
via Internet) to a network’s resources.
4.3.1 PPTP
A PPTP4 VPN type works by providing a PPP session with the recipient
through the tunneling GRE protocol. It needs another network connection to
start and manage PPP session that runs on port 1723 TCP. In IPBrick’s case, you
have to indicate who are the users that access VPN-PPTP connections, as well as
the address range that will be used by clients.
Configurations
The link configurations gives you access to a form where you define the range
of IP addresses chosen for VPN connections. Remote clients will get an IP in this
3
Virtual Private Networks
4
Point-to-Point Tunneling Protocol

4.3 VPN 97
Figure 4.18: VPN - PPTP - Users
group when they make an IPBrick connection. It is as if they were connected to

the network server with an IP from this range. The user list shown on the left
side in Figure 4.18 presents the selected VPN users. On the right side you find
the users registered in IPBrick.
Access log
The access log option permits the visualization of all PPTP accesses. It’s
possible to filter by:
• IP;
• User;
• Notes:
– Connected;
– Disconnected;
– Wrong password;
– Illegal user;
– Locked;
– Timeout.
• Date;
Options available:
• Clean filters: Will clean all the chosen filters;
• Export PDF: Exports all the information to a .pdf;
• Back: Go back to the top menu;

98 IPBrick.C
4.3.2 SSL
A VPN-SSL uses the SSL encryption protocol to insure data privacy and in-
tegrity between the two parts because the protocol provides data encryption and
authentication. SSL is based on TCP protocol and uses the Public key cryptogra-
phy concept (introduced by Diffie-Hellman in the 1970 decade).
This concept specifies that each part has a Private Key and a Public Key that can
be distributed by people that want to have encrypted communication. Encrypted
data with the Public Key are only decrypted by the corresponding Private Key.
Encrypted data with the Private Key are only decrypted by the corresponding
Public Key.
After clicking on SSL, the list of VPN SSL servers is shown. To configure the
tunnel you must click on it (Figure 4.19).
Figure 4.19: VPN - SSL Settings
Definitions In this section you can configure the definitions of the VPN-SSL
network.
• Name/IP: Name or public IP address of the network;
• Port: The port of the VPN server. The default for SSL is 1194;
• Protocol: The transport protocol used in the communication. TCP is more

reliable buy will add an extra overhead;
• VPN Network: The IP network which will be given to the clients. When a
user connects to this vpn server, he will get an IP address in this IP network.
This network should be different from any other IP network in the company;
• Domain: The domain offered to the clients;
• DNS Servers: The DNS server passed to the clients;

4.3 VPN 99
• NetBios Servers: The netbios server passed to the clients;

• Routes for clients: Sets all the networks that client must have access
through the tunnel.
NOTE: If you want to use a VPN SSL and use the same email client with
the internal mail server configurations, you need to add the VPN Network to the
Relay networks definitions at email;
Certificates After Definitions configuration its necessary to create SSL digital

certificates. A digital certificate has the following informations:
• Identification of the titular entity;

• Public Key for the titular entity;
• Serial number Certificate;
• Valid date Certificate;
• Identification of the Certifying Authority (The Certificate issuing entity);
• Digital signature of the Certifying Authority.
It will be generated a Digital Certificate for the server and for each of the
clients using the VPN SSL connection. Clicking on Insert you start by the server
Certificate generation. You have to insert data in the following fields:
• Country Code;
• Country;
• City;
• Company;
• Nome: Certificate name;
• Email: Company’s email.
The next certificates shall be for the clients, and it is necessary to fill the
following fields (Figure 4.20):
• Name: Certificate name. Normally the single name of the person/entity that
will connect;
• E-Mail: Client e-mail address;
• Password: A password (PSK) with six characters minimum;
• Associated access policies: The specific client certificate can be associated
to a policy, so we can control for what LAN machines the client will have
access. If none, will got access to all the network routes defined.

100 IPBrick.C
Figure 4.20: VPN SSL - Client certificate configuration
Afterwards, it is necessary to download the certificate and send it to the cus-

tomer who shall establish the VPN connection. The .zip file contains:
• Server public key: ca-server-domain.crt;
• Client private key: certificate_name.key;
• Client public key: certificate_name.crt;
• VPN configuration: certificate_name.ovpn;
Client
In the client side you have to install the specific software to create the VPN
SSL connection- OpenVPN5 . Then you must uncompress the certificate file to a
new directory in
c:\Program Files\OpenVPN\config.
To start VPN connection you have to click on the OpenVPN icon located in the
tool bar with the right button, choose the connection you want and click Connect.
The option Delete All should only be used to restart the all process.
State
This interface shows you the active tunnels and their respective traffic, users
and IP
After configuring this service you have to activate it in section Advanced

Configurations System Services. The procedure to configure VPN client
is described in detail at Appendix B.
5
Software: openvpn.net — Windows GUI: openvpn.se

4.3 VPN 101
Access policies
At main menu of SSL it’s possible to create two types of access policies (Figure
4.21):
• Permission policies: Making a certificate association to a permission policy

will give permission only to the configured destinations;
• Restriction policies: Making a certificate association to a restriction policy

will give permission to all except the configured destinations;
After clicking Insert and choosing the name, clicking on it will open a win-
dow when it’s possible to choose the destinations (Figure 4.22). The destinations
options include:
• Machine groups;
• Machines;
• IP Subnets;
• IP Machines;
• IP Ranges.
Figure 4.21: VPN SSL - Access policies list
Access log
The access log option permits the visualization of all VPN-SSL accesses. It’s
• IP;
• User;
• Notes:

102 IPBrick.C
Figure 4.22: VPN SSL - Access policy configuration
– Connected;
– Terminated/Timeout;
– Blocked.
• Date;
Options available:
4.3.3 IPSec
IPSec (IP security) technology is a suite of protocols that ensure confidential-
ity, integrity, authenticity to data transmission on an IP network. SSL protocol
works at the transport layer level - IPSec operates at the network layer level and
consequently provides data encryption in this level.
VPN through PPTP or SSL provides a connection between a defined machine

and the network (road warrior type). On the contrary VPN IPSec allows two net-
works to communicate permanently and in a transparent way (LAN to LAN type).

4.3 VPN 103
This is accomplished with an IPSec configured between two IPBrick’s or between

an IPBrick and a router, providing full configuration transparency to users from
the two networks.
Example: 192.168.2.0 network that belongs to the Company X headquarters

in Oporto, Portugal and network 192.168.4.0 belongs to its office branch located
in Japan. Both networks should have Internet connection to make possible the
communication between their machines through a VPN IPSec tunnel. With this
feature two networks can behave as if they where one.
To configure a VPN connection between two networks you need to have the
appropriate configuration in origin and destination IPBrick’s for the IPSec tunnel.
The main menu presents the configured IPSec tunnels. To insert a new IPSec
tunnel click Insert. In that page we are going to configure the IPSec connection
(as you may see in Figure 4.23). The following data is necessary:
• General settings
– Name: VPN IPSec name;

– Description: Description of the IPSec connection;
– State: VPN IPSec state - enable or disable;
• Local Network Definitions
– Local IP: IPBrick external interface address (eth1);

– Local network: Local network address and respective IPBrick network
mask;
– Local Gateway: Router internal interface address;
– Local Identification: Identification field. Can be used the public
network IP or if the network dont’t have fixed public IP, a dynamic
DNS address;
– Server IP in local network: IPBrick internal interface address (eth0).
• Remote network definitions
– Remote IP: Remote public address;

– Remote network: Remote network address and mask;
– Remote Gateway: Remote network router internal interface address
(this field is not mandatory);
– Remote identifier: Remote identification field (this field is not manda-
tory);
• Keys Management

104 IPBrick.C
– Password: A Pre-Shared Key is a shared key that the VPN service

expects as a first credential (before username and password). In order
that the VPN server allows the authentication process to continue, it is
necessary to pass the correct PSK;
– Type: The IPSec supplies two operation methods specified in this field,
which are Tunnel (where the original IP pack is encrypted) and Trans-
port (the data (payload) are encrypted, but the original IP heading is
not changed);
– Authentication: IPSec adds two extra headers to the IP package -
AH and ESP. The AH (Authentication Header) insures integrity and
authenticity, but not confidentiality. ESP provides data integrity, au-
thenticity and confidentiality;
– PFS6 : Allows PFS protocol that adds additional security in the keys
exchange;
– Start: Only automatic is available.
Figure 4.23: VPN - IPSec Configuration 1/2
Router configuration
In case of a VPN IPSec not between two IPBrick’s but between a IPBrick and
a router, at the router side it’s important to know all parameters used by the
6
Perfect Forward Secrecy

4.3 VPN 105
Figure 4.24: VPN - IPSec Configuration 2/2
IPBrick that are transparent to the web interface. Here are the most important
ones:
• Negotiation key protocol: IDE;
• Negotiation mode: Normal;
• Fase 1 encryption Algorithm: 3DES;
• Fase 1 authentication Algorithm: MD5;
• Fase 2 encryption Algorithm: 3DES;
• Fase 2 authentication Algorithm: SHA1;
• Key Group: DH2;
⇒ Note: Before configuring a VPN connection, PPTP, IPSec or SSL, you

have to know what is the addressing system used by the local network where the
client connects and what is the destination’s network addressing system. If the
addressing systems in both networks are exactly the same, the VPN connection
will be not possible.

106 IPBrick.C
4.3.4 GRE
The GRE7 protocol was developped by Cisco to encapsulate a multi variety of
network layer protocols inside a specific IP tunnel. So the main idea was to create
a link between Cisco routers, so two networks can stay interconnected (company
headquarters and branchs for example). In these days the GRE protocol is Linux
supported, so with GRE active at IPBrick, it’s possible to create tunnels between
IPBricks or between IPBricks and Cisco routers.
To set up a new GRE tunnel click Insert. The following options are available:
• General settings
– Name: GRE tunnel name;

– Description: Description of the GRE connection;
– State: GRE state - enable or disable.
• Local Network Definitions

– Local IP: IPBrick external interface address (eth1);
– Server IP in local network: IPBrick internal interface address (eth0).
• Remote network definitions

– Remote IP: Remote IP address. Normally a public one because the
tunnel is being established by Internet;
– Remote subnet: Remote network address and mask;
A configuration example is shown at Figure 4.25

NOTE: When configuring a GRE tunnel between an IPBrick and a Cisco
router, the Server IP in local network may need to be the local IP address
of a GRE tunnel network, e.g.: GRE tunnel with specific network 10.0.0.0/24.
IPBrick will have IP 10.0.0.1 and Cisco IP 10.0.0.2.
4.4 E-mail
This E-mail section is repeated in both IPBrick.I and .C modules. IPBrick.I
provides Intranet services: Base Configuration, Queue Management, User Man-
agement, Distribution Lists and Kaspersky Anti-Virus and Anti-Spam. IPBrick.C
provides additional services:
• Advanced relay;
• Get Mail from ISP;
• Mail copy.
7
Generic Routing Encapsulation

4.4 E-mail 107
Figure 4.25: VPN - GRE Configuration
4.4.1 Advanced relay

The advanced relay option makes possible to forward emails based on non-
existent recipients and also to forward all the mail that comes to a domain. This
last feature is also known as catchall (Figure 4.26).
Relay definitions:
• Email/Domain
– Email: Insert a invalid recipient that doesn’t have any LDAP account
created and the desired internal domain;
– Domain: Choose for each domain you want to relay all the messages
(catchall option);
• Relay to: Destination email. Can be an internal or external destination;
Figure 4.26: E-Mail - Advanced relay

108 IPBrick.C
4.4.2 Get Mail from ISP

If company mails are not delivered to an internal firm server, being therefore
only available via POP8 , you can configure IPBrick in order to unload these mails
from the ISP9 periodically to a local server. Once they are in this local server the
mails are associated respectively to the previously configured accounts. In this
way you can configure a server for internal E-mails, even if you only have one, to
automate and centralize all firm e-mails (from the Internet and internal).
This feature normally called fetchmail is useful when the MX from the enter-
prise domain points to another server.
Figure 4.27: E-Mail - Get Mail from ISP - Base menu
Click Insert (Figure 4.27) to configure a external server that you want to
connect to download email and deliver it in the local server. You have to insert
data in the following fields:
• Server: Server identification. It could be FQDN and IP address;
• Protocol: Protocol that is used by the server - POP3 or IMAP;
• Remote domains: Domains that deliver email to the server. It is commonly

used in volume email boxes.
To access server definitions, you must click on its name (Figure 4.27):
• Modify: To change the account data;
• Delete: Deletes the selected account;
• Back: Goes back to email servers list.
To access the management interface of remote mailboxes, you must click insert
and fill in the following fields (Figure 4.29):
1. Mailbox type: Select individual mailbox or volume box. A volume mailbox

refers to boxes that are not assigned externally to any user, so all mail to all
users is delivered in just one public mailbox. In that fetchmail case, IPBrick
will get all mail and analyse the to field, delivering mail to the respective
local mailboxes;
8
Post Office Protocol: Used to access inboxes and transfer mails.
9
Internet Service Provider

4.4 E-mail 109
Figure 4.28: E-Mail - Get mail from ISP - Servers Management
2. Login: Used username to access the email remote box;
3. Password: Needed to validate login;
4. Retype password: Confirm the previous password;
5. Local server email: If the individual mailbox is chosen, this field is the
local email account where the downloaded emails will be delivered;
6. Drop ’Delivered-To’: If the email address in ISP is the same as the email
address in local server, this field must be active.
Figure 4.29: E-Mail - Get mail from ISP - Add Account
4.4.3 Mail Copy

This feature (Figure 4.30) aims to save all the incoming and outgoing email
messages in two accounts: sentmail and receivedmail.

110 IPBrick.C
Figure 4.30: E-Mail - Mail copy
Note: It is necessary to pay attention to the management of these Mail Copies,

especially in places with a lot of e-mail traffic. It is very important to control the
development of the occupied server hard drive space. These e-mail inboxes may
quickly reach the full size of the partition. By reaching this size they may cause
some trouble either with interferences with other server applications or to the ones
responsible for these e-mail inboxes that at a certain stage will loose a series of
mails because no copy could have been made.
When you activate this service (Yes) the mails are copied to the corresponding
account, that is:
1. Sent: YES, all mails that get through this SMTP server and whose sender
is from the server domain(s) will be copied to the Sent Mails local account;
2. Received: YES, all mails that get through this SMTP server and whose
sender is not from the server domain(s) will be copied to the Received Mails
local account.
When you activate the option (Yes) the system shows the Delete Automatically
the Copies field. This field allows defining whether the mail copies that are in
the server are to be deleted or not. The Delete Copies With More Than field
allows specifying the days after which mail copies are to be deleted in the server.
4.5 SMS
IPBrick provides now the SMS10 functionality to send SMS by using a specific
account at Ficom or Vipvoz. The idea is to send one or multiple SMS using an
email client and a special FQDN created for that. So the method can be called
Mail2SMS.
4.5.1 Configure
At Modify hitting Yes will enable the service configuration. At Mail2SMS
definitions we should define the specific domain to use for SMS sending. Normally
it’s used this FQDN: sms.domain.com, replacing the domain.com with the actual
IPBrick’s domain (Figure 4.31).
10
Short message service

4.5 SMS 111
Figure 4.31: SMS - Enable configuration
4.5.2 Routes Management

Clicking Insert will create a new route:
• Operator: Two operators are present:
– Ficom: The SMS will be sent using XML-RPC method. Contact iPor-
talMais (support@ipbrick.com) to create an account;
– VipVoz: The SMS will be sent to a VipVoz mail account using SSL.
Contact iPortalMais (support@ipbrick.com) to create an account;
• Route name: A name just for route identification;
• Email for notification reception: It’s the email account that will receive the
notifications with the send result (only for VipVoz);
• User: Username from the account already created;
• Password: Password from the account already created;
After the created route, we need to click at the route name to define a prefix
in order to use that specific route. That choosed prefix will be later part of the
number and will match only that route (Figure 4.32).
4.5.3 Statistics
Displays statistics about the sent and outgoing SMS.
Sent SMS
For sent SMS there are that fields:
• Id;
• Send date;
• Sender;

112 IPBrick.C
Figure 4.32: SMS - Routes management
• Destination;
• Order;
• Attempts;
• Route;
• Operator;
• State;
• File.
Outgoing SMS
For outgoing SMS that are pending, the following fields are present:
• Id;
• Sender;
• Destination;
• Order;
• Attempts;
• Route;
• Operator;
• State.

4.5 SMS 113
4.5.4 Sending a SMS

With everything configured at IPBrick, we can send a SMS(s) using a mail
client or webmail using the syntax:
<prefix + number>@<mail2sms domain>
E.g.: We are using the domain sms.domain.com and a VipVoz account acti-
vated with prefix 00. To send a SMS to the Portuguese mobile number 946666666
saying ’Hello, party at 23:00 - Bar XYZ’.
To: 00351946666666@sms.domain.com
Subject: Party
Body: Hello, party at 23:00 - Bar XYZ
Note that you can create a mailing list at IPBrick and insert all the mobile num-
bers you want. Example: Create a mailing list named smscostumers@domain.com
and insert at External users list some costumers mobile numbers:
00351222222222@sms.domain.com
...
So at the client side you just need to send a email to smscostumers@domain.com,
with the text you want.
CSV file
Another method to send SMS is to attach a CSV file created in a spreadsheet
program with the columns number and message splited by a ;.
E.g.:
number;message
003519191919191; Hello John
003519696969696; Merry christmas Mike
003519191919191; Meeting at 15:00.
00339696969696; Bonjour David.
00344233333333; Feliz navidad Juan.
To send it, we just need to create a new email message with the destination of
the specific mail account smslist@<mail2sms domain>.
E.g.:
To: smslist@sms.domain.com
Subject: SMS CSV List
Body:
Attach: sms_list.csv
If at the CSV file the message column is empty, the considered SMS text will
be the email message body (if present).

114 IPBrick.C
4.6 Web Server

A web server, through the HTTP11 and/or HTTPS protocols, is responsible
for answering user requests, concerning the web pages lodged in it, and each server
may lodge several sites. The IPBrick web server running in IPBrick is Apache 12 .
The base virtual hosts registered in IPBrick are displayed after clicking on Web
Server.
IPBrick hosts the following sites by default:
• calendar.domain.com: Intranet LDAP agenda. Always a useful tool, the

calendar can be used to save events and share them with others. By clicking
on Calendar at MyIPBrick, the user will be redirected to this site;
• callmanager.domain.com: Flash callmanager application for VoIP;
• callstatistics.domain.com: Specific site with VoIP call detailed statistics. It’s

the same menu present in IPBrick.GT - VoIP - Monitoring - Call Statistics,
but now it’s possible to give access to LDAP users;
• contacts.domain.com: Intranet LDAP contacts management; An in depth

look is provided at Appendix y;
• ipbrick.domain.com: IPBrick web management interface;
• jwchat.domain.com: A web-based Jabber (XMPP) client for the IPBrick

LDAP users;
• myipbrick.domain.com: A site for internal users. It’s possible to change

personal settings, check the personal area and go to other internal websites.
A detailed description is done at Appendix z;
• pgsqladmin.domain.com: PostgreSQL database web management;
• ucoip.domain.com: UCoIP (Unified Communications over IP) site for LDAP

users. It’s described in Appendix x;
• webmail.domain.com: Horde webmail client. By clicking on Webmail at

MyIPBrick, the user will be redirected to this site;;
• webphone.domain.com: It’s a IAX webphone example. The idea is to view

the page source code and include it in a real website. This webphone can
be configured to call directly any number you want or to match some direct
access for a VoIP funcionality (sequence, groups, IVR etc). To specify that,
the variable called url must be changed.
11
HyperText Transfer Protocol
12
For more information please visit http://www.apache.org

4.6 Web Server 115
4.6.1 Creating a new site

By clicking in Insert it’s possible to create a new site. A new form is displayed
(Figure 4.33) with the following fields:
Figure 4.33: Web Server - Adding sites
1. URL address: It’s the FQDN13 of the new site that will be hosted in the
server. It’s possible to use SSL too. Example: www.domain.com;
2. Alternative URL address: Alternative name(s) for the URL address that
was previously set. This field is not mandatory;
3. Site administrator email: E-Mail of the user that is responsible for the
site management;
4. FTP User: A new user login that will access to the site folder through FTP.
This should be the only login and shouldn’t be equal to another IPBrick
LDAP user. The site maintenance will be made through this protocol.
5. Password: Password of the FTP user.
6. Retype Password: Confirmation of Password.
7. Site folder location: Folder to be created in the server filesystem that

will be automatically created on /home1/_sites/. Usually it’s used the
name of the site;
13

116 IPBrick.C
8. Internet Availability: Choosing Yes we say that the virtualhost will be

created from this site to the IPBrick external IP - if this is the case the
created site will be available in the Internet;
9. Safe mode: If the site is php based, it deny’s the access of files outside the
site folder location, so it will interfer too with the global variables. It’s the
reason that the default mode is Disabled;
10. Access authorized only to the directories: By default the php have
access to the site folder location and to /tmp but it’s possible to add more
locations;
11. Character encoding: It’s the encoding that Apache will use for the website
depending of the content language;
12. Always keep the typed URL: Allows to keep always the requested URL;
If the created site is internet available, it is also necessary to create a DNS

record in the company’s external DNS server pointing to the company’s network
public IP (A or CNAME). If IPBrick have public IP at eth1, it will point directly
to that IP and not for the router IP.
4.6.2 Management
When the site is created if you click on it as we can see at Figure 4.34, you’ll
have these options to choose from:
• Back: Allows you to go back to the main webserver menu;
• Alias;
• Redirect;
• Reverse Proxy;
• Modify: Allows to modify the site fields;
• Delete: Remove the site from the web server. After clicking on Apply Con-
figurations the site is no longer available online. The files of the site are not
eliminated but moved to the share sites_bk1. This share is the file location
of the removed sites. When IPBrick removes these sites only the services
that are affected are reconfigured and the contents removed to an own share
accessible only to LDAP Administrators. It is like in the user accounts and
group shares;

4.6 Web Server 117
Figure 4.34: Web Server - Features
Alias
Alias or Host Header is a simple form of having access to certain contents that
are physically dislocated from the main directory of the site. Next, we’ll present
these two examples:
In Figure 4.35 we create a web alias for the folder /home1/_sites/www/site/img.
So, going to www.domain.com/es/img or www.domain.com/img will be the same.
HeartBeat linux
Figure 4.35: Web Server - Alias 1
Figure 4.36: Web Server - Alias 2

118 IPBrick.C
In Figure 4.36 we have a subsite called www.domain.com/forum that is present

in filesystem at /home1/_sites/www/site/forum.
You can manage each alias if you click on it (Figure 4.37).
Figure 4.37: Web Server - Alias List
Redirect
Redirect allows you to be redirected to a new URL when you type a first URL
in the browser. Some examples:
• In Figure 4.38’s example if someone tries to access www.domain.com/index.htm

and the index.htm file doesn’t exist, he will be automatically redirected to
www.domain.com
/index.htm;
• In Figure 4.39’s example if someone tries to access www.domain.com/index.html,

he will be automatically redirected to www.domain.com/web/index.htm. Please
note that in the source field you can insert only /index.html or www.domain.com/index.ht
which is the same.
Figure 4.38: Web Server - Redirect - Example 1
You can manage each redirection if you click on it (Figure 4.40).

4.6 Web Server 119
Figure 4.39: Web Server - Redirect - Example 2
Figure 4.40: Web Server - Redirections List
Reverse Proxy
The reverse proxy is used in front of the Webserver and has the main objective
of redirecting all connections addressed to various Webservers to be routed through
the proxy server. A reverse proxy has the function of dispatching incoming network
traffic to various servers and is totally transparent to the user (he will not know
that a proxy is being used).
• The first example stands for this situation: When someone enters the URL
http://estore.domainx.com they will be transfered to a internal site run-
ning in another server. So the first step is the site creation (Figure 4.41),
and after that the reverse proxy definition (Figure 4.42);
• In the second example the idea is for someone in the Internet that wants to ac-
cess a site running in a internal machine (http://192.168.1.4:85/cgi/site).
To do this we just need to add a new reverse proxy definition at the base
domain (Figure 4.43 and Figure 4.44);
Statistics
Each site in IPBrick uses Advanced Web Statistics to display many statistics
about the site accesses, the same software used for proxy statistics. To access the
statistics just go to IPBrick.C - Web Server, click in the desired site and after

120 IPBrick.C
Figure 4.41: Web Server - Reverse Proxy - Example 1 - Empty site created
Figure 4.42: Web Server - Reverse Proxy - Example 1 - Add
that go to statistics.
You can get some useful information like you can at left side of Figure 4.45.
4.7 Webmail
The Webmail installed in IPBrick is Horde and can be configured to deal with
other e-mail servers that are not IPBrick. Therefore you only have to specify in
this section which IMAP14 and SMTP15 servers will be used (Figure 4.46).
14
Internet Message Access Protocol
15
Simple Mail Transfer Protocol

4.8 FTP Server 121
Figure 4.43: Web Server - Reverse Proxy - Example 2 - Add
Figure 4.44: Web Server - Reverse Proxy - Example 2 - List
To change the servers click Modify. The servers may be identified by their
FQDN16 or their IP address.
If we got a Intranet IPBrick (or another intranet mail server) and a Commu-
nications IPBrick, you need to point the IMAP and SMTP to the internal mail
server address. To use the IPBrick webmail at Internet you just need to:
• Register a A record or CNAME called webmail at the public DNS server of

the company domain, pointing to the IPBrick public IP;
• If the IPBrick doesn’t have a public IP at eth1, configure a DNAT rule in

router to the port 443 and eth1 IPBrick IP.
4.8 FTP Server

In FTP Server it’s possible to manage single FTP accounts. The accounts can
be associated to simple Unix system users or to IPBrick websites.
Clicking on Insert will present this fields (Figure 4.47):
• Login: FTP account login;
• Password: FTP account password;

16

122 IPBrick.C
Figure 4.45: Web Server - Statistics
Figure 4.46: WebMail - Servers
• Retype Password;
• Account location: It’s possible to choose a individual FTP work area or

associate the account to a virtualhost;
• Create folder account: Create a new folder account at /home1/_ftp or

/home2/_ftp. Choosing No, no folder will be created. This options is useful
when we want to create a FTP login to the same account but with different
permissions;
• Access permissions: Can have only read permission or read and write
permissions.

4.9 VoIP 123
Figure 4.47: FTP Server - Account definitions
4.8.1 Access log

The access log option permits the visualization of all FTP accesses. It’s possible
to filter them by:
• IP;
• User;
• Notes:
– Connected;
– Disconnected;
– Wrong password;
– Illegal user;
– Timeout/Locked.
• Date;
Options available:
4.9 VoIP
This section deals with the management interface of the VoIP17 service available
in IPBrick.
17
Voice over IP

124 IPBrick.C
The VoIP (Voice Over IP) technology allows phone calls through an IP network,
thus enabling phone calls through the Internet. The main advantages for the use
of VoIP are: reduction of expenses because the rates don’t follow the conventional
telephony model; better service quality, since commutation by packs does a better
use of the existing network resources, different from the circuit commutation.
The IP Telephony concept sometimes mixes up with VoIP, but they are not
exactly the same thing. The IP Telephony uses VoIP service and defines itself
as the group of services and applications that allow companies to reduce phone
expenditures.
Signalling VoIP service needs a protocol to signal the calls. The signalling
protocol used by IPBrick is SIP, but there are others such as H.323, MGCP,
Jingle, IAX, H.248/MEGACO etc. SIP18 allows calls and conferences through IP,
and those calls may include audio, video, images, etc. This way, the SIP protocol
is responsible for all the processed calls between users, regardless the content of the
call itself. The IPBrick.GT acts as an authentic PBX IP and it can route the calls
to/from a traditional PBX, Internet, LAN and PSTN. All the PBX management is
made by a software called Asterisk. Asterisk is compatible with several signalling
protocols, including SIP. The routing work is made by another software that is
acting as SIP proxy - OpenSER.
The VoIP functionalities accessible through the web interface are presented
next.
4.9.1 Phone management

This menu (Figure 4.48) allows you to get the list of registered IPBrick VoIP
clients (IP telephones, workstations + softphone) that where registered from the
IPBrick.I - Machines Management and to manage some configurations. By
clicking on a phone name it’s possible to modify the following fields:
• Phone: Phone username;
• Password: Phone password that can be changed;
• Alternative Phone Addresses: In that field we can have alternative ad-

dresses to the phone. An alternative address is another name (or number)
to reach the telephone. This functionality is very useful when there are
telephones from which you can only dial numbers. It’s a good policy to reg-
ister phones by names and after that define a numeric alternative address
(example at Figure 4.49)
• Caller ID: If you want to mask the caller ID insert the full number;
• Phone Location
18
Session Initiation Protocol

4.9 VoIP 125
– Local: It’s the default, for a LAN phone;

– Remote: For a remote phone that is connected behind a NAT. Usually
this option is used when the idea is register the phone from the Internet,
using the IPBrick network public IP.
• Auto provisioning: The auto provisioning option permits the automatic
configuration of SIP hardphones, so here we just need to choose the phone
model. To work, it’s mandatory when registering the phone at Machines
Management, to insert the MAC address.
• Description: This field should have a text description about the phone;
Figure 4.48: VoIP - Phones management
Figure 4.49: VoIP - Adding alternative addresses
Not that it’s also possible to register phones in:

Advanced Configurations - Telephony - Registered Phones
This option is only valid, if it isn’t necessary to attribute a specific IP address
to the phone’s, DNS, DHCP and LDAP record. It is possible to add a phone just
by filling the field relating to the name and the access password.

126 IPBrick.C
4.9.2 Users Management

This option provides a VoIP centralized management for each LDAP user.
User VoIP settings

The main screen presents the users list with SIP address and associated phone
address if any (Figure 4.50). When clicking on a user name (Figure 4.51), we can
manage:
• SIP address: It’s the default user email and can’t be changed here;
• Alternative addresses: It’s possible to define multiple SIP addresses for a
user. Persons can call user using the default SIP address or the alternatives;
• User PIN: Defines the user PIN and must be numeric. This PIN can be used
for multi functions: Phone locking, access classes, voicemail and call queues.
User can’t change PIN;
• Password: Defines a password and must be numeric. The password can be
used for phone locking, access classes, voicemail and call queues. A user can
change the password too from the myipbrick site;
• User access validation: For authentication it can be used only PIN or PIN and
password. When the authentication process begins for some funcionality, the
user will listen one Asterisk message to enter the User ID (PIN) and another
one to enter the Password.
• Phone Address: This is a important field. Here we can associate users to a
specific internal phone or external. So when someone in the LAN or Internet
make a call to the user SIP address, it will ring the phone that is defined here.
Off course it will work if interal/public DNS zone is properly configured. A
user can change the phone address at myipbrick site.
– Internal: The user will be associated to an internal SIP phone registered
in IPBrick;
– External: The user will be associated to other phone. Can be a external
SIP account, PSTN number, PBX extension, mobile number etc. When
somebody in Internet or from the user UCoIP site make a call, if IPBrick
have routes to make the call it will call the external number specified
here.
User Access Class

• Access class: A user can be part of an access class, not just phones. A user
access class should be less restricted than a phone’s access class;
• Unlock mode: The unlock mode by default is done using always the PIN or
PIN and password and the desired number to dial. The second mode uses
authentication only at the first time (Figure 4.52);

4.9 VoIP 127
Figure 4.50: VoIP - Users Management
Figure 4.51: VoIP - Users Management - User VoIP settings
E.g.: For a user with PIN 111 and password 1234 that need to call 003512255443322:
111#003512255443322 or 111#1234#003512255443322
Call queues
If some call queues are configured, a user can be associated as an agent (Figure
4.52). The waiting mode can be as:
• Music on hold: The phone will be immediately part of the call queue. The
user will listen to music until a call is received;
• Callback: Only if the agent receives a call from the call queue, the phone
will ring;

128 IPBrick.C
Figure 4.52: VoIP - Users Management - Access classes and call queues
4.9.3 Functions
This section allows you to configure all the IP PBX functionalities splitted into
inbound and outbound services.
Inbound
Call Groups
In this interface (Figure 4.53) it’s possible to define answering groups, (i.e., a
group of telephones which shall ring simultaneously when the access to the group
is made). To define a group it is necessary to fulfill:
• Name: Name for the group;
• Caller ID: Possibility to use a specific caller ID for this service;
• DID: If the IPBrick has a ISDN telephony card, the PSTN DID (Direct
Inward Dial) that will call this service need to be inserted;
– DID: If the IPBrick has a ISDN telephony card, the DID (Direct Inward
Dial) will be the direct PSTN number that will call this service;
– ANA: If the IPBrick has a analogic telephony card, will be the direct
PSTN number that will call this service;
– SIP: It’s the specific SIP address that will call this service;
• Group Members A user can be part of an access class if the configurations
are made correctly.

4.9 VoIP 129
– Internal: Internal SIP phones that belong to the group;

– External: External phones (SIP, PSTN number, etc) that belong to
the group.
Figure 4.53: VoIP - Call groups
Attendance seq.
In this section it is possible to define an answering sequence, or see/change/remove

the already defined sequences. To add a new sequence it is necessary to click In-
sert, define a name for the sequence, select if the voicemail is active or not and
in Direct Access add the addresses DID/SIP/ANA of the telephones by which the
sequence shall be activated.
If you intend to add a Direct Access for an extension defined in IPBrick, it

is possible to choose SIP and select the extension in the address. In Sequence is
possible to add the telephones which shall ring by the desired order and the time
in which each one of them plays till the next one.
To define a attendance seq. it is necessary to fill (Figure 4.54):
• Name: Name for the attendance seq;
• Caller ID: Possibility to use a specific caller ID for this service;
• Voicemail enabled: Enables the voicemail for the sequence;

130 IPBrick.C
• Direct access: List of numbers/addresses that will call this service. We

have tree options and it’s possible to use many direct accesses;
– DID: If the IPBrick has a ISDN telephony card, the PSTN DID (Direct
• Sequence positions
– Location Internal: Internal SIP phones that belong to the sequence;

– Location External: External phones (SIP, PSTN number etc) that
belong to the sequence;
– Timeout: Timeout in seconds, be default 25.
Figure 4.54: VoIP - Sequence definitions
A attendance sequences list can be viewed at Figure 4.55.

IVR Attendance
In this section it’s possible to define interactive answering menus (Figure 4.56).
You need to click Insert to add a new one:
• Name: Choose a name for IVR;

4.9 VoIP 131
Figure 4.55: VoIP - Attendance sequences list

have three options and it’s possible to use many direct accesses’;
• Number of desired shortcuts: Choose how many options does the menu
have;
• Shortcuts: What type of destiny to give (according to the pressed key):
– Phone: To call an internal telephone;

– IVR: To go to an interactive answering sub-menu;
– Conference: To connect to a conference;
– Scheduler: To connect to a scheduler;
– Group: To ring the telephones of a group;
– Sequence: To activate an answering sequence;
– SIP address: To call a SIP telephone;
– DISA: It allows someone outside the central to connect as if he/she is
directly connected to the central;
– Call queue: To make the call enter a waiting line;
• Attendance message: It allows the selection of an answering message. It

can be a .mp3 or .wav file;
• Number of message repetitions: Number of times the attendance mes-

sage is replayed;
• Redirect automatically when no option has been dialed: As Yes if

no DTMF pressed it can redirect the call directly to:

132 IPBrick.C
– Phone: To call to an internal telephone;

Figure 4.56: VoIP - IVR attendance configuration
An IVR can have only an attendance message without any shortcut or direct
access, e,g.: A message just saying that the company is closed, so that IVR can
be used at the scheduling, for example (Figure 4.57).
Call Conference
In this interface (Figure 4.58) is possible to create conferences. To create a

simple static conference just click Insert:
• Name: The conference name;
• Numeric identifier: Numeric identifier for the conference. It’s only a

internal identifier for the VoIP server;
• PIN: Code which shall allow the users to connect to the conference;

4.9 VoIP 133
Figure 4.57: VoIP - Simple IVR
• Administrator PIN: Conference code for the administrator;

have tree options and it’s possible to use many direct access’s;
– SIP: It’s the specific SIP address that will call this service.
Figure 4.58: VoIP - Call conference insertion
It is also possible to allow the creation of dynamic conferences. For that, it is

necessary to click Dynamic Conferences (Figure 4.59), modify the option Active
to Yes and insert the address(es) and/or number(s) for the Direct Accesses (Fig-
ure 4.60). At dynamic conferences, when someone calls to the direct access it’s
possible to enter automatically an existant conference or to create a new one.
Call Parking

134 IPBrick.C
Figure 4.59: VoIP - Call conference list
Figure 4.60: VoIP - Dynamic call conferences
Here (Figure 4.61) it’s possible to activate or deactivate the option of calls on
hold.
If this option is activated, it is necessary to define an extension to place the
calls on hold, as well as the virtual extensions in which calls are going to be placed
(Figure 4.62). To access these calls later it’s necessary to press on the telephone
keypad the ”#” plus the virtual extension were the call was parked.
Scheduling
This option (Figure 4.63) allows you to define the daily behavior of the IP
PBX. Usually this is the most important inbound service because from here, we
are able to call all the other configured services.
Figure 4.61: VoIP - Call Parking

4.9 VoIP 135
Figure 4.62: VoIP - Call Parking - Modify
Figure 4.63: VoIP - Scheduling
It is necessary to click option Insert (Figure 4.64) and configure the first
parameters:
• Name: The name for the scheduler;

have three options and it’s possible to use many direct accesses;
Next, it is necessary to add rules for this scheduler. For that:
• Click in the scheduler name;
• Click Insert;
• Choose the type of action to be executed;

136 IPBrick.C
• Choose the period to be executed.
Fields explanation:
• Destination type: Where shall the call be routed if the rule defined next
is equalled. Options:
– Phone: To call to a internal telephone;

• Destination: Telephone address or specific service name were the call shall
be routed;
• Hours: Beginning and end hour, from the timetable in which the rule shall
be valid (format hh:mm at each field);
• Weekdays: Weekdays in which the rule shall be valid. If not chosed it will
use all days;
• Month days: Days of the month in which rule shall be verified. If not chosed
it will use all;
• Months: Months in which the rule shall be valid. If not chosed it will use all
months;
NOTE: If you don’t select any hour or days of the week/month, hour or
months, the rule shall be valid respectively for all the day. A rule like this one is
called the default rule;
At Figure 4.65 we can see an example of a scheduling implementation. You

can see that the rule 4 is used from 19:01 to 08:59, because is the default time. It
will call a simple IVR with a voice message telling that nobody is at the company
to answer the phone.
DISA
DISA19 (Figure 4.66) is a service that allows that someone that is not directly
connected to IPBrick or the PBX central, to obtain an internal call sign and
19
Direct Inward System Access

4.9 VoIP 137
Figure 4.64: VoIP - Scheduling - Insert rules
Figure 4.65: VoIP - Scheduling - Rules list
execute calls as if he/she was directly connected to the internal network. The user
calls the access number to DISA and he/she should type a password followed by
the key ”#”. If the password is correct, the user shall hear the sign indicating that
he/she may dial the number. You can also enjoy this service without a password
if you want to. The fields necessary to configure a DISA are:
• Name: Name for DISA;

138 IPBrick.C
• PIN authentication: It allows the introduction of a password to enable the

dialling through DISA;
• Password: PIN password;
• Allowed caller ID’s: Callers identifiers list which may accede to this ser-
vice. Insert only one by line.
Figure 4.66: VoIP - DISA - Insert
Callback
Callback feature have the main objective to save costs on internacional calls.
It allows people to call to the IPBrick callback service, the IPBrick will hangup
the call and call back to that number that made the call. That callback usually
will be made using a VoIP operator SIP account, so with a low cost.
When inserting a callback, the options available are:
• Name: Name for the Callback;

• Callback type:

4.9 VoIP 139
1. Callback any number: No matter the number that made the call, the
call will be finished, will ring a defined internal phone and when someone
answer the phone will be made automatically a callback to the origin
number (Figure ??);
2. Callback authorized numbers. Hangup non authorized numbers: For
authorized origin numbers, the call will be finished, will ring a defined
internal phone and when someone answer the phone will be made auto-
matically a callback to the origin number. For unauthorized numbers,
the call will be just finished (Figure ??);
3. Callback authorized numbers. Redirect non authorized numbers:
For authorized origin numbers, the call will be finished, will ring a de-
fined internal phone and when someone answer the phone will be made
automatically a callback to the origin number. For unauthorized num-
bers, the call will be redirected to a internal phone (Figure ??).
• Originate Callback calls from: It’s the internal phone that will ring and
callback the origin number;
• Redirect non authorized numbers to: Internal phone where the calls will
be redirected. Used only for callback type 3;
• Callback timeout: Pause in seconds from the momment tha call is termined
and called back, so the person that makes the call can have time to hangup
the phone. The default is 5 seconds;
• Allowed caller id’s: Will be the authorized origin numbers list. Used for
callback type 2 and 3.
Figure 4.67: VoIP - Callback any number
Call queues
Here (Figure 4.70) it is possible to define waiting lines. When calling to the
telephone defined in Direct Access the caller shall be placed on hold if there is
another call to be answered. An answering message may be defined which shall be
heard when the call is on hold. It is also possible to choose messages by default in

140 IPBrick.C
Figure 4.68: VoIP - Callback authorized numbers or hangup
Figure 4.69: VoIP - Callback authorized numbers or redirect
Select queue information from the line which may inform the caller about his/her
position in the line and the time interval between those messages.
The settings where we hit insert are the following ones:

• Name: Name of queue;
• Queue weight: Queue’s priority.
• Maximum number of queued calls: Maximum number defined of calls on
hold. ’0’ defines an unlimited number;

4.9 VoIP 141
• Define maximum waiting time: It is possible to define the maximum wait-

ing time. For that it is necessary to click option Yes, select the maximum
time in seconds and the type of routing to do if the time is exceeded as well
as the final destiny;
• Phone attendance timeout: Period of time (seconds) at the end of which

the caller shall be put on hold if the call is not answered, even if there is no
one else on hold;
• Welcome message file: Select the message to be presented when someone

enters the waiting line;
• Select queue information message: Select some of these messages to in-

form about the position in the waiting line or the estimated waiting time.
Messages: ”You are now first in line”, ”There are”, ”calls waiting”, ”The
current estimated holdtime is”, ”minutes”, ”seconds”, ”Thank you for your
patience”, ”less than” ,”hold time” ,”All phones busy / wait for next”;
• Time interval between queue information messages: If some informa-

tive message is selected, is possible to select the time (seconds) between
messages;
• Attendance policy: How the waiting line answering telephones should an-
swer the calls:
– Ring all: All available telephones ring until one of them answers;
– Random: One of the available telephones rings by chance;
– Round Robin: Each telephone rings at the time;
– Round Robin with memory: Each telephone rings at the time, but it
remembers which was the last one to ring;
– Least recently called phone: Will ring the telephone that rung a
long time ago;
– Phone with fewest completed calls: Will ring the telephone with
less answered calls.
• Play message when call is answered: If Yes a message will be played

before the call is answered;
When a call queue is inserted there are the following options at the top: Back,
Modify, Delete and Members. So the next step is to define what IP phones or/and
LDAP users will be associated to the call queue. Clicking Members you will get a
list of phones and users, like shown at Figure 4.71.
Outbound
Access Classes

142 IPBrick.C
Figure 4.70: VoIP - Call queue definitions
Figure 4.71: VoIP - Call queue members
It is possible to define access rules for the existing telephones. For that it’s
necessary to click on the connection Insert and fulfil the following fields (Figure
4.72):
• Name: The access class name;
• Unlock code: Code to deactivate temporarily a access class;
• Prefixes: It allows to add to the authorized prefixes list the prefixes which
may be used in the telephones under the access rules. By default all the calls
are blocked except the Authorized prefixes;

4.9 VoIP 143
• Numbers: In Politics by default it is possible to block the traffic for any

number or let it pass by default (Block/Authorize, respectively) and then, if
there are some exceptions, it is possible to indicate an exception number by
line. You can use wildcards at the exceptions;
• Domains: In the same way it is possible to authorize or block the access to
certain numbers, it is also possible with VoIP domains at Internet.
To confirm and create a defined rule, click Insert. Now it is possible to add
the members under that rule, clicking the name of the rule and then Members
(Figure 4.73). To remove or add SIP phones to the access class you only have to
click the buttons or respectively.
Figure 4.72: VoIP - Access Classes - Insert
Figure 4.73: VoIP - Access Classes - Members
Speed Dial

144 IPBrick.C
The speed dial allows the association between an internal address and a tele-
phone external to the organization. That is to say, the users call an internal
number (or address) and this is associated to a telephone external to the organiza-
tion. Example: An external alternative address of the telephone 44@domain.com is
created for the destiny address john.smith@another-domain.com. This way, when-
ever you dial internally 44, the call shall be re-addressed to john.smith@another-
domain.com.
Choosing Speed Dial and clicking Insert we have two fields (Figure 4.74):
• Phone Address: Will be the external number or address to call;
• Speed Dial: The extension for speed dial.
If the IPBrick have routes, it’s possible to insert in speed dial field legacy PBX
extensions, GSM and PSTN numbers etc.
Figure 4.74: VoIP - Speed Dial
4.9.4 Monitoring
Online Phones
The VoIP clients who are actually active and ready to execute and receive calls
can be visualized here (Figure 4.75).
Figure 4.75: VoIP - Online phones

4.9 VoIP 145
The information made available about each telephone are:
• Phone: Name of the telephone and the respective user;
• Request location: It indicates the IP address of the telephone;
• Port: Port where the telephone is registered.
Call Statistics
Finished Calls
Detailed statistics about all the finished calls. At the main menu we have:
General statistics relating to the filter criteria:
• Call number: Total number of calls;
• Total call time;
• Maximum call time;
• Average call time;
• Total RTP packets: Total of RTP (voice/video) packets;
• Lost RTP packets:
• Average lag: Average packet delay;
• Maximum lag: Maximum packet delay;
• Average jitter20 ;
• Maximum jitter.
Clicking at Insert it is possible to filter the result of the list be specific fields:
• Source IP;
• Source address;
• Destination address;
• Used route: SIP routes and internal routes;
• Result: ANSWERED, NO ANSWER, BUSY, FAILED;
• Time periods.
20
Is the measure of the variability over time of the latency across a network

146 IPBrick.C
The option Export CSV will export all the list to a .csv file. At Access Management
we can manage the LDAP users that will have access to callstatistics website.
In the call list we have specific statistics relating to the filter criteria (Figure
4.76):
• #: Call identification;
• Source IP: Source IP phone address;
• Source Address: Name of origin telephone/number;
• Destination Address: Number or name of destination telephone;
• Route: Route used to make the call;
• Fallback: If it was a fallback route;
• Result: Result of the call (ANSWERED, NO ANSWER, BUSY or FAILED);
• Start: Call start time;
• Ring time: Time that the destination telephone rang;
• Duration: Call duration.
Clicking at one of this fields, it will order the calls by that field.
Figure 4.76: VoIP - Statistics filter
Current calls
In this menu we have statistics about the current calls, with that fields:
• Source;
• Destination;

4.9 VoIP 147
• Duration;
• State;
• Route.
Call Recording
It’s possible in IPBrick to enable the recording of all calls, placing the archived
records in the Document Management and Workflow System, iPortalDoc. Users
with higher privileges may listen to calls as they happen. Enabling configuration,
two other options will appear (Figure 4.77):
• Record format: MP3 or WAV;
• iPortalDoc URL: Specify the existant URL for the iPortalDoc. If no iPor-
talDoc is installed, it’s not possible to use this feature.
The next step is to define which SIP phones will have their calls recorded. This
can be defined at Advanced Configurations - Telephony - Registered Phones.
A new field called Call Recording is now present with the following options (Fig-
ure 4.78):
• None: The phone will not have its calls recorded;
• Incoming: Only the incoming calls will be recorded;
• Outgoing: Only the outoing calls will be recorded;
• All: All the calls will be recorded.
The high privileged iPortalDoc users can now listen to the calls at the workflow
calls;
Figure 4.77: VoIP - Call recording definitions

148 IPBrick.C
Figure 4.78: VoIP - Call recording - Phones configuration
Call Supervision
The call supervision permits to supervise some specific IP phones. The idea
is to guide the person that is answering a phone that is part of the supervisioned
phones. It’s a funcionallity that can be useful for technical support departments.
The first step to use call supervision is the feature activation. This is done at
Advanced Configurations - Telephony - Configurations - Call Supervision
(Figure 4.79).
When enabled, a supervision group should be created by clicking Insert. Two
fields are present:
• Name: A description for the supervision group. Example: technical support;

• Unlock code: A code for members authentication. Example: 444;
Figure 4.79: VoIP - Call Supervision Group
Clicking at the supervision group name, it’s possible to define:
• Call Supervision Group Members: To define what phones are able to lis-
ten/supervise calls (Figure 4.81);
• Supervisioned phones: To define what phones will be supervised (Figure
4.80);
After the configuration we can supervise a call by following that steps:
• Dial the prefix+supervised_phone from a phone that is member of super-

vision group;

4.9 VoIP 149
Figure 4.80: VoIP - Call Supervision - Supervisioned phones
Figure 4.81: VoIP - Call Supervision Group members
• Insert the unlock code and press # when asked;
• After that a beep will be listened and the supervision will start, so the call
will be listened and you can talk only to the person that is at the supervised
phone. The remote person can’t hear the supervision.
Call manager
The Call Manager (Figure 4.82) is a Flash application that allows to visualize:
the state of each extension, if it is online and if it is doing calls, state of the lines
and SIP servers. You can also end calls through this interface when authenticated.
Figure 4.82: VoIP - Call Manager configuration

150 IPBrick.C
The configuration of the call manager (Figure 4.83) is made from the IPBrick
web interface in IPBrick.C - Voip - Call Manager, and it is necessary to click the
connection Change. By default are shown the state of all registered telephones,
ports of each RDIS and analogic plate, state of the waiting lines, conferences and
SIP servers. Some of these fields cannot be shown if we remove them in Show fields.
Figure 4.83: VoIP - Call Manager
To define an administration password which allows to end the calls, it is nec-

essary to change the value of the field Administration password. To allow other
LDAP users to use the call manager it’s possible to control the permissions at
Access Management option.
In the configuration page you have the link to the call manager which may be
acceded from the LAN. It might be necessary to define the alias call manager in
the DNS server of the network.
If it is not possible to visualize all the extensions, lines and servers of the call
manager, it is necessary to move the mouse to the right side of the page and the
remaining ones shall be visible. In this version of Call Manager we can do some
operations when the administrator password is inserted:
• Call transfer: Drag and drop the active phone to another;
• Call termination: Double click in a phone;

4.9 VoIP 151
• Call generation: Drag and drop one phone to another;
In the screen appear all the telephones, routes, interfaces, etc., which shall be
registered in IPBrick. However, there are differences, if the telephone has a visible
IP address, it means that it is active, otherwise it will be deactivated. If the tele-
phone is represented in red, it means that a call is in progress and its duration is
indicated.
4.9.5 Routes Management

So that IPBrick executes the routing of the calls between the several network
interfaces, it is necessary the definition of specific routes according to a telephony
numbering.
As you can see in Figure 4.84 we have this options:
• Local Routes: Represent all the local interfaces available in IPBrick by de-
fault;
• Outbound routes: Represent all the outbound routes, so it will be possible

to make calls using SIP/IAX accounts;
• SIP servers list for registering: Allow to receive calls for SIP numbers asso-
ciated to SIP accounts;
Figure 4.84: VoIP - Routes Management

152 IPBrick.C
Local routes
Local routes (Figure 4.85) allow the configuration of an interconnection between

LAN, PSTN, PBX or INTERNET.
The possible options by default are:
• PSTN-LAN: It allows the call routing from the telephone network to the
VoIP phones of local network. So it’s a internal IPBrick route than can
redirect the received calls from the PSTN to VoIP phones;
• PBX-LAN: It allows the call routing between the telephones connected to
the PBX and the VoIP telephones of local network;
• LAN-PBX: It allows the call routing from the VoIP telephones in local net-
work to the telephones of the PBX;
• LAN-PSTN: It allows the call routing from VoIP phones to telephone net-
work;
• INTERNET-PBX: It allows to accept VoIP calls from the Internet and route
them to PBX phones. It’s a IPBrick internal route only for call redirection;
• INTERNET-PSTN: It allows to accept VoIP calls from the Internet and
route them to the telephone network network. It’s a IPBrick internal route
only for call redirection;
• PBX-PSTN: This is a default internal route. It allows the call routing from
the PBX to telephone network. 21
• PSTN-PBX: This is a default internal route. It allows the call routing from
the telephone network to the PBX.
If there are other configured interfaces (acting like trunks), they may be added
to the list of routes, and for that it is necessary to click the connection Available
Local Routes (Figure 4.85) and then add the necessary routes.
The Insert in the top menu allows to insert one of the routes mentioned. After
insertion, each type of route has a connection that allows its configuration. When
acceding to this interface it is possible to choose one of these options:
• Back
• Modify: To change the type of local route;
• Delete: Remove the local route;
• Insert: It allows to add the prefixes that must be added to this route. When
you indicate a prefix, all the calls whose initial digits coincide with that digit
are routed by that route. Choosing Advanced Options we have this options
(Figure 4.87):
21
It’s possible to call from phones connected to PBX and, if IPBrick is connected to PSTN
and to a PBX, you can also answer calls. IPBrick will work in a transparent mode, switching all
the traffic from PBX to PSTN and vice-versa.

4.9 VoIP 153
Figure 4.85: VoIP - Local Routes
– Prefix: The numeric prefix to use to make calls using that route;
– Include prefix in address: If Yes the prefix will be part of the
destination number, so the prefix will be maintained when the call is
routed. If No the prefix will be used only to identify the route. Example:
To enable the use of number 6 to route a call to the Portuguese PSTN
network, it is necessary to remove this prefix in order that the number
stays with the correct format (the format 2XXXXXXXX instead of
62XXXXXXXX).
– Postrouting prefix: It’s a prefix added by the IPBrick when the
number is received. Example: For the Portuguese PSTN network we
use the format 2XXXXXXXX. If we use has main route a SIP account
route it’s necessary to use prefix 2, include prefix in address and use
a postrouting prefix with 00351 (351 is the portuguese international
code);
– Caller IDs restriction: Will restrict the route only for the listed
caller ID’s;
– Fallback routes: It’s a backup route to use if the present one fails;
– Generate local ringing tone: Will generate a local ringing tone.
Can be used when it can’t ring at the destination phone;
– Priority: Define the prefix priority level.
Outbound routes
This option turns possible to configure which calls shall be routed to a external
server which shall be responsible for routing them to their destiny (Figure 4.86).
This routing is made through prefixes that may be inserted clicking the name of
the route and then the link Insert above the prefixes table. To change or remove
a route you only have to click its name and then the option Modify or Delete,
respectively.
To add a new outbound route click Insert. The Basic Options are:
• Type: Type of signalling protocol to use: Can be SIP, SIP with TLS or IAX;

154 IPBrick.C
• Name: Outbound server name;
• Server Address: Server IP/name address;
• Authentication: If it is necessary to make authentication in server, you

shall have to choose the option User/Password and fulfil the users name and
respective password;
Choosing Advanced Options the following parameters will be presented:
• Server Port: Server port to use;
• Video support: If the VoIP server supports video, you can enable that
option;
• Caller identifier: Outbound caller ID masking;
• Registration realm: Realm is usually the SIP server FQDN but some SIP
servers have different server address and registration realm;
• Outbound proxy: Usually not used but is a server that passes the SIP mes-
sages between the SIP client and the SIP proxy server;
• Available to Internet: With this option selected, the route shall be avail-
able for VoIP telephones outside the LAN;
• Simetric signalling: It allows to define if signalling is sent and received

through the same port (5060);
• Activate ENUM search: It allows IPBrick to search through ENUM.22
• DTMF type: Type of DTMF23 to use. Options: RFC2833 (default), Inband,

Info and Auto;
• Call limit: Number of possible simultaneous calls using that route, that
can be useful for bandwidth control. With 0 we can disable it;
If the outbound route type is IAX, the only parameters are:
• Name;
• Server Address;
• Server Port;
• Available to Internet;
• Call limit.
22
Group of protocols that aims to associate the telephonic numbering to a new register in
DNS. This way, a telephone number shall correspond to a SIP address.
23
Dual-tone multi-frequency

4.9 VoIP 155
Figure 4.86: VoIP - Outbound route definition
The prefixes inserted in these outbound routes shall be available automatically

for the SIP telephones and the telephones connected to PBX. If there are addi-
tional interfaces and you intend to use a outbound route, it is necessary to add the
route INTERFACE->INTERNET (for example PBX1->INTERNET or GSM->INTERNET),
include in that route a prefix matching the one of the route for the SIP server and
include the prefix (in option Include prefix choose Yes).
For each outbound route it’s possible to define which codecs will be used (op-
tion Modify and their priority with the option Order.
SIP servers list for registering
Here it’s possible to visualize the SIP24 address list which have already been
configured (Figure 4.88). When inserting a new one, the page generated asks for
the following data:
• Name: Server name;
• SIP server address: SIP server IP or address.
After inserting the data, it is necessary to click the button Insert to confirm
the insertion of the address. The next step is to register accounts to the local SIP
server. Pressing Insert we have this options:
24
Session Initiation Protocol

156 IPBrick.C
Figure 4.87: VoIP - Prefix definition
• Login: SIP account login. Normally it’s the nomadic SIP number;
• Authentication user: Usually the same as the login;
• Password: SIP account password;
• Local: Internal phone that will receive the calls coming from the Internet
to that nomadic number.
Figure 4.88: VoIP - SIP server for registering

4.10 IM 157
4.9.6 Music on Hold

In this section (Figure 4.89) you can see the list of songs which shall be heard
if the call is placed on hold. It is also possible to add more mp3 files to the list,
clicking the connection Insert and after searching the localization of the music file
(by clicking on the button Browse...), write a brief description of the file in the
field Name. To add the mp3 after all fields have been fulfilled, click the button
Insert. You can also remove or modify the songs from the list clicking on the name
of the song and clicking on Change or Delete.
Figure 4.89: VoIP - Music on hold
4.10 IM
IM (Instant Messaging) is a service that lets you exchange text messages at
near-real-time speed. IPBrick’s IM server is ejabberd, an IM server based on the
Jabber (XMPP) protocol. With this server you can communicate both using the
Jabber protocol and the MSN protocol through a MSN gateway. Access to MSN
contacts is controlled by this web interface. By default, the IM service, when
enabled, blocks access to all MSN contacts, except the ones explicitly authorized
in this web interface.
4.10.1 Enabling / disabling the IM server

Enable Instant Messaging Modify (Figure 4.90):
• No: The ejabberd server is stopped and all access to the MSN IM network
is unblocked.
• Yes: The ejabberd server is running. The access to the MSN IM network is
blocked. The MSN client programs will be blocked, (Figure 4.91) so will the
web messenger sites, as we can see in Firewall (Figure 7.16). At Authorized
domains we can define witch domains will be authorized to use the IM service.
When the Instant Messaging server is enabled, you’ll have the following fea-
tures:

158 IPBrick.C
• List of authorized MSN users from IPBrick Contacts:
– Insert: Clicking the checkboxes you can choose which MSN contacts,
from IPBrick Contacts, are reachable through the Instant Messaging
server.
– Delete: Clicking the checkboxes you can choose the contacts from IP-
Brick Contacts that you no longer want to be reachable from accounts
logged on the server.
• List of authorized MSN users:
– Modify: Add, one per line, the MSN contacts that you want to be
reachable through the Instant Messaging server. All users will be able to
reach only the authorized MSN contacts. To remove the authorization
you just need to remove them from the text box.
It is possible to use both these features simultaneously, that is, you can be
using IPBrick Contacts to allow MSN contacts, and add other contacts in the List
of authorized users.
Figure 4.90: IM - Enabling Instant Messaging Server

4.10 IM 159
Figure 4.91: IM - Blocking MSN applications
Figure 4.92: IM - Web messenger sites blocking in firewall

160 IPBrick.C

Chapter 5
IPBrick.GT
All the services except Fax are presented at IPBrick.C menu:
• VoIP;
• IM;
• Fax Server;
• E-Mail;
• SMS;
• Web Server;
• Webmail.
5.1 Fax Server

The fax server is integrated at IPBrick from version 4.1 onwards. It works
with a serial modem/fax or integrated in the PBX IP server. Incoming faxes are
automatically forwarded trough email.
The FAX Server configurations are implemented through the web interface in
IPBrick.I - FAX Server (Figure 5.1).
Figure 5.1: Fax Server - Configure
IPBrick provides you these two services: FAX2Mail e Mail2FAX. With the
FAX2Mail service, a FAX sent by an external FAX device is received by the FAX

162 IPBrick.GT
connected to IPBrick and then is forwarded to a defined email address.
With Mail2FAX you can send from an email an attached pdf file to a defined
FAX number. to enable this task you have to configure the email client with the
SMTP server where the FAX service is running and add the configured fax domain
to the domain list that is allowed to be forwarded by the email server.
5.1.1 Fax2Mail
To configure this service you have to click on the Modify link and select Yes to
Enable Configuration. The following options are displayed:
• Fax Device: Type of physical connection/FAX hardware.
– Line type: When the server has a telephony PCI card acting as a Fax
machine, the type of line could be ISDN or ANALOG in the case of an
analogic telephony access (Figure 5.2);
– Serial Fax Modem: If the modem is connected to the server serial port
you should choose the port that connects to the the modem in the Serial
Ports list (COM1 to COM8), the Baud rate (1200 to 38400) and Class
of the modem (Class1 to Class2.1). To know the appropriate values you
should read the modem manual (Figure 5.3).
Figure 5.2: Fax Server - FAX at telephony card

5.1 Fax Server 163
• Number of virtual fax machines: Define the number of virtual FAX’s to use;
• Main Fax Number: The PSTN Fax number to be present when a FAX is
sended;
• Company identification: Company name to be present when a FAX is sended;
• Country Code: Country phone number code to be present when a FAX is

sended;
• Area Code: Area phone number code to be present when a FAX is sended;
• Long distance prefix: 0 by default;
• International prefix: 0 by default;
• Rings Before Answer: Number of rings before IPBrick answers to Fax. Can
be useful if another FAX equipment is connected. For example, if the FAX
equipment can’t receive the FAX, IPBrick FAX server can answer at the 5th
ring;
• Speaker volume: FAX sound volume;
• Enable delay: Should be active by default;
• Sender of notifications: It’s a internal email account that will send notifica-
tions to users that are using the Mail2FAX. Examples: Error sending fax,
task completed etc. By default we use IPBrick Fax Server that will use
the current domain;
• Sender of received fax notifications: Identification of the reception warnings

sender. By default we use IPBrick Fax Server;
• Fax resolution: Define the vertical resolution of the fax. There are two
resolution modes, a normal resolution of 98 lines/inch and a high resolution
of 196 lines/inch;
• Number of attempts to send the fax: Number of tries attempts to send the
FAX. By default will terminate a job if 3 consecutive attempts to send a
particular page fail;
• Maximum time to send the fax: Sets the time that a fax have to be sent.
Stop the process if it does not complete in the indicated time.
If the inserted Fax is connected to a serial port, there are these available options:
• Send to: At this moment the single option available is sending to email;
• Destination: Is the email address where the IPBrick incoming faxes are
forwarded;
• File type: The format faxes will be delivered (pdf, ps or tiff);

164 IPBrick.GT
Figure 5.3: Fax Server - Serial Fax Modem
To activate configuration, click Modify
If you access the menu again, there will two new options near the link Modify:
Fax Users e Fax Lines (if the Fax is connected to an analogic telephony/ISDN
card).
In Fax users (Figure 5.4), you can set which users may be authenticated in the
Fax client application and which will have permissions to manage Fax queue lists.
The FAX client can be WinPrintHylafax that is available for download in http:
//winprinthylafax.sourceforge.net. The advantage of using a FAX client at
the workstations side is the possibily to print any document directly to HylaFax,
so it’s an alternative to Mail2FAX explained down.
Fax Line
The fax line settings are (Figure 5.5):
• Line Type: ISDN is the only option available. The FAX arrives by the PSTN
at a ISDN line;
• Fax Interface: By default we can use the PSTN. It’s also possible to specify a
trunk only for FAX at Advanced Configurations - Telephony - Interfaces,
option Insert;

5.1 Fax Server 165
Figure 5.4: Fax Server - Fax Users
• Fax number: It could be represented by its DDI, by the complete fax number
or after a 0;
• Send to: Email. It’s the only option available;
• Destination: Recipient email address for the Faxes;
• File type: The FAX can be received in attachment by .pdf, .ps or .tif.
Figure 5.5: Fax Server - Fax line definitions
By default, notifications and reception warnings are delivered by email to

fax@<domain>. That’s why you have to create an email account with this name
or an alternative email with the same name for other existing accounts.
Note: You have to activate the Fax service in Advanced Configurations

- System - Services and click in FAX. Enable Active and Automatic start.

166 IPBrick.GT
5.1.2 Mail2Fax
In Mail2Fax definitions we have two options:
• Domain for fax sending: It’s a internal domain used just to send FAX’s. You
can choose any domain you want, but the recommended one is fax.domain.com.
When the email server receives one message for that FQDN, the message at-
tachment will be forwarded to the FAX server that sends the FAX by the
PSTN;
• Presented source fax number: For each LDAP group it’s possible to define
what would be the source fax number field when someone sends a FAX to
the PSTN;
After updating the configurations you will be able to send Faxes from a work-
station using a simple email client. At the workstation side just:
• Map an email account pointing the SMTP to the IPBrick or use webmail;
• At the To: field insert number@fax_domain, e.g.: 221121112@fax.domain.com;
• The subject is optional, so the next step is to attach a .pdf or a .tiff file
that will be the FAX;
Note that you can create a mailing list at IPBrick and insert all the FAX
numbers you want, e.g.: Create a mailing list named faxcostumers@domain.com
and insert at External users list some costumers FAX’s:
00351222222222@fax.domain.com
...
So at the client side you just need to send an email to faxcostumers@domain.com,

attaching only the .pdf or .tiff file.
5.1.3 Statistics
This menu displays the statistics about Sent Faxes, Incoming Faxes and in
course tasks.
Sent Faxes
Visible fields (Figure 5.6):
• ID: Fax identification;
• Date: Sending date;
• Owner: Fax Sender;

5.1 Fax Server 167
• Pages: Number of Pages;
• Origin: Origin email address;
• Number: Fax number;
• Attempts: Number of attempts;
• State: Fax sending status.
Figure 5.6: Fax Server - Sent Faxes
Received Faxes
• Sender: Sender name;
• Destination: Receiver number;
• Pages: Number of pages;
• Reception date;
• File: Fax file.
Current faxes
• Delete: Deletes Fax;
• ID: Fax identification;

168 IPBrick.GT
Figure 5.7: Fax Server - Received Faxes
• Owner: Fax sender;
• Number: Fax number;
• Pages: Number of pages;
• Attempts: Number of attempts;
• State: Fax sending status.
In this menu you can visualize statistics and Delete Tasks.
Figure 5.8: Fax Server - Current Faxes
The monthly FAX statistics are automatically sended to the Sender of notifications
email.

Chapter 6
IPBrick.KAV
All the services are presented at IPBrick.C menu:
• Firewall;
• Proxy;
• VPN;
• E-Mail;
• Webmail.

170 IPBrick.KAV

Chapter 7
Advanced Configurations
Here you have the advanced interface for some services and configurations
present in the upper menus. This chapter is divided by the following main sections:
• IPBrick;
• Telephony;
• Network;
• Support services;
• Disaster recovery;
• System.
7.1 IPBrick
7.1.1 Definitions
In this section will be treated some very essential IPBrick server configurations.
Domain Definitions
In Domain Definitions you configure the hostname and the server DNS do-
main. The Fully Qualified Domain Name is composed by the machine name and
the DNS domain. For example, if you have the hostname ipbrick and the DNS
domain company.com, the FQDN will be ipbrick.domain.com. In order to change
these definitions click on Modify.
Network Definitions
At network definitions is possible to configure the following network interface
parameters:
• Interface: Interface name;

172 Advanced Configurations
• Type: Private (for eth0) or public for the others;
• Mode: Inferface mode can be static or for the public interfaces it’s possible
to configure the interface as dynamic, so it will act as a DHCP client;
• IP: Interface IP address with the correspondent network bit mask;
• Network: Network address;
• Broadcast: Network broadcast IP;
• Aggregate network interface cards: If some addicional NIC’s are available,

the ethernet bonding can be configured;
• MAC Address: Physical address of NIC.
The parameter state will show the physical link state:
• Green: The link is OK;
• Red: The link is DOWN;
The Modify will change these parameters. The Insert will add a new IP alias
for the interface. Example: eth0:1, eth0:2.
If IPBrick works as an Intranet server (IPBrick.I), it is only necessary to config-
ure the private interface. The public interface may get all the default configurations
and it shall not have a network cable connected.
If the server has more network cards (ETH2, ETH3...), they are listed as private
but no rules will be added automatically to the firewall. This means that all traffic
for that new interfaces will be denied.
If IPBrick works like a Communications server (IPBrick.C) or if it accumulates
the Intranet and Communications functions (IPBrick.I + IPBrick.C), it is neces-
sary to configure the two network interfaces (in these two situations, the server
where IPBrick was installed, shall have two network cards).
To change the network interfaces definitions, it’s necessary to click ETH0 and
ETH1.
The network cards aggregation (bonding) option can provide failover, load-
balance and link speed increase. To get a good experience with bonding the switch
were the network cards are connected must support IEEE 802.3ad Dynamic link
aggregation (Figure 7.2).
For configuration this steps must be followed:
• Have one interface (ex: eth2) present but not configured yet;
• Click at the interface to bond (ex: eth0) and choose to aggregate network
interface cards;

7.1 IPBrick 173
• Choose the NIC’s MAC addresses of eth0 and eth2 interfaces;
• Click Modify, so the eth0 will be bounded with eth2 and became only one
interface - eth0.
NOTE: The private interface is the first network card detected by IPBrick in
the server where it was installed. If the server has a second network card, this shall
be configured as a public interface. The firewall is already configured by default
with specific rules to recognize the ETH0 as a private interface and ETH1 as a
public interface. If the server has more network cards (ETH2, ETH3...), they shall
be considered as private;
NOTE: The ethernet cards MAC address should be associated to all the in-
terfaces, so when the server reboots the interfaces will be always associated to the
same NIC.
Default route
This menu allows to define the gateway of IPBrick.
If IPBrick works as an Intranet server (IPBrick.I), the address to put in this

field is the address of the equipment which makes the access to the Internet. This
equipment may be, for example, a Communications IPBrick or a router. The gate-
way IP address shall have to be the address of that same IP network configured
in the private interface, the ETH0. For instance, if the private interface has the
IP address 192.168.1.1, the gateway IP address shall have to be 192.168.1.x. The
interface to choose to configure the gateway is ETH0.
If IPBrick works as a Communications server (IPBrick.C) or if it accumulates

the Intranet and Communications functions (IPBrick.I + IPBrick.C), the address
to put in this field is the internal address of the equipment that accedes to the
Internet, for example, a router. In this case, the gateway IP address shall have to
be the address of that same IP network configured in the public interface, ETH1.
The interface to choose to configure the gateway is ETH1.
To change the Gateway definition is necessary to click Modify. An example

can be viewed at Figure 7.1
7.1.2 System Information

As you can see in Figure 7.3 , here you shall receive crucial information about
the system, from the use of the network, information of the hardware, use of
memory or archive systems.
7.1.3 Web Access

This section allows the access and license management of IPBrick (Figure 7.5).

Figure 7.1: Advanced Configurations - Definitions
Figure 7.2: Advanced Configurations - Bonding
Access definitions
• Login: admin;
• Password: 123456.
The login admin and respective password refer, uniquely and exclusively, to
the authentication used to access IPBrick through the web interface and both can
be altered. To edit them it’s necessary to click on Change.
Note: In contrast with the Administrator user this login has no work area
in IPBrick.
Language definition
IPBrick is currently available in five languages:

7.1 IPBrick 175
Figure 7.3: Advanced Configurations - System Information - 1/2
• Portuguese;
• English;
• Spanish;
• French;
• German.
In this section it’s possible to change the language in IPBrick (Figure 7.6). To
make this change, it is necessary to click on Modify, select the prefered language
and afterwards click on Apply Configurations so that the alterations become
effective.
External WEB access

To access the IPBrick configuration interface through the Internet (External
Web Access), is necessary to click Change and choose ”Yes” (Figure 7.5). You
should also activate the HTTPS service to the Internet. It is also necessary to do
this:
• Activ the HTTPS for Internet (IPBrick.C - Firewall - Services and

choose Active in the State;

Figure 7.4: Advanced Configurations - System Information - 2/2
• If the IPBrick is connected to the router internal interface (without public

address), is necessary in router to do a DNAT to the port 443 for the IPBrick;
IPBrick licence
This section is about the licensing process of IPBrick. When installing IPBrick,
you will have a trial licence of 30 days of use. When this licence expires, the server
is automatically reconfigured to the base configurations. The solution is to install
a permanent license.
To install a permanent license it’s necessary to click on the option Download

server identification for licence generation and send the file.dat to licence@ipbrick.com
asking for licence activation. You need to speciffy this information:
• Company name;
• Some information about the IPBrick server type (Intranet, Communication
or VoIP server);
After receiving the answer (with an attached file) from licence@ipbrick.com,
it is necessary to select the option Cancel Temporary Licence in the created page,
insert the file received (it will be licence.dat), and the licence will stay perma-
nent.

7.1 IPBrick 177
Figure 7.5: Advanced Configurations - Web Access
Figure 7.6: Advanced Configurations - Language
7.1.4 Authentication
From the moment the user is created in IPBrick, there shall be a register in
the database of the authentication server - LDAP1 . LDAP is defined as a directory
service where the information, relating to the computer resources of the company
and its users, is kept. Whenever an user intends to authenticate in a certain service
with his/her username and password, the IPBrick LDAP database is consulted to
validate or not the access.
Modify
IPBrick allows several authentication modes and it is configured by default for

all the users to authenticate themselves in their own IPBrick (Figure 7.7):
1
Lightweight Directory Access Protocol

• IPBrick Master: Default Mode. All the services in the server shall use the
LDAP server;
• Secondary Master IPBrick: Used only under High availability licence. See
Appendix E for details.
• IPBrick Slave: LDAP server shall be a synchronized replica of the indi-

cated IPBrick Master server, and this mode is used in a scenery with several
servers. The users may authenticate themselves in this server, once there is a
temporized synchronization of the LDAP database with the IPBrick Master,
but there is no possibility to add users. In networks with a high number
of users where there are several authentications, it is useful the use of slave
authentication servers thus avoiding a congestion in the IPBrick Master net-
work segment. This scenery is also of a great use in networks geographically
distributed (Figure 7.8);
• IPBrick Client: The services authenticate remotely in the indicated LDAP

IPBrick server. In this case, there is no local database copy, and it is nec-
essary to specify the IPBrick Master/Slave server. Normally, this way of
authentication is used in a IPBrick.c in the extent of VPN, PPTP and Proxy
services (Figure 7.9);
• Netbios Client: It is possible to IPBrick to become a part of the domain

managed by a server previous to Windows 200x to use the NetBIOS protocol.
In a network like this, the users continue to authenticate themselves normally
in the Windows machine.
• AD Domain Member (IPBrick Master): IPBrick is a member of a domain

managed by a Windows Active Directory server. The users of the network
need, as always, to authenticate in AD;
• AD Domain Member (IPBrick Slave): The IPBrick Slave is also going to

be a member of a AD domain, acting as a secondary IPBrick server. The use
of a Slave IPBrick as a member of a AD domain may be particularly useful in
the case of secondary email servers, always implying the existence of another
IPBrick server configured as a member of the AD domain - Master IPBrick .
NOTE: After changing the IPBrick authentication mode, during the Apply
Configurations, IPBrick shall reboot automatically.
NOTE: At a Slave/Client IPBrick, the myipbrick virtualhost will be automat-

ically configured with reverse proxy to the Master IPBrick.
Distributed Filesystem
The users nay be physically distributed by the Master/Slave servers. Mean-
while, the centralized information system - LDAP has the information about the
physical location of each account. A NFS (Network File System) service makes
available the accounts of the users through the network. The Automount service

7.1 IPBrick 179
Figure 7.7: Advanced Configuration - Authentication modes
Figure 7.8: Advanced Configuration - Authentication - IPBrick Slave
combines the LDAP information with NFS and makes automatically available the
accounts of the users virtually in any other Master/Slave server. IPBrick allows
the integration with authentication servers running in Windows operating sys-
tems, namely previous Windows 200x machines (NetBIOS authentication) and
after Windows 200x machines (authentication via Active Directory).
Figure 7.9: Advanced Configuration - Authentication - IPBrick Client

Automount
LDAP is a directory service where the relevant information of a company is
kept: Users, computer resources, contacts, etc. The Automount service combines
the LDAP information with NFS and makes automatically available the accounts
of the users virtually in any Master/Slave server.
In the Netbios authentication, the authentication server has not as a base a

LDAP service. In this configuration, IPBrick uses its own LDAP server as an
auxiliary member for the other services. In the authentication mode member
of the AD domain, the authentication server is a LDAP implementation. All
IPBrick services are configured to use this LDAP server. However, it is necessary
to extend the structure of this LDAP server to support the requisites of IPBrick
server, namely the UNIX/Linux credentials and the Automount information.
NOTE: At www.ipbrick.com - Documentation section, there is a document
about the integration of IPBrick as a member of an AD domain.
Servers
In that option all the servers registered at Master LDAP are presented by the
IP, FQDN and the authentication type (Figure 7.10).
Figure 7.10: Advanced Configuration - Authentication - Servers list
7.1.5 Update
All available updates in the Downloads section of the IPBrick site should be
installed from here. All you have to do is click on Archive, choose the update
file (.deb) and choose Insert. Next, the package shall be installed in the system
(Figure 7.11).
7.2 Network
In this section we’ll address the advanced configuration of services related to
the structure of the organization’s network. It will be possible to define specific
rules at firewall, to add static routes for other internal networks (or external), to
define rules and priorities in the QoS service as well the configuration of service
routing at firewall.

7.2 Network 181
Figure 7.11: Advanced Configurations - Update
7.2.1 Firewall
This section deals with the IPBrick firewall management. Some of the pre-
defined rules were already mentioned in the section Firewall in the chapter IP-
Brick.C (rules that can’t be changed by the user, only deactivated). In the mean-
time the configuration of some other services demands some other rules. These
rules can only be managed in part by the user in the Order section. Nevertheless,
IPBrick offers the administrator an advanced interface for the firewall manage-
ment. There, he can define a group of rules with high personalization (Figure
7.12).
Figure 7.12: Network - Firewall
Here you have links to:
• Insert new rules in advanced mode;
• Delete already inserted rules

• Order: Interface to order all the rules that exist in the firewall (Figure 7.16).
This option is particularly important when new rules are created. Because
the first rules the firewall does the matching will be the first to use. Then,
more specific rules should be at the top and general should be at the bottom.
You can insert three types of rules:
• DNAT Rule: Redirects the traffic that comes to a port to another port/machine
of the internal network. That rule here is only for TCP traffic (example at
Figure 7.15);
• Disable machine access: It defines the denial of access to a port of defined

network machine (example at Figure 7.14);
• General settings: Here you can add a completaly personalized rule (ex-
ample at Figure 7.13). These are the affected fields:
– Rule:
INPUT: Data received by the firewall that aim the recipient

interface no matter their origin;
OUTPUT: Data sent by the firewall;
FORWARD: Redirects traffic from an interface to another;
PREROUTING: Is used to change IP packets arriving to the
machine before the routing decision;
POSTROUTING: Is used to change IP packets arriving to the
machine after the routing decision;
– Interface: You should choose which interface to apply the rule (eth0,
eth1, eth2... and the loopback interface - lo);
– Protocol: Protocol(s) to which you want to apply the rule;
– Module: Shows the list of iptables modules available for use;
– Source IP: Source IP Address of the packet;
– Origin port: Source port of the packet;
– Destination IP: Destination IP address of the packet;
– Destination port: Destination port of the packet;
– Identifier: 16 bits field that exists in the original IP packet - it is
used to identify the type of packet to filter. Examples:
! --syn
--state INVALID
--state ESTABLISHED,RELATED
--icmp-type echo-request
– Politics:

7.2 Network 183
ACCEPT: To accept a packet and let it pass the firewall rules;

DELETE: Doesn’t accept the packet and eliminates it;
MARK: Saves a mark in the packet. These marks can be used to make
decisions at the forwarding level;
LOG: Saves a log of every packet that folows the rule.
– If the PREROUTING rule is used, there are the following extra policies:
REDIRECT: Used to redirect the traffic arriving from a port to
another port;
DNAT: it allows to redirect the traffic arriving at a certain
port to another machine and port belonging to the internal
network
– If the POSTROUTING rule is used, there are the following extra poli-
cies:
MASQUERADE: It allows to ’mask’ the traffic
SNAT: It allows to redirect the traffic generated in a certain
port to another machine and port.
TCPMSS: It changes the MSS field (maximum packet size) from the
TCP header. It just can be used to TCP SYN or SYN/ACK
packets because is just used in the beginning of
conections.
The rules that are defined by default can’t be eliminated, but can be deactivated
by clicking in the state of the rule and change the Deactivate option.
Figure 7.13: Network - Firewall - General settings rule

Figure 7.14: Network - Firewall - Disable access rule
Figure 7.15: Network - Firewall - DNAT rule
At body there’s a list of all the rules controled by the user (Figure 7.12). A
rule can be switched between enabled and disable state. To eliminate rules is
necessary to click Delete, select the rule or rules that you want to remove and
click the button Delete. The rules defined by default cannot be deleted, however
they can be deactivated, all you have to do is click the state of the rule and change
the option to disable.
7.2.2 Route management

When there are several distributed networks separated by some routers in an
organization, and if you want to give IPBrick access to all of them, you must
indicate the gateway for that network (Figure 7.17).
The following fields are present:
• Destination network: Network to access;
• Mask: Mask of the destination network;
• Interface: IPBrick interface with connectivity to the destination network;

7.2 Network 185
Figure 7.16: Network - Firewall - Order
Figure 7.17: Network - Route management
• Gateway: Router/server IP with connectivity to the destination network.
7.2.3 QOS
The QoS service2 (Figure 7.18) in IPBrick allows the customization of traffic
priority levels, oriented to the external interface, thus assuring a certain level of
quality of the service for the final user. It is importnt to indicate immediately the
value of the band width available in the connection for the internet. From these
data we can establish priority rules among the several types of traffic in a network.
2
Quality of Service

for example: instead of the internet connection being entirely occupied by the
email service, limit the band width given to that service and assure a minimum
value for the web traffic.
At Body we have the list of the available Public Interfaces (normally ETH1)
and the state of the service for each network card. Clicking the state allows to
move between active and inactive. Clicking the network plate allows to accede
the management formulary of that service (Figure 7.18).
Figure 7.18: Network - QoS management
In Generic Configurations (Figure 7.19) is possible to define which maxi-

mum band width is allowed for download and upload.
In section Structure there are three classes of defined priorities, each one of
them already with predefined filters. It is possible to define new filters for each
priority class, specifying the following fields:
• Types of filter: ACK type (confirmation of packets reception) or General;
• ToS3 :
– Minimizes the delay;

– Maximizes debit;
– Maximizes reliability;
– Minimizes the cost;
– Minimizes the cost;
• Protocol: Type of protocol to apply in the filter;
• Source IP;
• Source Port;
• Destination IP;;
• Destination Port.
The Priority Class 1 has always maximum priority, and the traffic is defined in
Priority Class 3, the less importnt.
3
Type of Service

7.2 Network 187
Figure 7.19: Network - QOS - General Configurations
7.2.4 Service Routing

IPBrick allows to route the traffic of several network services to different output
interfaces. A communication server may be routing the SMTP traffic to a certain
ISP router and the web traffic to another (example at Figure 7.20). The definition
of gateways is made through the following fields:
• Name: The name of the new access to the internet;
• IP address: Internal router IP responsible for that access - Gateway;
• Tag in the firewall: Automatically attributed.
After defining a Destination, it’s necessary to add specific rules in the firewall so
that the routing of desired services becomes a reality. It will be presented firewall
configuration examples for:
• Using the new access to send and receive email;
• Using the new access for web traffic;
Figure 7.20: Network - Service Routing

Mail service example

In this case, the new Internet Access (eth2) will be used for the mail service,
including incoming and sending (port 25). This rules should by inserted:
1. Rule to masquerade the outgoing traffic for the eth2 interface;
• Type: General configuration;

• Rule: POSTROUTING;
• Interface: eth2;
• Protocol: ALL;
• Module: Leave blank;
• Source IP: Leave blank;
• Origin port: Leave blank;
• Destination IP: Leave blank;
• Destination port: Leave blank;
• Identifier: Leave blank;
• Politics: SNAT;
• Value: eth2 IP;
2. Rules that accept incoming traffic for the port 25:

• Rule: INPUT;
• Protocol: TCP;
• Destination port: 25;
• Politics: ACCEPT
3. Rule to allow the replys for port 25 by the Internet mail servers:

• Rule: INPUT;
• Protocol: TCP;

7.2 Network 189

• Origin port: 25;
• Identifier: ! --syn;
4. Rules to forward outgoing Internet SMTP traffic for eth2

• Rule: OUTPUT;
• Protocol: TCP;
• Source IP: eth1 IP;
• Destination IP: ! eth1 IP;
• Politics: MARK;
• Value: 1 (firewall tag);
5. Rules to forward outgoing SMTP traffic with origin in IPBrick for the new
interface (eth2);

• Rule: OUTPUT;
• Protocol: TCP;
• Politics: MARK;

6. Rule to forward traffic with origin in LAN and destination the port 25 in
Internet (only when is used a external SMTP account)

• Rule: PREROUTING;
• Protocol: TCP;
• Source IP: LAN IP;
• Politics: MARK;
Web access example

In this case, the new Internet Access (eth2) will be used for the LAN web access
that will be redirected to the new interface:
1. Rule to masquerade the outgoing traffic for the eth2 interface;

• Rule: POSTROUTING;
• Protocol: ALL;
• Politics: SNAT;
• Value: eth2 IP;
2. Rule to allow the replys for port 80 by the Internet web servers:

• Rule: INPUT;

7.2 Network 191
• Protocol: TCP;
3. Rule to allow the replys for port 443 by the Internet web servers:

• Rule: INPUT;
• Protocol: TCP;
Internet (only when the proxy is not used!)

• Protocol: TCP;
• Source IP: LAN ip;
• Politics: MARK;

Internet (only when the proxy is not used!)

• Protocol: TCP;
• Source IP: LAN network;
• Politics: MARK;
6. Rule to forward traffic with origin in a machine conected to the LAN using
VPN PPTP and destination the port 80 in Internet (only when the proxy is
not used!)

• Interface: ppp+;
• Protocol: TCP;
• Politics: MARK;
7. Rule to forward traffic with origin in a machine conected to the LAN using
VPN PPTP and destination the port 443 in Internet (only when the proxy
is not used!)

7.2 Network 193
• Interface: ppp+;
• Protocol: TCP;
• Politics: MARK;
8. Rules to forward outgoing Internet web http traffic for eth2:

• Rule: OUTPUT;
• Protocol: TCP;
• Politics: MARK;
9. Rules to forward outgoing Internet web https traffic for eth2:

• Rule: OUTPUT;
• Protocol: TCP;


• Politics: MARK;
NOTE: To route other services for the new internet access (local and remote
port), the idea is the same.
7.3 Support services

7.3.1 LDAP
Figure 7.21: Support Services - LDAP
In this section a list is presented of the machines registered in the LDAP service
of IPBrick. To insert a new machine in the LDAP domain of IPBrick it’s necessary
to click Insert. It is also possible to Modify or Delete LDAP registers.
The insertion of machines in LDAP from here can be very useful, when there
are IP networks different from the internal interface of IPBrick, since there is no
need to indicate the IP.
Mass Operations for machines
option permits an import of a .csv file. You can edit a .csv file in a spreadsheet
application, choosing the ; to split the columns. When doing an export we can
see all this fields present:
– I: To insert a machine record in LDAP;

– U: To update a machine record in LDAP;
– D: To delete a machine record in LDAP;
• uidnumber: LDAP field that identifies the resource. Usually machines begin
with UID 50000.
• name: Machine name;

7.3 Support services 195
action;uidnumber;name
N;50000;pc01
N;50001;pc02
I;50002;pc03
I;50003;pc04
I;50004;pc05
7.3.2 DNS
DNS4 is a name resolution service that translates domain names into IP ad-
dresses and vice-versa, and it is implemented in IPBrick by the software Bind using
port 53 UDP/TCP. The majority of queries consists of a simple UDP request by
the client, followed by a UDP answer of the server. There are two situations where
the TCP is used: when the data to be sent by the user exceed 512 bytes or at
the transference of zones. Some operating systems like HP-UX, for example, even
adopt DNS implementations always using TCP, thus increasing reliability. The ser-
vice acts like a database with information about the connections of a IP network,
and that information is organized into domains. The used notation represents
FQDN5 :
servername.company.region
Being the ”servername.company.region” the FQDN, the ”company.region” des-

ignated as the domain, ”company” the sub-domain and ”region” the top domain
(Top Level Domain), which is administrated by an entity denominated ICANN6 .
A DNS server generates a database about a certain part of the domain, what is
normally designated by zone, and there are two different types of servers that:
• master: It obtains the data from a zone which it manages from its own
database;
• slave: It obtains the data from the primary master, existing one or more
in a network. Whenever there are changes in the configuration of the areas
served by the master, this server is always notified, proceeding to the update
of database.
So we can have master DNS servers, also called primary, and slave DNS servers
that can be named as secondary too. Regardless of being master or slave in a zone,
a server can have different purposes:
4
Domain Name System
5
6
Internet Corporation For Assigned Names and Numbers

• internal DNS server: A internal DNS server (master or slave) serves pri-
vate domains and resolve names at private IP’s. They stay inside the LAN
and normally the service is running at the same server that is PDC. Example:
pc01.domain.com -¿ 192.168.0.25. At IPBrick context, it will be a IPBrick.I;
• public DNS server: A public DNS (master or slave) serves only public do-
mains and resolve names at public IP’s that are well known at the Internet.
They can stay at company’s network DMZ, but usually the public DNS server
of a domain is managed by the company ISP or some hosting company in
Internet. Example: www.ipbrick.com -¿ 80.251.163.69. At IPBrick context,
a IPBrick.G/KAV/GT can be as public DNS server of some domain. It’s
not a good policy to have a unique server managing the same domain with
internal records and public records.
The DNS server also allows the resolution of names in a reverse mode, that is,
answer with the name (FQDN) from a certain IP address. This device allows the
confirmation of the authenticity of an IP address, important aspect in the email
service.
Domains
This is the main section of DNS configuration. Here you can handle the do-
mains managed by the server and their respective DNS records like, machines,
alias, mail exchange records etc. By default the following zones are presented:
• Forward zone: That type of zones have the name-¿IP address mapping,
and are the most used ones. By default IPBrick serves the forward zone
domain.com;
• Reverse zones: This type of zones can map IP address-¿ names and are
mostly used by public e-mail servers, for authenticity verification. By defaut
IPBrick serves the forward zone 192.168.69.0/24;
You can access the interface management of these zones by clicking on one of
them. (Figure 7.25 and Figure 7.26)
Clicking at link Insert a new domain, a new domain will be served by IPBrick
(Figure 7.22)
Insert a new zone At top menu you have a link to get Back to the previous
list and cancel the current process of introducing a new zone. At body you see a
register form for forward and/or reverse name (Figure 7.27) resolution zones. You
find the following definitions:
1. Domain: Name of the new zone to create; e.g. companyx.com; porto.companyx.com;

easylinux.com;

2. Network: The associated IP network for which you are going to create reg-
istrations. This is used only for reverse name resolution records (PTR7 );
3. Zone type: Field that allows you to create a master or secondary zone. A
secondary zone is a copy of another DNS server master zone;
4. Server: Name of the machine that will serve8 this domain (e.g. ipbrick.domain.com)
(this field is only applied on master zones);
5. Email: E-mail of the responsible for this domain. This e-mail is registered
in the DNS under the name of the administrator for this domain (this field
is only applied on master zones);
6. Refresh time: The time of a secondary zone to see if there are any changes
in the master zone (this field is only applied on master zones);
7. Transfer retry time: The time a secondary zone has to wait to retry the
connection to the master zone, that is, if the last refresh was unsuccessfully
(this field is only applied on master zones);
8. Expiry time: The time a secondary zone has to consider the dates of a zone
as valid since the last successful refresh (this field is only applied on master
zones);
9. Default time-to-live the time in which the other DNS servers have to
consider the dates of this zone as valid (this field is only applied on master
zones);
10. Master servers: IP address of the master server for that zone (this field is
only applied on secondary zones);
11. Visible in the management of machines: If selected, all these defini-

tions will appear too under domain management.
If the idea is to create a sub-zone these are the necessary steps (Example:
porto.companyx.com):
• Insert a new zone at the present main menu. At domain type porto.companyx.com;
• Go to domain management of main zone companyx.com and at Name Servers

insert:
Domain: porto.companyx.com
Server: ipbrick.domain.com (no need to change that default field)
• Go to domain management of sub-zone and start populating it (machines,

alias, MX record...)
7
Pointer
8
SOA - Start of Authority

Figure 7.22: Support Services - DNS - Name resolution zones
Domains Management To manage a domain simply click on the domain name

in zones list. So in this section you control all DNS records of a selected zone. At
top you have a link to get Back to the zones list and a Domain link that guide us to
zone definitions. At body you have a list of all possible DNS records to configure,
each one with a Insert bottom. Now all records will be presented supposing that
we are managing the forward zone of domain.com:
• Machines: This is called the A record (address record). It’s used to map
hostnames to IP’s. E.g.:
pc01 192.168.69.96
ipbrick 192.168.69.1
slave01 192.168.69.2
So pc01.domain.com will resolve to 192.168.69.199. In order to get the

base domain domain.com associated to some IP you need to insert a machine
record like that:
domain.com. 192.168.69.1
• Aliases: This is called the CNAME record (canonical name record). It’s
an alternative name for some existing machine record (this option is only
available for a forward name resolution zone). E.g.:
webmail ipbrick
im ipbrick
contacts ipbrick
voip ipbrick
mailsrv2 slave01

• Name Servers: It’s the NS record (name server record). Here we manage the
list of DNS servers for the zone. If a zone has master and slave servers, the
master should have that information defined here. E.g.:
domain.com ipbrick.domain.com
domain.com slave01.domain.com
Let’s suppose that the same IPBrick’s are serving other zone called easylinux.com.
So the configuration would be:
easylinux.com ipbrick.domain.com
easylinux.com slave01.domain.com
• Mail Servers: This is called the MX record (mail exchange record) and it’s
a crucial record. We can say what server or servers are the mail servers for
the present domain. You can have several registrations each with different
internal positive values. The values indicate which registration to use first.
The registration with the lowest value is always the first one to be used. The
names to be introduced here must always be the e-mail server FQDN (this
option is only available for a forward name resolution zone). For example:
10 ipbrick.domain.com
20 mailsrv2.domain.com
• VoIP Servers: It’s one SRV record (service locator) for new protocols, in-
cluding VoIP (SIP). The value to be introduced here is the FQDN of the VoIP
server (this option is only available for a forward name resolution zone). For
example:
voip.domain.com
• Instant Message Server: It’s also a SRV record for Jabber protocol and by
default the address is im.domain.com. The alias im exist by default;
The SRV records for VoIP and IM are very easy to configure if IPBrick is
the DNS server, because we only need to type the FQDN of the server. If
the private/public zones are managed by different DNS servers and we want
to use that services in IPBrick you need to really specify all the SRV records
that are being used, and pointing them to IPBrick.
Example for VoIP:
_sips._tcp.domain.com. IN SRV 1 0 5061 voip.domain.com.

_sip._tcp.domain.com. IN SRV 1 0 5060 voip.domain.com.
_sip._udp.domain.com. IN SRV 1 0 5060 voip.domain.com.

Example for IM:
_jabber._tcp.domain.com. 86400 IN SRV 5 0 5269 voip.domain.com.

_xmpp-server._tcp.domain.com. 86400 IN SRV 5 0 5269 voip.domain.com.
_xmpp-client._tcp.domain.com. 86400 IN SRV 5 0 5222 voip.domain.com.
• Valid records for sending mail (SPF): In this field we can use the SPF
in order to specify what records are valid for mail sending. So this config-
uration here will be the IPBrick’s mail server answer to the external mail
servers that are using the SPF protection. The configuration can be done at
Basic Options (Figure 7.23):
– Registered mail servers: The domain MX records can be valid (pass),

invalid (fail) or undefined (not present at TXT record)
– Registered machines: The domain A records can be valid, invalid or
undefined;
– Domains: Other domains that are valid (corresponding to the senders
address);
– Networks: Valid sender networks;
All the rest is invalidated (mechanism -all).
Figure 7.23: Support Services - DNS - SPF basic options
After the configuration, from the Basic Options, going to Advanced Options
will present the TXT record. There it’s possible to edit directly the TXT
record, so other specific SPF mechanisms and qualifiers can be used (Figure
7.24).
TXT record example:

Figure 7.24: Support Services - DNS - SPF advanced options
domain.com. IN TXT "v=spf1 a mx -all"
In that configuration, if someone in Internet asks for the mail authenticity,

only the mail sended by the domain MX and A records will be valid. The
rest will be invalidated.
Figure 7.25: Support Services - DNS - Zone Management 1/2
Mass Operations for machine record

option permit an import of a .csv file. You can edit a .csv file in a spreadsheet
application, choosing the ; to split the columns. When doing a export we can see
all the fields present:

Figure 7.26: Support Services - DNS - Zone Management 2/2
Figure 7.27: Support Services - DNS - Reverse zone
– I: To insert a machine record in DNS;

– U: To update a machine record in DNS;

– D: To delete a machine record in DNS;
• idzone: Zone identifier;
• zonename: Zone name;
• iddnsina: A record identifier;
• name: A record name;
• ip: A record IP;
• addtorev: Option to add the record or not to reverse DNS zone. Value 1
yes, 0 no.
action;idzone;zonename;iddnsina;name;ip;addtorev
N;1;domain.com;1;ipbrick;172.29.1.154;1
N;1;domain.com;2;pc2;172.29.1.32;1
I;1;domain.com;3;pc3;172.29.1.33;1
I;1;domain.com;4;pc4;172.29.1.34;1
Note: The private reverse zones can exist at DNS LAN servers, but the public
reverse zones are maintained at .arpa9 . The configuration of that public zones
are configured at ISP DNS servers, so all the costumers public IP’s can be mapped
to the respective FQDN. It’s called a PTR record and actually they became very
important, because the number of mail servers that make that reverse zone ver-
ification is increasing. Example: Mapping the IP 195.23.45.33 with name ip-
brick.companyx.com. The ISP will insert a record like that:
33.45.23.195.in-addr.arpa. IN PTR 195.23.45.33
Forwarders
If a DNS server receives a request for a domain which he neither serves nor has
in cache, then the server has to forward this request to other DNS servers in the
Internet. The forwarders should be the nearest ones, normally the DNS servers
of ISP. If the forwarders field is empty the DNS still working because the server
use the internet gateway to do the DNS search. If in the same network exists a
IPBrick.I and a IPBrick.C, the IPBrick.I must have the IPBrick.C eth0 address in
the forwarder field. Here you have the most appropriate interface to register the
nearest DNS servers (Figure 7.28).
9
Internet Address and Routing Parameter Area

Figure 7.28: Support Services - DNS - Forwarders
Name Resolution
Regardless of the DNS service is being executed or not in this server, you can
configure the server to handle its DNS requests in another server. You can apply
this configuration to all server services (with the obvious exception of the DNS
server which uses its forwarders for requests he does not know). In order to make
the server use its own DNS you have to configure the IP address of the localhost10 ,
127.0.0.1 - by the way, its the default configuration. (Figure 7.29).
Note that if IPBrick is not resolving in the own DNS service and if we dont
have machines using IPBrick as DNS server or as a forwarder, the service is not
being used at all. In that case all zones presented at DNS - Domains submenu
may even be deleted;
Figure 7.29: Support Services - DNS - Name resolution
7.3.3 DHCP
The DHCP11 service may be defined as a protocol of dynamic attribution of
parameters for configuration of network and workstations (door 67 and 68 UDP),
an evolution of the BOOTP protocol. Basically, a DHCP client sends a broadcast
packet to a network asking an IP address, and it obtains an answer if there is a
DHCP server active in the network. The server not only attributes it an IP but
also: Network mask, route by default, DNS server and WINS server.
10
local server
11
Dynamic Host Configuration Protocol

DHCP allows two ways of attributing the IP addresses:
• Address manual or reserve: there an association between the MAC address

of a client machine and the IP address to supply, and that machine stays
with that same IP address;
• Dynamic: the client obtains the address from a range of address previously
defined by the IPBrick administrator, for a defined period of time;
NOTE: There is a mechanism that allows to have the DHCP server in a IP

network distinct from the clients, this mechanism is known by DHCP relay. The
DHCP relay is assured by an agent installed in the post(s) present in the remote
network(s), this agent receives the DHCP clients requests and routes them to the
configured DHCP server.
Subnets
This menu permits the definition of subnets to be served and the parameters
of the network configurations to attribute to the workstations. (Figure 7.30)
Figure 7.30: Support Services - DHCP - Subnets
At top menu you have a link to Insert new subnets, configure Redundancy
parameters and define General Options by default. (Figure 7.31)
At body you have a list of the inserted subnets. Each line is a link that opens
a configuration form with options for each subnet. (Figure 7.32)
It allows the insertion of the subnet parameters, which shall be attributed to

the clients:
• Network Address: It allows to indicate the address of the network and the
respective mask;
• Dynamic addresses range: Which range of addresses is reserved to at-

tribute the clients;
• Clients mask: Mask of the network to attribute the clients;
• Broadcast address: Address of broadcast to attribute the clients;

Figure 7.31: Support Services - DHCP - General Options
Figure 7.32: Support Services - DHCP - Subnets Definition
• Default lease time: Default lease time during which the address can be
lent;
• Max lease time: Max lease time of an IP address for the machines. This
value surpassed, the IP address is renewed;
• Option Router: Address of the router which will serve as the default route
(by default 192.168.69.199);
• DNS Servers: List (one per line) of the DNS servers to be used by the clients
(by default ipbrick.domain.com);

• NetBios servers: List (one per line) of the NetBios servers to be used by
the clients (by default ipbrick.domain.com);
• TFTP server: Define the TFTP server to be used by DHCP clients. Can be
used for example for IP phones auto provisioning;
• DNS domain: Name of the domain indicated to the clients (by default do-
main.com).
It allows the insertion of general DHCP parameters, which shall be attributed

by default to the clients:
• Base domain: Domain where the DHCP is operating;
• DNS servers: DNS servers to be used by the DHCP server;
• NetBios servers: NetBios servers to be used by the DHCP server;
• Clients mask: Mask to be used by the clients of the DHCP service;
• Default lease time: Default lease time during which the ’lease’ of the address
is valid for the clients;
• Max lease time: Max lease time of an IP address for the machines. When
this value is surpassed, the IP address is renewed.
If you want the DNS Dynamic Update, it is necessary to choose ”Yes” in the
respective box. This feature is used to update dynamically a machine IP in the
DNS record if that machine is not registered with MAC address
Redundancy
It is possible for an IP network to configure two DHCP servers, one as main
(primary) server and the other as secondary. Normally, only the primary server
answers the requests, while the secondary one synchronizes its DB with the pri-
mary, if the primary fails the secondary shall assume its service. Communication
between the servers is made from the network ports which may be customized.
One of the ports shall be attending the connections from the secondary server and
the other one shall be attending the connections from the main server. (Figure
7.33)
Top Menu Here you have a link to get Back and Insert a new connection.
The following fields are presented in the insertion of redundancy and fault:
• Name: Name of the redundant connection;
• Configuration: here you can see if the server is the primary or secondary
DHCP;

• Local IP: Servers internal IP address;
• Local gate: Local gate where the service is running;
• Remote IP: Remote IP address from the server of the other extreme;
• Remote gate: Remote gate where the service in the other extreme is running;
• Max answering time: Max time that the DHCP server can wait for a mes-
sage from the other peer. When that is out, the server assumes that the
other has failed and assumes itself as the network DHCP server;
• Max Unpacked Updates: Max Unpacked Updates (BNDUPD) non-confirmed

that the server can receive from other peer.
Figure 7.33: Support Services - DHCP - Redundancy
Machines
Here you see a list of the registered machines with their MAC addresses in
the DHCP service. You can register the machines in Machines Management (see
section 3.2, page 22) or directly in this section (Figure 7.34).
Figure 7.34: Support Services - DHCP - Machines

Mass Operations for machines
option permit an import of a .csv file. You can edit a .csv file in a spreadsheet
application, choosing the ; to split the columns. When doing a export we can see
all the fields present:
– I: To insert a machine in DHCP;

– U: To update a machine in DHCP;
– D: To delete a machine in DHCP;
• iddhcpmachine: DHCP machine identifier;
• name: Machine name;
• ip: Machine IP address;
• mac: Machine NIC’s MAC address;
action;iddhcpmachine;name;ip;mac
N;1;maq1;172.29.1.66;AA:55:43:4A:AA:A1
I;2;maq1;172.29.1.67;AA:55:43:4A:AA:A2
I;3;maq1;172.29.1.68;AA:55:43:4A:AA:A3
7.3.4 ENUM
The ENUM12 service allows the mapping of telephone numbers (Rule E.164)
in names associated to IP addresses, using an architecture based on the DNS ser-
vice. Those names may be from the protocol SIP, H.323, Email etc. In order to
consult the DNS, ENUM inverts the telephone numbers, giving them the prefix
e164.arpa. which is the root of the tree. This tree is delegated to all countries of
the world taking into account their codes E.164. this way, the Portuguese delega-
tion shall be the inverted 351 - 1.5.3.e164.arpa.
In IPBrick, you can define the ENUM zones where a number search can be
made. For that you’ll have to click on the connection Insert and input the ENUM
zone domain. In Order it’s possible to define which are the priority zones where
the number search shall be made. In Figure 7.35 a list of the ENUM zones may
be visualized.
Once the list of the ENUM zones is defined, where to search numbers, the
ENUM may be used in VoIP routes. Next, an example is given:
12
Telephone Number Mapping

1. In IPBrick.C - VoIP - Routes Management, there is a Output Route for

Sip Servers - VoIPBuster.
There it is necessary to activate the option Activate ENUM Search in the
Route Definitions;
2. A certain user of the network calls through the SIP/PBX to number +351253593112;
3. Automatically, a research is made in the ENUM zones specified in the present

menu for 2.1.1.3.9.5.3.5.2.1.5.3.e164.arpa, in order to obtain the cor-
respondence of that number in a certain IP address/name;
4. Supposing that the research results in the SIP address joaod@domainx.com,

a SIP call is made to the address joaod@domainx.com;
Figure 7.35: Support Services - ENUM
7.4 Disaster recovery

7.4.1 Configurations
All configurations done in IPBrick through the web interface are saved in a
Postgres database. This way any changes done will only be effective in the system
after clicking on Apply Configurations.
IPBrick allows the time tracking of all configurations, because when you modify
something in the web interface and Apply Configurations, a new configuration is
locally saved. It is possible to store these configuration files in an USB pen and ad-
ditionally send them to a configurable email address. In the configuration filename
we have the date and the exact hour when a configuration was created. In short,
this configuration management allows a fast disaster recovery, in case of hardware
problems. When applying configurations if for some reason the configuation can’t
be saved, a warning message will be presented.
There is a configuration called default which is the IPBrick’s base configura-
tion immediately after install.
Clicking on Definitions there are the following fields that can be modified on
the link Modify:

7.4 Disaster recovery 211
• Source address: Source address to send the notifications (by default admin-
istrator@domain.com);
• Destination address: Email address (internal or external) were the config-

urations are delivered (by default config.backup@iportalmais.pt). You can
add multiple destinations separated by a ;
• Message Subject: By default is Backup IPBrick ;
• Message body: Should have a description about the IPBrick server type. By
default is empty.
! Attention !: After the IPBrick installation you should always insert a USB
pen connected to server. The pen must be labeled with the name IPBRICK-D and
must be FAT32 formated.
Replace
In this section you see a list of all saved copies on the USB pen. In order to
replace a setting you just have to click over it (Figure 7.36).
Figure 7.36: Disaster Recovery - Replace configuration
⇒ Note: All services will be reconfigured when replacing a copy of the set-
tings. After the configuration of all services IPBrick restarts automatically.
Download
This section allows you to download the copies of the configurations done to a
local computer (Figure 7.37).
With this useful option you can save IPBrick settings on another place.
Upload
In this section it is possible to upload a previously downloaded configuration
file to the server (Figure 7.38).

Figure 7.37: Disaster Recovery - Download configuration
Figure 7.38: Disaster Recovery - Upload configuration
! Attention !: It is not possible to use setting copies in different IPBrick

versions. The configuration files are not compatible with the different IPBrick
versions.
7.4.2 Applications
This is a useful disaster recovering feature. When upgrading IPBrick from
version A to version B, if an old installation is detected, the following applications
will be backed up:
• PostgreSQL: All the Postgres databases will be dumped, including the sites
databases;
• Mail: The emails that were in the queue will be saved;
• Kaspersky: All the Kaspersky applications statistics will be saved;
• VoIP: It will save all the VoIP statistics;
• IM: The Instant Messaging data and configuration will be saved.
So, all these application files are packed and saved in a folder.
Choosing the option Applications - Restore the list of available application
data backups will be shown (Figure 7.39). To restore the desired application data
backup, click on the file and then on Restore. At this moment the backup will be
restored for the new IPBrick version (Figure 7.40).

7.5 System 213
Figure 7.39: Disaster Recovery - Applications - Data backups list
Figure 7.40: Disaster Recovery - Applications - Data restore confirmation
7.5 System
Inside the System menu, we can find the options indicated in these following
points.
7.5.1 Services
In Services (Figure 7.41) you’ll find a list of several services available in IP-
Brick. The State column shows you if the service is enabled or disabled. It is
possible to restart any service without having to restart IPBrick.
In order to restart any service you have to:
• Change the State from Enable to Disable;
• Change the State from Disable to Enable;
The Start column defines the way in which each service has to start with the
server (whether after a reboot or after a period while the server was disconnected).
If you see Automatic in the Start column of a service then the service will start
automatically with the server. On the other hand, if you see Manual on the
column then the service will not start with the server. Nevertheless it can be
started manually in this menu by changing its State from Disable to Enable.

Figure 7.41: System - Services
⇒ Note: Any changes in the Start column of a service will not have imme-
diate effects on the service start. The changed start will only be valid for the next
server start. On the other hand, a change in the State column has immediate
effects. That is, by changing the service state from Enable to Disable IPBrick
stops this service.
7.5.2 Task Manager

The Task Manager shows you a list of all executed processes in IPBrick. It
gives you information about:
• Identifier: It’s the PID13 ;
• Owner: The system user name that started the process;
• Start: The date of the process start;
• Memory: The memory percentage used by the process;
• Processor: The processor percentage used by the process;
• Process: The process that is running.

13
Process Identifier

7.5 System 215
In this section it is possible to stop a certain process. Therefore you only have
to click over the option Kill Task (Figure 7.42).
Figure 7.42: System - Task Manager
! Attention !: Speaking in general, the running processes should not be

stopped in this manner. To stop a process in this interface may cause instability
in IPBrick. In order to correctly stop services use the Services menu.
7.5.3 Date and Hour

In this menu (Figure 7.43) you can see and change the server date/hour and
the time zone. When clicking Modify this fields are presented:
• Synchronization: If Manual the date/hour will be managed by the own server.

If Automatic IPBrick will use a NTP server to remotely synchronize the
data/hour. The default one is pool.ntp.org14 (Figure 7.44);
• Date: Only active in manual mode;
• Hour: Only active in manual mode;
• Time Zone: Choose the correct time zone.
14
Big virtual cluster of Network Time Protocol timeservers

Figure 7.43: System - Date and Hour
Figure 7.44: System - Date and Hour - NTP
7.5.4 System users

This menu (Figure 7.45) lists the System users (name and its login). If you
select one of them, it is possible to change its password as long as you know the
existing password. This is the list:
• root: Linux console superuser;
• operator: Linux console operator;
• Received Mail: User for the received mail copy functionality. The idea is
to map a IMAP account from a email client;
• Sent Mail: User for the sent mail copy functionality. The idea is to map a
IMAP account from a email client;
• kaspersky: User to receive the Kaspersky Applications notifications for ex-
ample. The idea is to map an IMAP account from a email client;
• spam: User to receive the mails from Kaspersky Anti-Spam. The idea is to
map a IMAP account from an email client;
• VoIPCDR: User for FTP access, to get the asterisk full call statistics.
The password for all of them except root is L1opardo.
⇒ Note: Do not mistake System Users for LDAP Users. A System User is
not registered in LDAP.

7.5 System 217
Figure 7.45: System - System users
7.5.5 Monitoring
This section stands only for monitoring features. Main options:
• Logs: IPBrick and system logs management;
• Accesses: Monitoring for some TCP protocols;
• Traffic: Can manage all the active TCP connections;
• Alerts: Options for disk partitions alerts;
Logs
The logs are an important tool for troubleshooting. In this menu we can:
• IPBrick Logs: Logs generated by the IPBrick. Useful in detecting any prob-
lem at the web interface layer. The most recent information is available in
Current Log (Figure7.49). In case there are other log registrations then
each of them provides information generated by IPBrick till their indicated
date (Figure7.48);
• System Logs: Can manage some system logs (syslog, daemon.log,auth.log,

mail.*). Figure7.46:
– State: The default is disable;

– Server: If enable we can say if logs will be written locally or in a remote
machine that supports syslog daemon (Figure7.47);
– Authorize logs from remote servers: If enable, authorize servers to
write system logs in IPBrick;

Figure 7.46: System - Monitoring - System Logs
Figure 7.47: System - Monitoring - System Logs - Remote server
Accesses
At Management clicking on the service name we can enable the accesses moni-
toring for SSH, FTP, VPN PPTP and SSL. By default the state is disabled (Fig-
ure7.50).
The Entries option permits the visualization of all accesses (Figure7.51). It’s
• IP;
• User;
• Notes:
Figure 7.48: System - Monitoring - IPBrick logs list

7.5 System 219
Figure 7.49: System - Monitoring - IPBrick current log
– Connected;
– Disconnected;
– Wrong password;
– Illegal user;
– Locked;
– Timeout;
– Timeout/Locked;
– Log in attempt with root user;
– Disconnected/Timeout.
• Date;
Options available:
• Export PDF: Exports all the information to a .pdf file;

Figure 7.50: System - Monitoring - Accesses - Management
Figure 7.51: System - Monitoring - Accesses - Entries
Traffic
Here all the active TCP connections are listed by this fields:
• Source IP: Remote machine that has a connection to the server;
• Source port: Port used by the source machine;
• Destination IP: Server IP;
• Destination port: Port where the source machine is connected;
• State: The default is enabled.
In Action, choose the option Block connection to finish a specific connection.

After blocking one connection it’s possible to unblock it hiting the option Unblock
connection (Figure7.52).
Alerts
Define here if the full partition alerts definition will be active. So if the
partition reaches 85%, an email alert will be delivered to the email present at
Destination address. Changing the source address notifier is possible too (Fig-
ure7.53).

7.5 System 221
Figure 7.52: System - Monitoring - Traffic
Figure 7.53: System - Monitoring - Alerts
7.5.6 SSH
The SSH menu implements a secure connection to the IPBrickś shell, showed
in Figure 7.54.
The SSH (Secure Shell) is similar to the known Telnet application but more
secure because of the protocol SSL used.
Note: This function needs the installation of Java Virtual Machine. The
software is available in www.java.com. After the connection it’s necessary to make
an authentication. Therefore, you’ll need to input the following data:
• Username: operator;
• Password: L1opardo.
After that first authentication, you can enter su to login as superuser;
7.5.7 Reboot
This option allows you to reboot IPBrick (Figure 7.55). After confirming the
reboot option, the web connection with the server is automatically stopped. When
IPBrick restarts it is possible to establish a new https connection with the server.

Figure 7.54: System - SSH
Figure 7.55: System - Reboot
7.5.8 Shutdown
This option is to clearly shutdown IPBrick (Figure 7.56), assuring that all
the services are terminated correctly. You should use this option, whenever it is
necessary to shutdown IPBrick. Do not shutdown the server directly in the power
supply.

7.6 Telephony 223
Figure 7.56: System - Shutdown
7.6 Telephony
To make possible the IPBrick’s interaction with telephone systems, you need
to install specific hardware. This hardware includes PCI cards that can be ana-
logic, RDIS BRI or RDIS PRI. Analogic cards provide the connection to telephone
networks working in analogic mode. If telephone networks are working in digital
mode (RDIS), cards may be BRI or PRI. A BRI (Basic Rate Interface) access
has three channels: Two 64kbit/s (B) for data/voice and one 16 kbits/s (D) for
control. The PRI (Primary Rate Interface) access corresponds to 30 B channels
plus one D channel in Europe - can also be designated as E1 circuit.
7.6.1 Cards
After physical configuration and installation in the machine you have to con-
figure IPBrick. To make this step you have to know how the card was physically
configured, i.e., each port configuration. After the physical installation of the
hardware, you can configure cards in the IPBrick web interface in the menu:
Advanced Configurations - Telephony - Cards
To insert click on Insert, and then indicate (as shown on Figure 7.57):
• Card type: Can be analogic, ISDN BRI or ISDN PRI;
• Manufacturer: Depending of the card type can be:
– ISDN BRI: Beronet compatible (chipset HFC);

– ISDN PRI: Digium compatible (default), Open Vox, Sangoma;
– Analog: Digium compatible (default), Open Vox.
• Port count: Number of ports;
• Port configuration: Each port can be configured to connect to the pre-

setted interfaces: PBX or PSTN. For analogic, ISDN BRI/PRI the settings
are automatically configured like this:

Analogic: Connecting to a PBX, so the card port will act as fxs

Connecting to PSTN, so the card port will act as fxo
ISDN BRI: Connecting to a PBX, so the card port will act as NT PtP or NT Pt
Connecting to PSTN, so the card port will act as TE PtP or TE PtM
(PtMP = 1 to N possible terminals. Contact the PSTN operator)
ISDN PRI: Connecting to a PBX, so the card port will act as NET
Connecting to PSTN, so the card port will act as CPE
The actual status of each port is presented as shown on Figure 7.58. Detailed
explanation:
• Green: The layer 1 (physical) and layer 2 (signalling) are UP. So the port is
ready;
• Yellow: The layer 1 is UP and layer 2 is DOWN. It means a sync problem,

so probably you need to check the tx or rx settings (ISDN PRI) or the card
jumpers (ISDN BRI);
• Red: The layer 1 and layer 2 are DOWN. It means that we have a connection
problem (bad cable or no cable) or the port is damaged. Note that for a
PSTN BRI - PTMP mode, usually when no calls are active, the standby
status can be allways red;
• Red blinking: Hardware problem. You need to verify the card integrity /
jumpers configuration. It’s very rare to happen.
If no card is present or if it’s not detected, the message will be NA.
Figure 7.57: Telephony - Cards - Insert
For each card inserted there are three options: Back, Modify and Delete (Fig-
ure 7.58).
If the port is connected to the landline (PSTN) you need to configure the
setting as TE. If the port is connected to the PBX gateway you have to configure
the PBX port and configure the setting as NT. A ISDN FAX usually behaves like a
PBX requiring the port configuration as FAX (to show this option requires a FAX

7.6 Telephony 225
Figure 7.58: Telephony - Card definitions
interface configuration) and configure the setting as NT. If there is a GSM interface
configured in one of the ports you have to choose it on the list and configure the
setting as TE. To configure a ISDN PRI you have to indicate if the line uses R2
protocol (protocol used for example in Brazil) and if the CRC4 is active on the
line. The PtP or PtMP depends of the telephone operator line type.
After the configuration, we can see a list with the configured cards, as visible
in Figure 7.59.
Figure 7.59: Telephony - Cards list
7.6.2 Registered Phones

The phones should be inserted by the IPBrick.I - Machines Management so the
main goal of this option is to modify some specific SIP phones attributes.
Inserting a phone here is valid too if there is no need to attribute a specific IP

address to the telephone and we don’t want that LDAP stores information about
that machine. You can add a telephone simply by filling the field relating the
name and the access password to the telephone.

• Phone: Insert the name of the telephone to register;
• Password: Insert the access password to the telephone;
• Retype Password: Reinsert password;
• Caller ID: If you want to mask the caller ID insert one;
• Phone Location
– Local: It’s the default, for a LAN phone;

– Remote: For a remote phone that is connected behind a NAT. Usually
this option is used when the idea is register the phone from the Internet,
using the IPBrick network public IP.
• Auto provisioning: The auto provisioning option permit the automatic

configuration of SIP hardphones, so here we just need to choose the phone
model. To work, it’s mandatory when registering the phone at Machines
Management, to insert the MAC address.
• Description: This field should have a text phone description;
Example at Figure 7.60.
Figure 7.60: Telephony - Simple phone register
7.6.3 Configurations
In this menu it’s possible to adjust several configurations for VoIP and PBX/PSTN
integration. This are the options:
• General options;
• Analog and ISDN PRI options;

7.6 Telephony 227
• ISDN BRI options;
• List of enable codecs;
• IP PBX remote managers;
• VoIP domain alias.
General options
The following fields in Options (Figure 7.61):
Figure 7.61: Telephony - Configurations
• Router with full DNAT?: If IPBrick is connected to a router responsible

for the access to the exterior (in terms of VoIP) that allows the ’passage’ of
all traffic, it is necessary to select Yes and indicate the external address of
that same router in Router public IP address;
• IP address of the IPBrick public interface used by the VoIP service:

IP address of the public interface of IPBrick responsible for the VoIP service;
• Intranet VoIP Server only?: It allows to route the network traffic only
in a interface and not in two interfaces, as usual;
• Remove default national prefix (0): It removes national prefix nor-

mally used;

• Get call source address from IPBrick LDAP: If activated, it goes to the
database LDAP of IPBrick defined in IPBrick IP address and in IPBrick DNS
domain and, if it finds the calling number in the database, it will replace it
by the name of the entity associated to that number.
• Immediate answer on calls originated in a PBX: It is advisable to have

this option connected if you are using connections to SIP servers (ex: VoIP-
Buster, NetCall), in order to avoid timeouts in the PBX central. If, for
example, you intend to define rates for the calls from the PBX, this option
shall have to be deactivated to avoid that the user starts paying as soon as
he dials the number.
• Attendance Timeout: Time (seconds) during which the call is sent to the
destiny phone, before being sent or routed to another phone;
• Call Timeout: Time (seconds) during which the connection is trying to be

established. If it expires, the attempt will be ended;
• Timeout to hangup calls without sound;
• Timeout to hangup calls on hold without sound;
• Enable SIP video support: Enables the support for SIP video. The sig-
nalling protocols doesn’t support only voice but also video.
• Attended transfer: If yes you can define a key activation sequence to do

a attended transfer. So you can stop using this feature from the SIP phone
and use it from the VoIP server;
• Blind transfer: If yes you can define a key activation sequence to do a

blind transfer. So you can stop using this feature from the SIP phone and
use it from the VoIP server;
• Call pickup: If yes it will enable the call pickup. If some phone is ringing
and the idea is to answer the call using another phone, we can use the key
activation sequence (*8 by default) plus the phone number to pickup the
call. Example: *8111, will pickup a call from the phone 111 that is ringing;
• Group call pickup: With this option active, if some phone is part of a
Call Group it’s possible to pickup a call from a ringing phone member that
is using the defined key activation sequence (*7 by default);
• Global call pickup: If yes it will enable the global call pickup. If some
phone is ringing and the idea is to answer the call using another phone, we
can simply use the key activation sequence (*8 by default) to pickup the call.
Example: *8, will pickup a call from some phone that is ringing. If we have
two or more calls at the same time, will be picked always the last arrived
call;

7.6 Telephony 229
• Phone lock: Permit to lock a internal phone, so it will be not able to make
and receive calls. To lock a phone you need to enter the key activation
sequence and wait for a message. After that message you need to type the
user PIN or PIN and password defined at IPBrick.GT - Users Management,
depending of choosed user access validation. To unlock the phone the process
is the same. If the option Allow phone unlocking by any valid user is set to
NO, only the user that locked the phone or the defined Administrator unlock
password will unlock the phone;
• Do not disturb: If enabled the phone will be unable to receive calls. By

default use *73 to activate DND on a phone, and *74 to deactivate;
• Unconditional forwarding: Can be used to do unconditional call forwarn-

ing at a phone and by default uses key sequence *70. Example: Calls for
phone 201 will be unconditional forwarded to phone 202. So we just need
to do a *70202 at phone 201. To deactivate we type only *70;
• Forward when busy: Can be used to forward a call when some phone is
busy and by default uses key sequence *72. Example: If phone 201 is busy,
calls will be forwarded to phone 202. So we just need to do a *72202 at
phone 201. To deactivate we type only *72;
• Forward when not answer: Can be used to forward a call when some phone
do not answer and by default uses key sequence *71. Example: If phone 201
is not answering, calls will be forwarded to phone 202. So we just need to
do a *71202 at phone 201. To deactivate we type only *71;
• Call Supervision: If yes it will only enable the call supervision feature. Be
default the key activation sequence is *9;
• Voicemail: Enables general voicemail for VoIP. The voicemail files will be
sended allways by e-mail;
• Call’s prioritization: If enabled it will be possible to define priority

levels for each route prefix defined in Routes Management. The level is from
1 (highest) to 10 (lowest). Example: In a LAN-PSTN route all the BRI lines
are full. If a emergency call prefix (911) have maximum priority defined,
when someone dial 911 some current call can be disconnected;
• Enable advanced call statistics: If active will enable some fields at call
statistics like: Total packets, codec, lag, lost packets, signalling and jitter.
Note that CPU/memory load will be increased;
• Store calls details records in csv file: All the call history in the
default asterisk format will be saved to a file called Master.csv. This file
can be downloaded acceding by ftp with username voipcdr and password
L1opardo;

• IP of server-signalling different from the media server: If a re-

mote signalling service is running in one server, and the remote media server
is running in a different one, this option must be activated;
Analog and ISDN PRI options

Parameters only for the analog/ISDN PRI cards, that will be adjusted at the
driver configuration files used for that cards - zaptel (Figure 7.62):
• Channel tone zone: Country tone zone. The frequences may be different
from country to country;
• Echo cancel;
• Type of Number (ISDN TON): Low level signalling options
– Callee (Calling Number): Unknown is the default, other options are

local, private, national and international;
– Caller (Caller Number): Unknown is the default, other options are local,
private, national and international;
• R2 signalling options: If the R2 signalling protocol is used (old ISDN proto-

col) you can define here the R2 parameters:
– DNIS: Dialed Number Identification Service value;

– ANI: Automatic Number Identification value;
– Zone/Country;
Figure 7.62: Telephony - Analog and ISDN PRI options

7.6 Telephony 231
ISDN BRI options

Parameters only for the ISDN BRI cards, that will be adjusted at the driver
configuration files used for that cards - misdn (Figure 7.63):
• Echo cancel: The default is High. Other options: Disabled, minimum, low
and maximum (requires more CPU processing);
• DTMF detection threshold: Permit to change the DTMF sensibility from 50
to 400 (less sensibility);
• Immediate digit capture: The immediate capture of digits changes the way
how the numbers sent from a PBX central are read in IPBrick. When this
option is deactivated, the routine capture of digits is changed to solve prob-
lems in the reading of numbers in some central stations, for example, when
the dialled number is wrongly identified in IPBrick (repeated digits or lack
of digits). Attention: This option should be placed No by default;
• PSTN digit reception timeout: Timeout in seconds;
• Jitter Buffer: Permit the change of Jitter Buffer15 ;
• Digit timeout: Time (seconds) from the dialling of the last number from
which IPBrick considers the dialling as ended;
• Response timeout: Time (seconds) counted from the moment the receiver is
hung up and at its end IPBrick shall cancel the channel;
• Type of Number (ISDN TON): Low level signalling options
– Outgoing number (onumplan): Unknown is the default, other options
are national, international and subscriber;
– Caller id (dnumplan): Unknown is the default, other options are na-
tional, international and subscriber;
– CPN (cpnnumplan): Unknown is the default, other options are national,
international and subscriber.
List of enable codecs

In this table are listed the codecs used in IPBrick and the preference order by
which they are chosen in communications. To add or remove codecs to the list, you
just have to follow the option Modify, select the codec and press the button add
() or remove () (Figure 7.64). In the same way, to change the order by which
the codecs are used, you should select the codec and clicking on the arrows on the
right of the list, making it going up or down in the list according the necessary
priority.
It is possible to select among the following codecs, knowing that the bandwidth
used for each one in a call is approximately:
15
Shared data area where voice packets can be collected, stored, and sent to the VoIP server
in evenly spaced intervals

Figure 7.63: Telephony - ISDN BRI options
• GSM: 13 Kbps;
• iLBC: 15 Kbps;
• Speex: Configurable 4-48 Kbps;
• G.726: 32 Kbps;
• LPC10: 2.5 Kbps (not recommended);
• G.711 ulaw: 64 Kbps;
• G.711 alaw: 64 Kbps, used in Europe;
• G.729: 8 Kbps. You may have to buy a license to make calls with this codec
at Digium website. If this codec is enabled a link called Licence Activation
will appear, so with a valid key a G729 licence will be generated. See Figure
7.65 and Figure 7.66.
Of course the bigger the required bandwidth, the smaller the number of possible
simultaneous calls. For each of the selected codec we can include an average of
more 15 Kbps of overhead.
IP PBX remote managers

This option allow other programs to connect to the asterisk, normally programs
running at LAN servers. Some examples: Mail plugin for calls generation, external
asterisk monitoring tools, call center for calls generation etc.
By default the IP PBX remote management is disabled. To enable click Modify

and next Insert IP PBX remote manager (Figure 7.67)
Configuration options:

7.6 Telephony 233
Figure 7.64: Telephony - Configurations - Codecs
Figure 7.65: Telephony - Configurations - Codecs with g729
• Login: Login to use;
• Password;
• Network: Network range or specific IP that will got access;
• Network mask;
An example is shown at Figure 7.68.
VoIP domain alias

The VoIP server can accept calls not only for the main domain but for different
ones as well. To add domains just click Modify and insert the domains one per
line. (Example at Figure 7.69).
Functions available for phones

Call transfer
Besides supporting the transference of calls made by the terminal equipment,
telephones SIP, PBX’s or softphones, IPBrick also makes transfers in any tele-
phone, even if it does not support transfers from origin. The two types of trans-
ference allowed by IPBrick are:

Figure 7.66: Telephony - Configurations - g729 licence
Figure 7.67: Telephony - IP PBX remote managers
• Assisted transfer: When receiving a call, the person receiving it dials an

extension, asks the person in that extension if he/she accepts the call or not,
Figure 7.68: Telephony - IP PBX remote managers - Configuration

7.6 Telephony 235
Figure 7.69: Telephony - VoIP domain alias
disconnects it and the call is transferred. To execute an assisted transference

during the call, it is necessary to dial * (by default) and the name of the
extension or alternative address. Example: To transfer a call into a telephone
registered as ipbrick1 which has as alternative address the 480 extension, dial
*480 during conversation.
• No-assisted transfer: when receiving a call, the person receiving it dials
an extension and the call is immediately transferred to that extension. To
execute a non-assisted transference during a call, dial # (by default) and
the name of the extension or alternative address. Example: Non-assisted
transference to the above telephone: #480.
To cancel a transference, you just have to dial again the number you have
dialled to transfer. Example: you wanted to transfer a call to extension 481
but you have dialled *482. To recapture the call you shall have to dial again
*482 and then it is possible to transfer to the correct number dialling *481.
Calls capture
To capture a call ringing in another extension, dial *8 followed by the name
with which the telephone was registered or the name of the group of telephones
ringing.
7.6.4 Interfaces
Interfaces represent trunks normally to non-IP world. I’ts possible to create
more interfaces than the default ones (PBX and PSTN) (Figure 7.70. Examples:
GSM ISDN or FAX’s interface. You can create them at:
Advanced Configurations - Telephony - Interfaces

Figure 7.70: Telephony - Interfaces
Menu to insert interfaces (Figure 7.71):
• Interface Name: When created, the interface will appear by that choosed
name at Local Routes and Telephony Cards port configuration;
• Interface Type: Represents the associated trunk:
– BRI PSTN: Represents the PSTN side using a ISDN BRI connection;
– BRI PBX: Represents the PBX side using a ISDN BRI connection;
– PRI PSTN: Represents the PSTN side using a ISDN PRI/E1 connec-
tion;
– PRI PBX: Represents the PBX side using a ISDN PRI/E1 connection;
– ANALOG PSTN: Represents the PSTN side using a ANALOG connec-
tion;
– ANALOG PBX: Represents the PBX side using a ANALOG connec-
tion;
– OCS: Represents the Microsoft Office Communications Server. That
interface will be used only for Local Routes (Figure 7.72). For that
interface type two extra fields are present:
∗ FQDN: OCS full qualified domain dame;
∗ Mediation Server IP: Mediation Server IP address;
• SIP Peering: The Open Peer option provides that any incoming call from the
Internet can use this interface. The Closed Peer option sets that only peers
defined in SIP Peers can use the interface(this is the best option connect to
PSTN or GSM). So peers are public IP’s authorized to use certain interface,
for instance a peer can be another IPBrick. They can be inserted at:
Advanced Configurations - Telephony - SIP Peers
• Receive gain: Receive gain in dB. Can be useful to increase it if we are

talking about the PSTN interface and at the IPBrick side we are listening
with low volume;
• Transmission gain: Transmission gain in dB. Can be useful to increase it
if we are talking about the PSTN interface and at the PSTN side they are
listening with low volume;

7.6 Telephony 237
This operation is necessary if you want to connect a FAX to a card port, a GSM
gateway or another additional interface. If there is a GSM gateway, you may add
here a GSM interface (as an interface name). Choose a card type (analogic, PRI or
BRI) in the Interface Type, and the Closed Peer option in the SIP Peering.
Figure 7.71: Telephony - Interface insertion
Figure 7.72: Telephony - OCS interface
7.6.5 SIP peers

You may add here IP addresses to let remote known gateways to use interfaces
defined as Closed Peers in IPBrick. For instance, you have two IPBrick’s connected
to each other through the Internet and one is connected to the PSTN. If you want
that remote IPBrick connects to PSTN interface, you need to add your IP to this
list by clicking on Modify. Example at Figure 7.73.
7.6.6 IAX peers

By clicking insert we define the IAX servers that are authorized to forward
the calls using that IPBrick. The IPBrick will accept inbound routes from other
servers that will be specified in that list. Example at Figure 7.74.

Figure 7.73: Telephony - SIP peers
Figure 7.74: Telephony - IAX Peers
7.6.7 Auto provisioning

Here is presented the full auto provisioning template list. The list shows the
template name, phone brand and model and the specific firmware version (Figure
7.75). We can manage existant templates clicking at the template name or clicking
Insert in the main menu to create a new template. The fiels are:
• Name: Name for the template. Usually is the complete phone brand and
model;
• Brand: Phone brand. Available: Aastra, Atcom, Grandstream, Snom and
Thomson;
• Model: Shows the supported models;
• Firmware version: Supported firmware for that choosed model;
• Configuration files: Here the idea is to insert the desired configuration file.
It’s possible to have various auto provisioning configurations for the same phone
model. So we can change only some configuration parameters like ringtone, LCD

7.6 Telephony 239
logo information, codecs etc. An example of a new template insertion is present at

Figure 7.77. A new list with some customized templates is shown at Figure 7.78
Figure 7.75: Auto provisioning - Template list
Necessary steps to use auto provisioning:
• If needed adjust the template for some specific configuration;
• Register a phone in IPBrick;
• Go to Advanced Configurations - Telephony - Registered Phones and

associate the desired template to a phone (Figure 7.76);
• Go to DHCP server and enable the option 66 (TFTP server) pointing the
IP to IPBrick;
• Get ready the SIP phone and connect it to the network (read next section)
Figure 7.76: Auto provisioning - Phone with a specific template
The LAN DHCP server must have the option 66 active and pointing to the IP-
Brick IP. That option represents the TFTP server that will be always the IPBrick

were the auto provisioning is configured, because all the supported phones will get
the configuration stored in IPBrick using the TFTP server IP passed by DHCP. If
the IPBrick is the DHCP server, the option TFTP server at Advanced Configurations
- Support services - DHCP - Subnets must point to the IPBrick IP. It’s impor-
tant too to check that the phone firmware is the same listed at auto provisioning
template list.
Figure 7.77: Auto provisioning - Insert a new configuration for a phone
Figure 7.78: Auto provisioning - Full template list with customized ones
Supported phones
Information about auto provisioning in all suported models: Atcom 530, Astra
6755i, Thomson ST2030, Grandstream GXP2000, Grandstream GXP2020, Grand-
stream GXP1200, Grandstream GXP2010, Grandstream GXP280, Grandstream
BT200 e Grandstream BT201

7.6 Telephony 241
Atcom 530
Because the auto provisioning parameters can’t be passed by DHCP in this
phone we need to do a inicial configuration at ATCOM phone web interface. The
complete steps are:
• If not a new phone reset the configurations by default;
• Go to phone web interface using the defined IP passed by DHCP;
• Go to menu Update - Auto Provisioning and configure that:
Server address: IPBrick IP

Username: -
Password: -
Config File Name: MAC_ADDRESS.cfg
Config Encrypt Key: -
Protocol Type: TFTP
Update Interval Time: 1 hour
Update Mode: after reboot
• Save config and reboot;
Other supported phones

Just connect the phone to the LAN. You just need to check that the DHCP
is active. If they are new the DHCP is active by default, if it’s a used phone
please change the network mode from static to DHCP or reset the configurations
by default.


Chapter 8
Apply Configurations
The option Apply Configurations is crucial in IPBrick. All configurations

done in IPBrick through the web interface, are saved in a Postgres database.
This way any changes the configuration will only be effective in the system after
clicking on Apply Configurations.
Most changes don’t make the IPBrick server go to reboot, so a screen like
Figure 8.2 will appear. IPBrick only needs to reboot in these cases:
• Network interfaces configuration;
• Domain name and server name configuration;
• Changes in authentication mode (LDAP).
And a screen like Figure 8.1 will show. It’s important to inform that IPBrick
will go to reboot, so the administration has the option to apply configurations in
that momment or at non work hours.
As we can see, we only need to change this type of configurations to get the
server in production at the costumer network. From the momment IPBrick is in
production, is becames very rare to go to a reboot because we don’t need to change
anymore of the network definitions, domain/server name and LDAP mode.
When applying configurations two extra options are presented:
• Description: Each time we apply configurations we can make a description

of what we did;
• Cancel all changes: Choosing that option, instead of Apply, will rollback
all configurations that were made. So IPBrick will stay with the settings
from the last time someone applied configurations, i.e. the last configura-
tion file that appears at Advanced Configurations - Disaster Recovery
- Configurations.

244 Apply Configurations
Figure 8.1: Apply Configurations and reboot
Figure 8.2: Apply Configurations

Chapter 9
Appendix A
Join in the domain
This section describes the process of:
• Configuring a workstation with DHCP;

• Joining a workstation in a domain.
This process description presupposes the following:
• the domain controlling server is IPBrick.I ;
• the DNS domain is empresa.pt;
• the domain is EMPRESA.
In order to join a workstation in a domain you need to take the following steps:
1. Know the MAC address of the machine’s network interface card;

2. Choose a machine ”name”;
3. Have a machine IP address;
4. Create an entry for the machine in IPBrick.I ;
5. Update IPBrick.I.
9.1 Windows XP Professional Workstation

⇒ Note: Before starting the process of joining a machine in a domain you
have to know the username/password of the administrator of the XP machine.
Then you can start the migration process.
Therefore you have to:

246 Appendix A - Join in the domain
1. Press [windows];
2. Select My Local Network ;
3. Select Network Connections;
4. Right click on the icon Local Network Connection and select Properties;
5. Choose TCP/IP in the open window and click on Properties;
6. Choose Get the IP Address Automatically in the open window and then
select Get the DNS server addresses automatically;
7. Close the network properties windows.
The next step is to confirm that the machine IP address is the same that was
introduced in IPBrick.I. Therefore you have to:
1. Press the keys [windows]+[R];
2. cmd [ENTER];
3. ipconfig /all;
4. Check the information in the IP Address field.
If the IP address is not the one introduced in IPBrick you have to release it
and renew it with the following commands:
1. Press [windows]+[R] keys simultaneously;
2. cmd [ENTER];
3. ipconfig /release;
4. ipconfig /renew;
5. ipconfig /all.
If the machine IP address is right you can join the machine in the domain
EMPRESA:
1. Press the keys [windows]+[pause] and open the System Properties;
2. Select ”Computer Name”, click on ”Change...” and give the computer a name
(the name must have been created in IPBrick.I before);
3. Press button ”more..” and add the dns machine domain: empresa.pt. Do
not select the option Change the primary DNS suffix when the association
to the domain is changed ;

9.1 Windows XP Professional Workstation 247
4. Insert EMPRESA in the domain. The password of the domain EM-

PRESA or of the machine administrator may be requested;
5. Click OK and close ”System Properties”;
6. Restart the machine. While the machine is starting you can already login
the domain EMPRESA.
⇒ Note: The workstation must not be with the DHCP. It can be configured
with a fix IP address. In this case you don’t have to fill in the field MAC Address
while you register the machine in IPBrick.

248 Appendix A - Join in the domain

Chapter 10
Appendix B
Configuring a VPN connection
In order to create a VPN (PPTP) connection in a Windows XP Professional

workstation you have to take the following steps:
1. Press [windows]
2. Select Control Panel
3. Double click Network Connections
4. In the window Network Connections, select Create a New Connection
5. The Wizard appears to create a new connection. Select ”Connect to my work

area network” (refers to the VPN description), ”Virtual Private Network
Connection”. After that select a name for the connection to be created, for
example ”Enterprise connection”. Then you have to indicate the IP address
or the full name by which IPBrick is known in the Internet. At last you have
to select who can use the VPN connection.
The VPN connection is configured. In order to establish a VPN you only have
to introduce the user name and password registered in IPBrick. IPBrick is now
working as a VPN-PPTP server.

250 Appendix B - Configuring a VPN connection

Chapter 11
Appendix C
Configuration of a VPN SSL
connection (Open VPN)
To create a VPN connection (Open VPN) in a Windows 2000/XP and higher

workstation it is necessary to install the Open VPN GUI software:
• Open VPN - VPN Open Source Pack;
• Open VPN GUI - The Graphic Interface for Open VPN.
The installation of this pack should be executed without changing the default
definitions. This software is installed in directory C:\Program Files\OpenVPN.
The certificate generated by IPBrick must be unpacked into directory C:\Program
Files\OpenVPN\config.
To start a VPN connection, press the right button on icon OpenVPN in the
toolbar, choose the intended connection and press Connect.
Insert the password used to create the certificate in IPBrick and the VPN shall
be established.
11.1 Two or more SSL certificates

When it is intended to put more than one certificate in the same workstation
(create VPN connections for distinct places) it is necessary to create a new folder
into directory C:\Program
Files\OpenVPN\config. Extract all the files to that new folder.
To initiate VPN connection, press the right button on icon OpenVPN in the
toolbar, choose in the list the connection and press Connect.

252Appendix C - Configuration of a VPN SSL connection (Open VPN)
11.2 Configuration of a SSL Connection for MS

Windows 2000/XP and higher
1. In http://openvpn.net/index.php/open-source/downloads.html down-
load the latest version of the Windows Installer file;
2. Install the openvpn;
3. Extract the IPBrick zip file to the config folder of OpenVPN. Example:
c:\Programas
\OpenVPN\config;
4. If you are using Windows Vista or 7, run the file, openvpn-gui.exe as

Administrator;
5. In the Windows Vista tray, click on the OpenVPN icon and connect;
NOTE: If it’s not working you need to modify the *.ovpn file in
c:\Programas\OpenVPN\config and add the following lines at the end:
route-method exe
route-delay 2

Chapter 12
Appendix D
Backup Service - Arkeia
Arkeia Light is a freeware backup service utility. At IPBrick 5.0 and higher,
Arkeia Light is not included. You’ll need to download it at the Related Software
section at IPBrick’s website:
http://www.ipbrick.com/index.php?oid=2347
Note: Arkeia Light is a very useful and simple backup utility tool, but our cos-
tumers are free to use, should they want it, a more robust and professional backup
service in their systems.
When selecting this option at IPBrickI - Backup - Arkeia, and after click-
ing the Open button, a session window by VNC is open. It is necessary to have
the JRE1 , which can be found at http://sun.java.com/ installed to execute the
connection. The authentication in this session is made with the IPBrick Admin-
istrator’s actual password. The Arkeia management interface is available after
validation.
In order to start the Arkeia configuration software it is necessary to submit
your validation by default:
login: root
password: (without password)
After the successful server connection the following menus are displayed (Figure
12.1):
• Backup: Sets, configures and launches Arkeia’s backup, including savepacks
• Restoration: Sets, configures and launches Arkeia’s restore function;
• Hardware: Sets and configures the hardware (drives, tapes, libraries) con-
nected to the server;
1
Java Runtime Environment

254 Appendix D - Backup Service - Arkeia
• Running jobs: Displays the executing processes;

• Administration: Functions to configure Arkeia;
• Logs: Displays the logs that are generated by Arkeia.
Figure 12.1: Backup - Arkeia - Main Menu
Arkeia menus are easy to use. When you access a menu, new sub-menus show
up with new options, successively. Every time you pick a menu, its icon appears
in an upper bar. To move back in these menus you only have to click in the cor-
responding icon.
To administrate Arkeia executing processes you have to select the Running

Jobs menu (Figure 12.2).
Select the request line that will have more priority to backup execution (Figure
12.3).
Inside this menu, you can see the backup processes. These processes can have
two status:
• The process is pending waiting for confirmation, i.e., you have to click OK.
The user is alerted to replace the tape;
• The jobs are waiting for the conclusion of the remaining processes.
Usually, if backup administration is normally processed, with the administra-
tor intervention in a daily basis, there will be only an execution process per day.
In the power failure case, all this processes are eliminated.

12.1 Advanced Administration 255
Figure 12.2: Backup - Arkeia - Running Jobs
Figure 12.3: Backup - Arkeia - Backups confirmation
12.1 Advanced Administration

• Add users (Administration Users (Figure 12.4))
Arkeia sends email messages reporting several occurrences, like the need to

Figure 12.4: Backup - Arkeia - Add Users
insert tapes, the details of a backup process, etc. You should create a user
that handles these messages (with an Administrator type role) to check if
the procedures are correctly done.
1. Insert:
(a) Name;
(b) Role;
(c) Email address.
• SavePacks (Backup Â SavePacks)

This is an essential feature of Arkeia technology. A savepack is a set o paths
and files that are included in the backup.
1. Create a SavePack (usually named Data);

2. Add directories that will be included in the backup (name of SavePack
Â Browse Trees) (Figure 12.5).
– /boot
– /etc
– /homeX (were 1 ≤ X ≤ number of homes)
– /opt/ipbox/backupDB
– /var/lib/ldap
– /var/lib/postgres

12.1 Advanced Administration 257
– /var/lib/postgres2
– /var/lib/samba
– sysinfo
Figure 12.5: Backup - Arkeia - Directories to save
• Configure the backups (Backup Â Periodic) (Figure 12.6)
1. Create a new Periodic Backup

2. Create 3 levels:
(a) Level 1 - Archive
(b) Level 2 - Weekly
(c) Level 3 - Daily
• For each backup select:

Level 1 Level 2 Level 3
SavePack
DrivePack
Pool Archive Weekly Daily
Type Total Backup Total Backup Incremental
Valid for 2 years 8 weeks 4 weeks
The available backup types are:
– Archive: Saves savepack data and keeps it indefinitely (requires addi-

tional license);

Figure 12.6: Backup - Arkeia - Levels
– Total: Saves all the savepack data and keeps them during the period
set in Valid For;
– Differencial: Only saves the files that were modified since the last
Total type backup;
– Incremental: This is the most complex backup type. It creates a list
with the modified files since last backup (both Total and Incremental)
and proceeds to do the backup of the files included in the list.

Chapter 13
Appendix E
High Availability
13.1 Introduction
Users want their systems to be ready at all times. Downtime (i.e.: periods of
time when your system is unavailable) affects your users, your customers, sales,
revenue, productivity, and just about every other aspect of your business.
High availability (HA) is a system design protocol that garantees an operational
continuity during a given period of time and is now a possibility at IPBrick, using
a service called Heartbeat. The main idea is to have a clustering solution with two
or more IPBricks that provides:
• Availability:
• Reliability;
• Serviceability.
Note: High Availability is available solely for VoIP and E-Mail relay services.
13.1.1 Advantages
The advantage of clustering servers for HA is seen if one node in the cluster
fails, another node can resume the task of the failed node, and users experience
no interruption of access.
The advantages of clustering servers for scalability include increased application
performance and a greater number of users that can be supported. You can imagine
a cluster of servers as a single computing resource. With the total redundancy of
multiple servers that will make the system work if other servers fail, the cluster
can help achieve greater system uptime (i.e.: periods of time when your system is
available).
Clustering can be implemented at different levels,
• Hardware

260 Appendix E - High availability
• Operating systems
• Systems management and applications.
• Middleware
The more layers, the more reliable, scalable and manageable the cluster is.
13.2 HA Requirements
The minimum requirements to run an HA service in IPBrick are;
• At least two IPBricks (they can be more, it all depends on the client’s de-
mands, needs and expectations)
• All IPBricks have to be installed with the same IPBrick software version;
• Two NICs per server.
You can see in Figure ?? a diagram of an IPBricks HA service.
13.3 HA Configuration
To set up a high availability solution with two IPBrick’s:
• Install the HA update from Advanced Configurations - IPBrick - Update;
• Choose a secondary master server. At that IPBrick, the authentication type

must be changed at Advanced Configurations - IPBrick
- Authentication to Secondary Master IPBrick;
• At primary master (IPBrick Master), go to Advanced Configurations - IPBrick

- Authentication set Yes at High availability and choose the HA mem-
bers;
• There are two different types of High Availability configuration:
– Active-Passive: It’s a failover solution and only one virtual IP address

will be used. Configuration: At the primary master insert a virtual IP
for HA. To do that go to Advanced Configurations, click at interface,
Insert and choose HA Private Interface;
– Active-Active: It’s a load balancing solution and two virtual IP ad-
dresses will be used, one on each server. Configuration:
• At the primary master insert a virtual IP for HA. To do that go to Advanced

Configurations, click at interface, Insert and choose HA Private Interface;
• At the secondary master insert a virtual IP for HA. To do that go to

Advanced Configurations, click at interface, Insert and choose HA Private Interface;

13.3 HA Configuration 261
Figure 13.1: HA Diagram
• In both servers at Advanced Configurations - System - Services en-

able the service Heartbeat and set HA at the wanted services;
• In both servers insert a general settings firewall rule at Advanced Configurations

- Network - Firewall,
– Rule: INPUT;
– Interface: lo;
– Protocol: ICMP;
– Policy: ACCEPT;
• In both servers Apply Configurations. The servers will reboot;
Note: The services (VoIP/E-Mail) must have exactly the same configuration
in both servers. To use the high availability an addicional licence is needed.

262 Appendix E - High availability

Chapter 14
Appendix F
UCoIP
All enterprise communications - Voice, Mail, Instant Messaging and Web - are
managed in an integrated way, (i.e. unified through a single individual or group
address). To reach this goal, IPBrick uses only Internet communications services
(SIP, SMTP/IMAP, XMPP and HTTP) integrating them with DNS and LDAP
support services.
The generic site is ucoip.domain.com but the idea is to have one site for each
LDAP user. The following options are included:
• A webphone for direct connection to the user SIP url;

• A SIP url link to call the user using a softphone previously installed at the
workstation;
• A web-based Jabber (XMPP) client to chat directly with the user;
• A SMTP link to mail the user using a email client at workstation;
Like we can see, for SIP/SMTP/XMPP the user will be reached using the single
address user@domain.com. Now we present all the necessary steps to configure a
UCoIP site for a specific LDAP user with username jsmith, with IPBrick FQDN
being ipbrick.domain.com:
• The user jsmith must go to https://myipbrick.domain.com and define a

phone (depending of the IPBrick.GT routes can be a SIP/PSTN/GSM num-
ber) at field SIP Address. Examples: 101@domain.com, 00351221121112,
00351963322212;
• Activate the IM service at IPBrick.C - IM;
• Go to IPBrick.C - Web Server, click at ucoip.domain.com and define the
alternative address jsmith.domain.com;
• At private/public domain DNS server add a record named jsmith, pointing
to that IPBrick server;

264 Appendix F - UCoIP
• Enter now the UCoIP site using http://jsmith.domain.com (Figure 14.1)
Figure 14.1: Web Server - UCoIP site
The UCoIP site design is simple but it can be improved. It’s possible to use
the site’s default FTP account for site management:
• username: ucoip
• password: uco1pp4ss
The integrated webphone by default call to the user SIP address, but it’s pos-
sible to call all internal SIP phones/funcionalities, by copying the webphone link
and paste it in a new browser tab.
Examples of url variable definition:
http://webphone.ipbrick.com/index2.php?user=jdomingues
http://webphone.ipbrick.com/index2.php?user=200
http://webphone.ipbrick.com/index2.php?user=IVR2

265
User Profile
To include a photo and profile at the user UCoIP site follow this steps:
• Save a photo with the format login.extension. The supported extensions

are .png, .jpg, .gif, .bmp. Example: jsmith.png;
• Access the server using the FTP account of UCoIP site and upload the file
to folder photos;
• Save a profile using html, with format login.html. Example: jsmith.html;
• Access the server using the FTP account of UCoIP site and upload the file
to folder descriptions

266 Appendix F - UCoIP

Chapter 15
Appendix G
MyIPBrick
The MyIPBrick site is available at IPBrick with URL https://myipbrick.domain.com

(Figure 15.1). This site is only used by the internal LDAP users, so they can change
personal settings, check the personal area and go to other internal websites (Figure
15.2).
Figure 15.1: Web Server - MyIPBrick site - Login
15.1 Personal Settings

User definitions:
• Name: User complete name. Can be changed;

268 Appendix G - MyIPBrick
Figure 15.2: Web Server - MyIPBrick site - Available options
• Login: User login. Not editable;
• UidNumber: It’s the User ID used by LDAP to identify users. Not editable;
• Quota: User general quota if defined. If not defined it will show Unlimited.
Not editable;
• Password: When clicking Modify at top, the user LDAP password can be
changed too;
VoIP settings:
• Phone Address: Phone associated to the user. Represents the phone num-
ber that the user is using at the moment. Multiple phone numbers can be
used: Internal SIP addresses (Ex.: 201, phone01), external SIP addresses
(Ex.: user22@sipserverx.com), PSTN number (Ex.: 00351221121334), GSM
number, etc. No matter where, the user will always be available, the person
who wants to call him, just needs to dial username@domain.com and the
selected phone will ring;
User mail settings:
• State: Shows if mail account is active or not. Not editable;
• Mail: User mail address. Not editable;
• Alternative address: Shows the user alternative mail addresses list. Not
editable;

15.2 Personal area 269
• Mail quota: User mail quota if defined. If not defined it will show Unlimited.
Not editable;
• Message maximum size: Message maximum size to receive, if defined. If not

defined it will show Unlimited. Not editable;
• Forward To: The user can define other email addresses. So when someone
send a mail to username@domain.com, the addresses defined here will receive
a copy too;
• Automatic reply message: If some message is defined, IPBrick will auto reply
with this message when someone send a mail to the useraccount. By default
of course no message is present.
The fields that are not editable, are only definedHeartBeat linux by the IPBrick
web interface. A configuration example is shown at Figure 15.3.
Figure 15.3: Web Server - MyIPBrick site - Change settings
15.2 Personal area

The Personal Area is where the user can manage his directory of folders and
files (Figure 15.4). If the user wants to remotely access its personal area to re-
trieve a file or access a folder he doesn’t need to establish a VPN connection
to the organization’s intranet server, because his personal area is available at

270 Appendix G - MyIPBrick
https://myipbrick.domain.com.
These are the options in the personal area index page:
• New folder: Create a new folder. Click OK, insert the folder name and click
Ok again;
• New file (upload): Upload a file. Click OK, insert the file you want and click
Ok again;
• Delete selected items: The selected items will be deleted, when Ok is clicked;
• Rename selected items: The selected items will be renamed. Click Ok, re-
name the items and click Ok again;
• Download this folder (zip): The entire folder will be downloaded in .zip
format. Just click Ok to download;
Folder operations:
• Enter a folder: Just click on folder name;
• Go one folder back: Click Ok on WindoHeartBeat linuxws Network (Up);
• Select a folder: Click on folder - left side.
Figure 15.4: Web Server - MyIPBrick site - Personal area

Chapter 16
Appendix H
Contacts
An organization cannot exist without relating to others. Managing your con-

tacts is something not to be taken lightly. That’s why IPBrick offers a way to
handle communications, in the business world, by offering a special web interface
dedicated to handle the management of your firm’s contacts.
16.1 Getting Started

The web interface can be accessed by visiting this URL;
http://contacts.domain.com/
NOTE: For security reasons there’s an access time limit of 30m. When it ex-
pires anyone accessing Contacts will be automatically Logged out.
The IPBrick Contacts web interface will be supervised by an admnistrator, he

will have total clearance to create and edit any contacts he sees fit and to manage
access permitions by creating user profiles.
After the login procedure (Figure 16.1), the index page (Figure 16.2), presents
a quick access alphabetical list (the ’1’ is to access Entities whose name starts
numerically or with a symbol) a filter and a Show All link.
The Rebuild Contacts link has the sole purpose of synchronizing data between
the database and the LDAP service.
Logout, obviously ends the session.
There’s also two buttons in the central area of the page;
• Definitions
• Entity Types

272 Appendix H - Contacts
Figure 16.1: Contacts login interface
Figure 16.2: Contacts index page
By clicking on Definitions the following options appear:
• Entities management
This is where the creation and editing of Entities is done.
An Entity is any given organization that is related to your business. It will

be the parent folder, so to speak, of an undetermined number of contacts.
NOTE: To create an Entity you must first create an Entity Type entry in
the Auxiliary Data page. This procedure is mandatory. You can’t create an

16.1 Getting Started 273
Entity if you don’t have a type to classify it with.
• Auxiliary Data
Selecting this option on the index page, displays a list of attributes (Figure
16.3) that will serve to characterize any given Entity.
Figure 16.3: Auxiliary Data Page
This step is crucial, you’ll have to create at least an entry in any of these
attributes if you wish them to be available when you are creating entities.
To do so just click on its name and fill the field that will appear (Figure
16.4), to save click on Insert.
Figure 16.4: Entity Types creation page
– Entity Types - The mandatory attribute, a type of Entity (e.g. Suppli-

ers, Clients,etc...).

– Categories - an under-level Entity type (e.g. CeBite 2001).

– Sub-Categories - Bear in mind that before creating a sub-category it’s
necessary to create a Category.
– Countries - Create a Country.
– States - Create a State.
– Provinces - Create a Province.
– Regions - Create a Region.
– Economic Activities Classification - Identifies Entity by its E.A.C. num-
ber and description.
– Associated Groups - Create an Associated Group (e.g. Consultant,
Press, Reseller, User, etc...).
– Additional Field - Any extra classification you wish to add.
– Groups of contacts - Creates a tag that identifies a group of contacts.
• Profiles Management This menu (Figure 16.5) manages the permissions granted
to users, it lets you edit or create new user profiles. By default there are three
basic non-editable profiles:
Figure 16.5: Profiles management page
– Admin - The Administrator has complete control. He can Read, Cre-

ate/Edit and Erase.
– Editor - He Can only Read and Create/Edit.
– Reader - Only has permission to Read.
To create a new user profile simply click on Insert, this page (Figure 16.6)
will appear.
– Input the Profile name.

– check the permissions you want to concede.
– click on Insert to save the new profile.

16.2 Creating an Entity 275
Figure 16.6: Profiles Management Insert Page
• Users Management
This is where you can select which of the LDAP users can also be Contacts
users (Figure 16.7), simply select the user and click the arrow button in
the direction of the IPBrick Contacts Users box. You can also click on the
button pointing to LDAP Users to remove a LDAP user from being able to
access the IPBrick’s Contacts management web interface.
The profile association link located under the Rebuild Contacts link serves
as a quick way to assign a certain user profile to the user in question.
• Close Session - Selecting this option ends the session.
16.2 Creating an Entity

To create an Entity you must first create at least one Entity Type entry in the
Auxiliary Data page.
This procedure is mandatory.
In the Entities Management page, click on Insert and please fill in these fol-
lowing fields:
• Entity Name.
• Tax Number.
• Address: The address added here will be available at the locations page.

Figure 16.7: Users Management Page
• Postal Code.
• Phone: Should you wish to add several numbers separate them by /
• Mobile Phone: Should you wish to add several numbers separate them by /
• Fax: Should you wish to add several numbers separate them by /
• Email.
• MSN Contact.
• Web: The URL of the Entity’s web page
• Company domain: The Entity’s Domain, (multiple domains separated by ;

).
• Birthday: Choose (/day / month / year/).
• BIN: Type in the Bank Identification Number of the Entity.
• Country: To choose a country you’ll have to create an entry in Auxiliary

Data.
• State: To choose a State you’ll have to create an entry in Auxiliary Data.
• Province: To choose a Province you’ll have to create an entry in Auxiliary

Data.

16.2 Creating an Entity 277
• Region: To choose a Region you’ll have to create an entry in Auxiliary Data.
• E.A.C.: To choose an EAC you’ll have to create an entry in Auxiliary Data.
• Associated Group: To choose an Associated Group you’ll have to create an

entry in Auxiliary Data.
• EXTRA: You’ll have to create an entry in Auxiliary Data (Under the name
Aditional Field ).
• IPBrick phone: Choose the Entity’s phone registered in the IPBrick server.
• Comments: Add any comments you’d like to make.
• Extra Field: Create an aditional field.

On the bottom of the page, These following boxes (Figure 16.8), show the
available Entity Types, Categories and Sub-Categories, you have pre-defined
in Auxiliary Data, they will serve to categorize the Entity you are creating.
Figure 16.8: Entities Management Association Boxes
• Available Entity Types - This box shows the available Entity Types that
were created in the Auxiliary Data Menu. You have to choose the Type of
Entity you want by clicking on it, after which you should click on the arrow
pointing in the direction of the Entity Types box.
• Entity Types - This box shows the Type of Entity selected from the list of
available types, you can also remove a type by selecting it and clicking on
the arrow pointing to the Available Entities Types box.

• Available Categories - This box shows the available Categories that were
created in the Auxiliary Data Menu, you have to choose the category you
want and click on the arrow pointing in the direction of the Categories box.
• Categories - This box shows the Category selected from the list of Available
Categories. You can also remove a Category by selecting it and clicking on
the arrow pointing to the Available Categories box.
• Available Sub-Categories - This box shows the available Sub-Categories that

were created in the Auxiliary Data Menu, you have to choose the Sub-
Category you want and click on the arrow pointing in the direction of the
Sub-Categories box.
• Sub-Categories - This box shows the Sub-Category selected from the list of
Available Sub-Categories.
Click on Insert to save.
After creating an Entity you can check if all the data inserted is correctly and
,if not, just click on Modify or Delete if you wish to erase the entry.
16.3 Creating a Contact

Now that an Entity as been created you can add contacts to it.
If you return to the Entities Management page (Figure 16.9), the name of the
Entity you have just created is now visible.
Figure 16.9: Entities Management page with a created Entity
If you click on the name of the Entity, a new page will appear (Figure 16.10).
• Click on the Contacts Link.
• Click on Insert Contact.

16.3 Creating a Contact 279
Figure 16.10: Entity details page
Please fill in these fields:
• Entity Name: (obviously non-editable).
• Location: Choose the contact’s location, from the list of available options.
• Contact: The contact’s name.
• Tax Number.
• Address.
• Postal Code.
• Phone: If you want to add several numbers please separate them by /
• Mobile Phone: If you want to add several numbers please separate them by
/
• Fax: If you want to add several numbers please separate them by /
• Email.
• MSN Contact.
• Web: The contact’s personal webpage.
• BIN: Type in the Bank Identification Number of the Entity.
• Birthday: Please insert the contact’s birthday (day/month/year).
• Presentation: fill in with what you need to show so that it can be considered.
• Post: His position in the Entity’s hierarchy.
• Country: To choose a country you’ll have to create an entry in Auxiliary

Data.

• State: To choose a State you’ll have to create an entry in Auxiliary Data.
• Province: To choose a Province you’ll have to create an entry in Auxiliary

Data.
• Region: To choose a Region you’ll have to create an entry in Auxiliary Data.
• Group: To choose an Associated Group you’ll have to create an entry in

Auxiliary Data.
• IPBrick phone: Choose the contact’s IPBrick phone registered in the IPBrick
server.
• Comments: Add any Comments you’d like.
• Extra Field: Adds an extra field.
To save, click on Insert.
After creating a contact you can verify if all the data inserted is accurate. If
not, click on Modify or Delete if you wish to erase the entry.
Return to the Entities management page by clicking on the Entities Manage-

ment link situated on the left corner.
- Click on the desired Entity.
If you wish you can Modify, Remove or add Contacts to the Entity by simply
clicking on the corresponding link located in the top right corner of the screen.

IPBrick Manual - Referencia - ENV5.2

Uploaded by

Copyright:

Available Formats

IPBrick Manual - Referencia - ENV5.2

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IPBrick Manual - Referencia - ENV5.2

Uploaded by

Copyright:

Available Formats

IPBrick

Reference Guide - Version 5.2 iPortalMais - 2010

1 Aim of this document 15

iPortalMais - 2010 Reference Guide - Version 5.2

Reference Guide - Version 5.2 iPortalMais - 2010

7 Advanced Configurations 171

8 Apply Configurations 243

9 Appendix A - Join in the domain 245

10 Appendix B - Configuring a VPN connection 249

iPortalMais - 2010 Reference Guide - Version 5.2

11 Appendix C - Configuration of a VPN SSL connection (Open

12 Appendix D - Backup Service - Arkeia 253

13 Appendix E - High availability 259

14 Appendix F - UCoIP 263

15 Appendix G - MyIPBrick 267

16 Appendix H - Contacts 271

Reference Guide - Version 5.2 iPortalMais - 2010

2.1 IPBrick login interface . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.1 Machine Groups - List . . . . . . . . . . . . . . . . . . . . . . . . . 22

iPortalMais - 2010 Reference Guide - Version 5.2

3.35 E-Mail - Definitions - Valid internal recipients . . . . . . . . . . . . 52

4.1 Firewall - Available Services . . . . . . . . . . . . . . . . . . . . . . 82

Reference Guide - Version 5.2 iPortalMais - 2010

4.9 Proxy - Destination groups . . . . . . . . . . . . . . . . . . . . . . . 89

iPortalMais - 2010 Reference Guide - Version 5.2

4.55 VoIP - Attendance sequences list . . . . . . . . . . . . . . . . . . . 131

5.1 Fax Server - Configure . . . . . . . . . . . . . . . . . . . . . . . . . 161

Reference Guide - Version 5.2 iPortalMais - 2010

5.8 Fax Server - Current Faxes . . . . . . . . . . . . . . . . . . . . . . . 168

7.1 Advanced Configurations - Definitions . . . . . . . . . . . . . . . . 174

iPortalMais - 2010 Reference Guide - Version 5.2

7.45 System - System users . . . . . . . . . . . . . . . . . . . . . . . . . 217

8.1 Apply Configurations and reboot . . . . . . . . . . . . . . . . . . . 244

12.1 Backup - Arkeia - Main Menu . . . . . . . . . . . . . . . . . . . . . 254

13.1 HA Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

Reference Guide - Version 5.2 iPortalMais - 2010

14.1 Web Server - UCoIP site . . . . . . . . . . . . . . . . . . . . . . . . 264

15.1 Web Server - MyIPBrick site - Login . . . . . . . . . . . . . . . . . 267

16.1 Contacts login interface . . . . . . . . . . . . . . . . . . . . . . . . . 272

iPortalMais - 2010 Reference Guide - Version 5.2

Reference Guide - Version 5.2 iPortalMais - 2010

Aim of this document

• Process of joining a workstation (MS Windows) to a domain;

• Procedures for the establishment of a virtual private network (VPN) PPTP

iPortalMais - 2010 Reference Guide - Version 5.2

Reference Guide - Version 5.2 iPortalMais - 2010

IPBrick is a complete integrated server system based on a Linux distribution.

Figure 2.1: IPBrick login interface

iPortalMais - 2010 Reference Guide - Version 5.2

For more information about installing IPBrick and configuring a workstation,

• IPBrick.I : For the configuration of specific Intranet services;

• IPBrick.C : For the configuration of specific Communication services outside

• IPBrick.GT : Permits an easy way to configure the services normally active

• IPBrick.KAV : Permits an easy way to configure the services normally active

All configurations done by the IPBrick administrator are stored in a Post-

• Advanced Configurations  IPBrick  Definitions;

• Advanced Configurations  IPBrick  Authentication;

• Advanced Configurations  System  Date and Hour  Time zone;

causes a restart of IPBrick (IPBrick needs approximately 1 minute to restart,

• Advanced Configurations IPBrick Definitions;

• Advanced Configurations IPBrick Authentication;

• Advanced Configurations System Date and Hour Time zone;