Adding a custom port to the firewall

[hboetes (Han Boetes)]

Since it’s very well hidden, and I found some odd things along the road, looking on how to do it. See if you can find it with these docs:
https://wiki.freepbx.org/display/FPG/Firewall+Custom+Rules
Or this tip:

Firewall blocks SCCP/Skinny Protocol traffic

For documentation purposes mostly, I was reminding that it is important to open port 2000 through the local zone if you are running the base Asterisk Skinny protocol module or the more complete Chan-SCCP-B module. Both systems use port 2000 to communicate with the server. Since the basic setting in the firewall module is to block any unknown ports, it gets blocked. If it gets blocked, the phones can’t register and you spend the whole afternoon trying to figure out what you could have possibly s…

OK, the trick is: Go to connectivity → firewall and then on the right side of the window there the a special button:
Click it and select services. Now I assumed that since CHAN_SIP is there port 2000 would be open, so I ran /sbin/iptables-save|grep 2000 and noticed it wasn’t there.
So I went to custom services, and added SCCP, port 2000, tcp and udp, on the local interface, and pressed save and then pressed save:

And after that checking the firewall rules resulted in:

root@asterix ~ # iptables-save | grep '2000 '
-A fpbxsvc-d7956cbbf9874dc7 -p tcp -m tcp --dport 2000 -j ACCEPT
-A fpbxsvc-d7956cbbf9874dc7 -p udp -m udp --dport 2000 -j ACCEPT

And now sccp works on the local interface.