0

Missing audio due to S50 firewall...

Jeff Justice

January 30, 2019 21:23

None

Follow

Our firewall contains all of the IP's/domain names of our customer's.  No one else is allowed to connect to the pbx.

Since the firewall is now correctly only letting our customer connect, the issue has become that audio is missing from one side.

Turning off the firewall makes the problem go away, so it's definitely a firewall issue.

My question is, WHAT is being blocked and why?

Customer phones are able to connect remotely, they can generally perform dialing functions, they just can't hear one side of the conversation.

• Facebook
• Twitter
• LinkedIn

5 comments

• 0
  
  Larry Neblett January 30, 2019 23:11

  what make and model?

  Did you port forward to include the RTP range?

  If there is a sip alg in the device, is it disabled?

  Does it only occur on remote phones?

  Are you using a sip provider and are they on-premise with the PBX using a eSBC or ISR, or external? If external, is there an issue with on-premise phones making calls?

   

   

• 0
  
  Jeff Justice January 30, 2019 23:14

  The fix for this was to create a firewall rule for 0.0.0.0/0.0.0.0 ports 10000:20000.

  This wouldn't have been my first choice to basically open up the whole box to the internet just to allow RTP traffic.

• 0
  
  Graham Aker January 31, 2019 05:44

  If only add the SDP connection IP address of the SIP trunk, such as x.x.x.x/255.255.255.0 ports 10000:20000, does it work? (SDP address which used for audio connection) You may find the IP address via the analyze of wireshark.

  Make a test call and capture the dump  https://support.yeastar.com/hc/en-us/articles/360007739473-How-to-Get-PCAP-Dump-Capture

   Then find the SDP address in the dump you got

  https://support.yeastar.com/hc/en-us/articles/360007606533-How-to-Analyze-SIP-Calls-in-Wireshark

• 0
  
  Riddhe M January 31, 2019 06:01

  As Graham's comment. The SIP trunk provider might have a different IP address than the SIP registration IP address.

   

• 0
  
  Larry Neblett January 31, 2019 13:11

  You can make the RTP range smaller as the default is just that and more than what is needed for the S50. Two ports are required for each call. I am not sure, but I think the S50 minimum range is 250 ports. 

  The reality is the RTP ports present a much lesser risk as:

  1. The ports are forwarded to the only device (PBX) that can utilize same. 

  2. RTP ports are not in and of themselves interactive. They are only active when a call setup is established via SIP messaging and bound to the session created by same. A port scan will evoke no response which will then cause it to appear as closed. 

  3. It is great that you are able to filter the IP at the SIP level using the firewall, just be certain to "drop" any requests seen from non-approved IPs as otherwise; the router will reject the packet which causes the router to inform the sender of same, which effectively lets them know they have found something which may cause them to increase their efforts. A drop simply ignores the packet with no corresponding notification to the sender of such. 

   

  You can check ports if you like with:

  https://portscanner.standingtech.com/