Firewall Not Blocking inbound SIP Traffic

[Mike S]

I have an RT-AC68U router running Asuswrt Merlin running 384.18. I have the firewall enabled. I have a SIP VOIP phone connected to the router on my LAN. Today, I started getting a tone of ghost calls on the phone. I turned on the packet trace and discovered lots of inbound SIP traffic from a 198.23.xx.xx network addressed to the phone on my LAN.

How can this happen? I don't have any Port Forwarding configured.

 

[bits]

I have an RT-AC68U router running Asuswrt Merlin running 384.18. I have the firewall enabled. I have a SIP VOIP phone connected to the router on my LAN. Today, I started getting a tone of ghost calls on the phone. I turned on the packet trace and discovered lots of inbound SIP traffic from a 198.23.xx.xx network addressed to the phone on my LAN.

How can this happen? I don't have any Port Forwarding configured.

Upnp created a port forward?

 

[ColinTaylor]

How can this happen? I don't have any Port Forwarding configured.

Check WAN > NAT Passthrough > SIP Passthrough

 

[OzarkEdge]

I have an RT-AC68U router running Asuswrt Merlin running 384.18. I have the firewall enabled. I have a SIP VOIP phone connected to the router on my LAN. Today, I started getting a tone of ghost calls on the phone. I turned on the packet trace and discovered lots of inbound SIP traffic from a 198.23.xx.xx network addressed to the phone on my LAN.

How can this happen? I don't have any Port Forwarding configured.

It's not a router firewall issue... it's your phone willing to talk to whoever calls.

Check your phone's SIP account configuration for settings to reject anonymous SIP calls such as:
AcceptSipFromRegistrarOnly = enabled
EnforceRequestUserID = enabled
Check SIP User ID for Incoming INVITE = yes
Accept Incoming SIP from Proxy Only = yes
Authenticate Incoming INVITE = yes

Basically, you want to only accept SIP connections from your SIP service provider.

Also, set your phone's SIP account configuration to use a local user agent port other than 5060, such as 65061 to hide from SIP scanners... security by obscurity. If you have more than one SIP account registered on the phone, make the next port 65062, etc.

Do disable router WAN\NAT Passthrough\SIP Passthrough. These SIP helpers have caused issues like one-way audio on calls.

OE