Ghost calls from 1000@public_IP_address to my remote phone

[Marbled (Nicolas Riendeau)]

Hi!

@avayax

I have been receiving ghost calls to one of my remote phones, which connects to my PBX over openvpn.

So it doesn’t access port 5060 or has it opened through/from the Internet?

@avayax

SIP port 5060 is open, but whitelisted to only allow traffic from my SIP provider IP addresses

What firewall (or firewalls) are you using?

@avayax

The logs on the phone show something like this:
Call from
[email protected]
[email protected]
[email protected]
[email protected]

I haven’t found anything in the Asterisk logs referencing those IP addresses.
Are those calls touching the FBPX server at all?

It sounds like they are directly contacting your phone…

There’s one thing I don’t get here, it sounds like the phone is directly accessing port 5060 (and opening a hole back to it in the firewall) but isn’t it supposed to access your PBX through OpenVPN so why should it do that?

@avayax

Is it the firewall in front of the remote phone that’s the problem?

Sounds like you have the same problem that is described here:

Phantom Phone Ringing

We have seen the same behavior with a home users remote phone. We have determined also that the calls are coming in thru the users firewall as described. When the phone communicates to the outside the cheap firewall is opening 5060 to the outside and allowing any traffic back in rather than limiting the traffic to only from the single destination.

(Crappy firewalls which open holes back to them when they access an outside server without restricting the traffic to only the IP of the server they contacted…)

@avayax

Sure the incentive is toll fraud, but what information are those calls trying to gather?

They probably don’t know that they are accessing a phone and are simply trying to do toll fraud…

Good luck and have a nice day!

Nick