Unknown traffic - Firewall Settings?

[Geloso]

Hi there, kinda new this but had done some work. I managed to setup the pbx but not sure about the firewall. Not my area.
At this moment I have a trunk with and inbound route. I have 2 extension and nothing else setup.
The Inbound route is pointed to the extension (100) and the extension has the Follow Me on and directed directly to my cell phone. There is no hard nor soft phone attached to the extension.
Basically I’m testing and have an external number pointed to my cell number through the PBX.

Here is what I don’t get.

Just restarted the PBX after a couple of hours off.
No call made nor received.
The CRD reports shows activity and I can’t understand why. Can anyone illuminate me on this?
Eager to learn,
Thanks

This is the result shown when I click the entry id at the crd report. and BTW this PBX is hosted in a hosting company (Vultr), a friend of mine is running a PBX for a company and works great.
The hosting account has no firewall at all, so the IP is exposed to the Internet.

2017-03-28 13:49:48 CHAN_START 507 507 DEFAULT 01119123245080 from-sip-external SIP/“EXTERNAL PBX IP”-00000000
2017-03-28 13:49:48 ANSWER 507 507 507 01119123245080 DEFAULT s from-trunk Answer SIP/“EXTERNAL PBX IP”-00000000
2017-03-28 13:50:05 HANGUP 507 507 507 01119123245080 DEFAULT h from-trunk SIP/“EXTERNAL PBX IP”-00000000
2017-03-28 13:50:05 CHAN_END 507 507 507 01119123245080 DEFAULT h from-trunk SIP/“EXTERNAL PBX IP”-00000000
2017-03-28 13:50:05 LINKEDID_END 507 507 507 01119123245080 DEFAULT h from-trunk SIP/“EXTERNAL PBX IP”-00000000

[cynjut (Dave Burgess)]

Who do you know in Brunswick, Georgia?
Did you leave “Allow anonymous SIP clients” turned on?
Did you leave “Allow SIP Guests” turned on?

[Geloso]

@cynjut

Allow SIP Guests

Hi Dave, that would be No I don’t know someone in Brunswick, and both of them are set to YES.
I don’t quite understand what is going on though.

[cynjut (Dave Burgess)]

If you allow anonymous connections or guests onto your system, people can connect to your system and place calls to anyone or anywhere in the world on your dime.

You probably want to turn those two features off.

[Geloso]

Thank you Dave, I did that yesterday thanks to your warning and the traffic stopped.

I was in the thinking that the firewall would take care of that. I guess I need to learn a lot.

Is there a link you can send me to understand those security rules? I understand that would be a big area to search and learn but a starting point will help.

Thanks a lot,

[Marbled (Nicolas Riendeau)]

Hi!

@Geloso

I was in the thinking that the firewall would take care of that. I guess I need to learn a lot.

You might want to take a look at this thread and especially this post:

Phantom Phone Ringing

We have seen the same behavior with a home users remote phone. We have determined also that the calls are coming in thru the users firewall as described. When the phone communicates to the outside the cheap firewall is opening 5060 to the outside and allowing any traffic back in rather than limiting the traffic to only from the single destination.

You might be a victim of those less than protective firewalls…

Good luck and have a nice day!

Nick

[cynjut (Dave Burgess)]

@Geloso

I was in the thinking that the firewall would take care of that. I guess I need to learn a lot.

There are two firewall components. The first is the “Integrated” firewall. That’s the one that sets up your basic trusted and untrusted networks, opens ports, etc.

The second it the “Adaptive” firewall. That’s the one that accepts calls from SIP/PJSIP/IAX2 phones and watches to see if they succeed. If they fail and the performance thresholds for “blocking” are reached, the callers are blocked. If you allow anonymous and guest callers, though, the calls succeed. This means that the only heuristic the Adaptive firewall has (failure) is not met and the firewall does as instructed and ignores the call.