DrayTek UK Users' Community Forum

Help, Advice and Solutions from DrayTek Users

How to disable onboard VoIP Ports on Vigor 2820VN

More
16 Nov 2011 13:09 #7 by zxdgkjzdhfj
Replied by zxdgkjzdhfj on topic Re: How to disable onboard VoIP Ports on Vigor 2820VN
Well I don't know what happened there but I've got the Gigaset back with a hard reset.

I'm on the old ISP router again until I feel confident I know what I'm doing.

Incidentally, since we have a couple of Gigaset users here, has anyone been able to configure a Draytel network mailbox to signal to the Gigaset that there's a new message so it appears in the messages list on the handset? The best I've achieved is to dedicate a unique email address to the mailbox and set up that email on the Gigaset. However the polling interval creates a delay and although you are alerted to new messages you can't hear them from the phone.

Please Log in or Create an account to join the conversation.

  • briain
  • User
  • User
More
16 Nov 2011 17:16 #8 by briain
Replied by briain on topic Re: How to disable onboard VoIP Ports on Vigor 2820VN

zxdgkjzdhfj wrote: Many thanks for that. I'm trying it now but the Gigaset has stopped displaying certain configuration pages. I set it to static IP so that the open port stays is fixed and I changed the Draytel account to use 5062 under Telephony Connections. Oddly now I can log into the Gigaset web interface and display most of the configuration pages but the Telephony Connections page just hangs. The page outline is there with the left hand menu but the configuration options in the body no longer appear. I might be doing a factory reset soon.

In principle though, if I don't want to use the POTS ports on the router is it still necessary to change the port and if so why?

@neptune, thanks. If your suggestion is different would you mind posting them here so future readers can benefit?



Hi

It probably should be okay on 5060 as you aren't using the inbuilt SIP feature. The only reason I suggested changing it is in case the inbuilt SIP feature had some 'hidden' code which is linked to the expected use of 5060. I'd very much doubt that, so it should be totally okay to use 5060 and open up the port to that. If you do get any odd problems, you can then try changing the Gigaset to 5062 and opening that one up instead.

To open the port for 5060, go to 'NAT' then 'Open Ports' then click on the first unused number (likely 1) to build a rule, then set it as below:

Comment: VoIP Port
WAN Interface: WAN1
Local Computer: (the IP address of your Gigaset)
Protocol: TCP
Start Port: 5060
End Port: 5060

Bri

Please Log in or Create an account to join the conversation.

  • nealuk
  • User
  • User
More
16 Nov 2011 19:06 #9 by nealuk
Replied by nealuk on topic Re: How to disable onboard VoIP Ports on Vigor 2820VN
A lot of NAT and VoIP registrations have been fixed with the latest 3.3.7 firmware. Also, for security, I'd suggest not using the default 5060 port, as there is quite a bit of probing directed at this port from the darker side of the net. Regards, Neal

Please Log in or Create an account to join the conversation.

  • briain
  • User
  • User
More
16 Nov 2011 19:48 #10 by briain
Replied by briain on topic Re: How to disable onboard VoIP Ports on Vigor 2820VN

nealuk wrote: Also, for security, I'd suggest not using the default 5060 port, as there is quite a bit of probing directed at this port from the darker side of the net



Hi Neal

Yes, the daily registration failures seem to have been resolved in my WIP310 (though I've only had 3.3.7 running for a couple of days; time will tell). I've also noticed another very nice improvement; 20% of the public DNS servers used to be shown as unreliable when using a benchmarking tool (from GRC) with FW 3.3.5.2; this looks to have been totally resolved* in 3.3.7.

I see that with the 2820Vn and with its built in SIP feature enabled, using shields up (http://www.grc.com) shows 5060 as closed and in 'stealthy' mode (just in case anyone is wondering). Getting back to 'external' VoIP phones (ie not referring to using the 'built in' Draytek SIP feature) that's an Interesting suggestion about avoiding 5060 for a VoIP phone, but I was thinking, since the rule of thumb is to use 5060 then 5062, then 5064, etc, etc, for multi phone systems, wouldn't these will all be pretty heavily targeted, anyway? I guess that since most single phone VoIP systems will just be left on that default setting of using port 5060, it'll by far be the most frequently hammered port; is that your thinking behind the suggestion to avoid using it?

Bri

*Oops; no pun intended! :roll:

Please Log in or Create an account to join the conversation.

  • nealuk
  • User
  • User
More
17 Nov 2011 12:21 #11 by nealuk
Replied by nealuk on topic Re: How to disable onboard VoIP Ports on Vigor 2820VN

Briain wrote: ...that's an Interesting suggestion about avoiding 5060 for a VoIP phone, but I was thinking, since the rule of thumb is to use 5060 then 5062, then 5064, etc, etc, for multi phone systems, wouldn't these will all be pretty heavily targeted, anyway? I guess that since most single phone VoIP systems will just be left on that default setting of using port 5060, it'll by far be the most frequently hammered port; is that your thinking behind the suggestion to avoid using it?...


Hi Brian, I get quite a lot of unexpected incomings at my home [non draytek setup] to port 5060 - and nothing to my next voip service on port 5062.
Yes, I guess it would seem logical that if there is an answer on 5060, then there could be a "multi handset environment" behind, and a probe of 5062, 5064 etc. would prove this.
You are quite correct - my thinking is, that if there is no answer on 5060, it probably isn't worth checking 5062, 5064 etc, as you could assume no VoIP on the LAN. I'm pleased you're seeing improvements with 3.3.7 Best regards

Please Log in or Create an account to join the conversation.

  • briain
  • User
  • User
More
17 Nov 2011 13:39 #12 by briain
Replied by briain on topic Re: How to disable onboard VoIP Ports on Vigor 2820VN
Hi

That's very interesting to know; after reading your post, I was tempted to move the Draytek's 'internal' one to 5062 and my Cisco phone to 5064, but I've just checked and 5060 currently looks to be completely closed to both solicited and unsolicited TCP packets (whereas 5062 - which I have purposely opened - shows as responding to solicited packets but closed to unsolicited packets), so it looks like Draytek have been very crafty in designing the system and thus that there would be little point in changing it (since any probes won't see 5060 as being in use with it set up the way I have it now). I'll look forward to debating all this - in the pub - with a computer scientist friend I know (in case I'm unaware of any other subtle benefits of doing so); it's a very good excuse to go and drink some beer as well!

Bri :)

Please Log in or Create an account to join the conversation.