maziloFrom Mazilo
Premium Member
join:2002-05-30
Lilburn, GA |
to homer01
Re: [Equipment] SIP Ghost Callssaid by homer01:... i have been getting ramdom 1-2-3 or 4 digit calls. About a month back ago, I built and/or compiled my own OpenWRT with FreeSWITCH (FS) to update my outdated PBX System hosted on a Seagate DockStar and ran into this similar problem, too. The calls appeared to have randomly come from other extensions. So, I took my FS offline and tested it on a NAT/Firewall router without an Internet connection. The behavior persisted even without any SIP accounts. Just to be sure on the safe side, I reformatted my SD card to install the same OpenWRT with FreeSWITCH sans any SIP accounts and ended up with the same problem. Then, I rebuilt my OpenWRT with FreeSWITCH a few weeks later on and now my PBX System doesn't have this problem any more. FYI, my builds of FS is always to the current git trunk. So, perhaps the problem was caused by some quirks introduced by FS at the time. |
|
MangoUse DMZ and you get a kick in the dick.
Premium Member
join:2008-12-25
www.toao.net |
Mango
Premium Member
2015-Feb-19 2:55 pm
Does the Panasonic TDE100 run FreeSWITCH? If not, it is highly highly improbable that the OP has the same issue. said by homer01:If i remove 5060 from the fwding, [...] the ghost calls stop immediately |
|
1 recommendation |
so far and in the last 4 hours, the phone system has been working fine, no ghosts calls at all.
what i did was enabling this :NAT - Keep Alive Packet Sending Ability: Enable
I will give an update tomorrow about this. If it works i will be very gratefull to you guys. You have helped me more in the past 24hours than the pbx provider in the last 3 years.. Or Allstream for that matter |
|
| homer01 |
argh, didnt work.
I left my pc on to monitor the calls, and they started again right after midnight, but with different numbers this time |
|
MangoUse DMZ and you get a kick in the dick.
Premium Member
join:2008-12-25
www.toao.net |
Mango
Premium Member
2015-Feb-20 9:24 am
This means that your firewall is insecure.
On your router's configuration, navigate to Firewall >> General. Double check that Firewall and SPI are both enabled, and SIP ALG is disabled.
If that causes any new symptoms, change the settings back one at a time to see which one caused the problem.
If what I suggested does not help, the next step is Stewart's suggestion of trying port 35060. This won't make your PBX unscanable, but it will make it harder for the scanners to find you. |
|
| |
Firewall and spi were already enabled.
SIP alg is disabled as well |
|
| |
to homer01
said by homer01:but since the day i did a sip line test(back in mid December of 2014) that i have been getting ramdom 1-2-3 or 4 digit calls What's a SIP line test? OE |
|
 brg
Premium Member
join:2001-01-03
Chicago, IL |
brg to Mango
Premium Member
2015-Feb-20 10:21 am
to Mango
said by Mango:You can use the tool at »sipscanner.voicefraud.com/ to test your firewall. Let us know the results, as well as the details of your port forwarding as graysonf asked, and we'll go from there. As an aside, I'm always annoyed when a vendor insists on getting an email address from me to "send me the results." These guys say they "hate spam as much as (I) do." I doubt it. And the only reason they could have for requesting my email address is to spam me. They could just as easily provide the results during the web dialog. Sure, I could cobble-together a temp address, but that takes time. |
|
MangoUse DMZ and you get a kick in the dick.
Premium Member
join:2008-12-25
www.toao.net
1 recommendation |
Mango
Premium Member
2015-Feb-20 10:32 am
I use a unique address for everything I sign up for, and so far have not received spam from them. Of course, even if they're honest, any database could theoretically be hacked and stolen. |
|
|
1 recommendation |
to homer01
said by homer01:argh, didnt work.
I left my pc on to monitor the calls, and they started again right after midnight, but with different numbers this time Before trying other options, confirm that when you turned on Keep Alive Packet Sending Ability, you also removed the forwarding of port 5060. |
|
brg
Premium Member
join:2001-01-03
Chicago, IL |
brg to Mango
Premium Member
2015-Feb-20 10:52 am
to Mango
said by Mango:[1] I use a unique address for everything I sign up for
[2] so far have not received spam from them.
[3] Of course, even if they're honest, any database could theoretically be hacked and stolen. [1] Me too, but that gets cumbersome. [2] Excellent. In reviewing the site it seems to be a small, possibly one-or-a-few-person operation. Kudos tto them if they don't attempt to monetize their email list. [3] As always... |
|
| |
to Stewart
did not try this combo. i will now and reply with results
EDIT, tried this but start getting busy signal when calling in, so added back the fwd |
|
| |
to homer01
Did you have NAT - Keep Alive Packet Type set to Blank UDP? If not, try that (with forwarding of port 5060 turned off). Otherwise, try the next option. |
|
| |
homer01
Member
2015-Feb-20 12:11 pm
yes it is set to blank udp |
|
| |
Stewart
Member
2015-Feb-20 12:17 pm
said by homer01:yes it is set to blank udp I'm quite puzzled. Perhaps the router's UDP timeout is really short -- try setting NAT - Keep Alive Packet Sending Interval to 25 (seconds). If no luck, try setting SIP Client Port Number to 35060 as described earlier. If still no luck, we may have to capture some traffic to see what is actually going wrong. |
|
| |
homer01
Member
2015-Feb-20 12:28 pm
interval was set to 20secs |
|
| homer01 |
to Stewart
I have tried setting the fwd for port 35060 only(instead of a range) and disabling fwd for port 5060. So far, no ghost calls and phone service seems fine, i tried 3 simultaneous calls from 3 cell phones and and 3 went through fine, which didnt happen when just removing fwd to 5060.
I will keep you posted about that solution |
|
homer01
1 recommendation |
It has now been 3 days, and no sign of ghost calls. I do really appreciate your help in getting this sorted out. Kudos to you all, specially Stewart and Mango. |
|
