Home » Forums » Community Edition » Open Discussion

To open or not to open? That is the question

bravonoj
Posts: 213
 Member Since:
2007-11-20
Submitted by bravonoj on Wed, 01/20/2010 - 10:14am.

I have recently switched from Broadvoice to Vitelity for my SIP Phone service. I am having some issues with outgoing calls - every day there is at least one that returns an all circuits busy message. Strange that you can dial the number once, hear the message, and immediately redial and the call will go through. The other night no calls were going out at all.

I escalated the issue with Vitelity and their suggestion was to simply open up ports 10,000 - 20,000 and 5060-5061 to the internet. Now I am not a fan of having my system flapping around in the breeze like that, and currently have no ports forwarded to it at all. Would I really need 5060 opened up if the SIP registry is OK and never goes down? I know 10,000 - 20,000 are for the call audio (correct me please if I am wrong about any of this) so do those ports really need to be opened either?

I am at a loss here as to what could be causing my issues- my big question here is this is a basic install running 2.6, but has gone through several provider changes through the last two years, eventually resulting in the choice of Vitelity (which I am very happy with). I don't think it is possible, but can anyone see any reason why some old configuration could be messing something up? Are there dangers with opening 5060 and 10000-20000 to the net without much security? I suppose I would need to strengthen my passwords, etc if I were to do this, but would I need all the hardening that is suggested? I would have no reason to open HTTP or any other ports for any reason.

Can someone advise me please?

thanks!

Jon

‹ DISA GSM Problem iax extension problem ›

&nbsp

awebster
Posts: 93
 Member Since:
2007-01-29
open ports
Wed, 01/20/2010 - 2:43pm

Jon,

It is important to understand how SIP and RTP work together.
SIP simply establishes the call, and then negotiates the audio with messages that say "by the way, your audio codec will be XYZ and it will be on port NNN". If you have a good firewall, it can listen to this SIP dialogue and then expect to see UDP traffic on the appropriately negotiated port, and everything will be fine.
Unfortunately, most consumer grade equipment isn't equipped to do that, or if you are using encrypted SIP, so what you end up having to do is to open all the inbound high ports because you just don't know in advance what port the audio will be comming in on.

On the surface this doesn't seem like such a bad issue, the problem through is that many other applications might also be listening on these ports (especially the malware variety) and will happily do what is asked on them when probed from outside.

Andrew

--

Andrew


&nbsp

bravonoj
Posts: 213
 Member Since:
2007-11-20
Andrew, I am not really
Thu, 01/21/2010 - 7:48am

Andrew,

I am not really ready to open any ports - correct me again if I am wrong, but if the ports were the issue, wouldnt all the calls fail?

No consumer grade devices in the way between the net and the server - I have Cable service; from there it runs through a Cisco 2611 router and Cisco switch. I am setting up an Untangle box to throw in the mix in the case I need to open up anything for another level of protection, but in your mind, would port forwarding be the issue with calls failing randomly? For the last 24 hours or so, there have been no failures.

Jon


&nbsp

aacero2009
Posts: 8
 Member Since:
2009-02-05
Not ready
Wed, 02/03/2010 - 4:14am

Unfortunately there is something else that needs to be considered, Vitelity has been having many issues from lack of proper tech support, servers going down, DTMF issues, call termination issue to lack of proper customer service. Something has changed for them and they are not the same Vitelity. On top of that they have been bought out and things are not looking better.

I would recommend iCall and there tech support people. They have more product offers and people better suited to assist and actually terminate your calls.


&nbsp

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.