Can I Just Kill STUN, And Will That Stop These Annoying Phone Registration Attempts?

[Jim.Lloyd]

I only use soft phones in a really small home/office configuration. Can I just block STUN, altogether? I think that will stop all these phones trying to register with my 3CX. I keep consolidating these IPs down to parent ranges, and have been keeping the list down to 3 screens, but this is getting tiring. I know the system locks them out, and I have really short lockout settings. This last week, it has Been "Digital Ocean" IPs... dozens of them. I see 3CX has some sort of agreement with them, but am not sure if this has anything to do with this latest bout of login attempts.

I recently upgraded my router and may not yet have a full grasp on how to set up the security rules. This Synolgy RT6600ax is awesome, but maybe I am not yet up to speed on how to properly set it up.

Any assistance would be awesome.

 

[CentrexJ]

I only use soft phones in a really small home/office configuration. Can I just block STUN, altogether? I think that will stop all these phones trying to register with my 3CX. I keep consolidating these IPs down to parent ranges, and have been keeping the list down to 3 screens, but this is getting tiring. I know the system locks them out, and I have really short lockout settings. This last week, it has Been "Digital Ocean" IPs... dozens of them. I see 3CX has some sort of agreement with them, but am not sure if this has anything to do with this latest bout of login attempts.

I recently upgraded my router and may not yet have a full grasp on how to set up the security rules. This Synolgy RT6600ax is awesome, but maybe I am not yet up to speed on how to properly set it up.

Any assistance would be awesome.

Lock ports 5060 TCP and UDP down to just the IP of your SIP trunk provider and it will stop the attempts cold.

 

[Jim.Lloyd]

Lock ports 5060 TCP and UDP down to just the IP of your SIP trunk provider and it will stop the attempts cold.

EDIT: Thank you CentrexJ! I went back and reviewed my "Port Forwarding" & "Firewall Rules"... It appears that I may have had two things going on... an improperly created port 5060/5061 TCP/UDP block rule, and some "System Rules" that were created by Synology's "VPN Plus Server" add-on that came in in the middle of my 3CX rules for ports 5001, 5090 5060 & 5061... basically overriding my port rule for "Deny" to 5060/5061 for TCP/UDP.

Semantics and rule order is important, and I didn't pay attention. I am glad your comment encouraged me to go back and take another look >)

 

[Jim.Lloyd]

Well... That didn't work. I got a couple hits overnight. Another Digital Ocean and Upcloud-Chicago. My rules are apparently not quite there.

 

[bitn2]

You have to limit port 5060 to your sip provider as @CentrexJ allready said. That will fix your "problem".

 

[Jim.Lloyd]

Thank you for your responses! I think that I have finally gotten to a good configuration. After messing around with the Firewall Rule order (and Port Forwarding), I can now implement the firewall block rule for 5060/5061 on TCP/UDP after the SIP IP allow rules without knocking out my SIP provider.
. I did disable all my "Block Countries" & VPN Plus rules to get back to the basics. I will add things back far enough apart to determine what I am doing to cause 3CX & my SIP provider to not properly work with each other.

I am in the process of retiring, and feel that I am losing my edge. The older I get, the more I realize how little I know or how much I no longer do.

I appreciate all your responses, and thank you for chiming in!

 

[Jim.Lloyd]

I think this one is OK to close... The system has responded normally for 3 days without a pesky and unwanted login attempt.

I am constantly impressed by this Synology router. I am not sure I will ever grow into the capabilities of this thing. For a small office or home office, this thing is impressive.