No transmission problem on DrayTek routers

[david.taylor]

• 3CX Version: Professional Annual 18.0.7.312
• Server location: Hosted by 3CX
• Server OS: Debian? (Hosted by 3CX)
• IP Phone Make/Model/Firmware version: Yealink T54W version 96.86.0.74
• Provisioning Method: STUN
• Trunk Provider or VoIP Gateway Make/Model: Voiceflex
• Has the Firewall Checker passed: N/A
• Are custom Phone Templates being used: No

We have run into an issue where 1 or more phones sometimes have no transmission or one-way transmission. It could be just 1, many or all phones that are affected. SIP packets are not blocked, but RTP packets are. Internal calls are affected too so it's not the SIP trunk. Restarting the phone usually does not fix the problem. Restarting the router does fix it, but the problem sometimes returns days, weeks or months later. This only seems to happen with DrayTek routers. SIP ALG is disabled.

I have narrowed it down to 'Port Scan detection' being enabled under Firewall » Defense Setup. Disabling this solves the problem. DrayTek describe this as below.

Enable Port Scan detection

Port Scan attacks involve sending lots of packets to many ports in an attempt to find services that respond. When detected, the Vigor router will monitor the port-scanning Threshold rate and send out a warning if malicious exploration behaviour is detected.

By default, the Vigor router sets the threshold as 2000 packets per second. That means, when 2000 packets per second received, they will be regarded as an “attack event”.

Source: https://www.draytek.co.uk/support/guides/kb-denial-of-service

Has anyone else had this or similar problems?

Secondly, having gotten the phone working by disabling the above, there was then intermittent poor speech quality (dropped packets/speech breaking up) on the same phone as above. We resolved this by disabling 'Block TCP flag scan' on the router. DrayTek describe this as below.

Block TCP flag scan

Any TCP packet with the anomaly flag setting is dropped. Those scanning activities include no flag scan, FIN without ACK scan, SYN FINscan, Xmas scan and full Xmas scan.

Source: https://www.draytek.co.uk/support/guides/kb-denial-of-service

Does 3CX send packets with the anomaly flag set?

I'm asking the same/similar questions of DrayTek.

Not blaming anyone; just trying to get to the bottom of this as we are concerned about leaving some of these protections disabled.

See also attached screenshot from the router.

 

[SteveITS]

STUN isn’t supported for hosted servers:
https://www.3cx.com/docs/switch-hosted-pbx/#h.ijlc0r5ihohv

In general an SBC will avoid many firewall issues. Note many phone models can act as an SBC/router phone now.

 

[JohnS_3CX]

• IP Phone Make/Model/Firmware version: Yealink T54W version 96.86.0.74

Hi David,

Allow me to save you wasted hours on something entirely pointless which would otherwise have you going in circles.

1. Congrats - You already have a phone with a built in SBC and correct firmware (T54W)
2. Delete the phone from the extension
3. Login to the new 3CX Webclient Admin panel (not the MC)
4. Go to Users > Find your user, add an IP phone
5. Select the new Router Phone feature, pick T54W and paste in your MAC
   
   
   
   
6. When completed, perform a factory reset (not a plain reboot)

Now wait a bit, and after 2-3 minutes the phone will come up using its own built in SBC, and you can forget about chasing STUN issues ever again. You can even remove the port forwards you had on the DrayTek if you had any for this phone.


Read more here if you want the details:
https://www.3cx.com/docs/manual/ip-phones/
https://www.3cx.com/sip-phones/yealink-t5-series/