Firewall default config and why are my incoming VoIP calls not blocked?

Software SW help
1

Hi all,
I am discovering Turris OS (5.1.10 as of today) on a MOX as a router on my recently installed home fibre broadband. I haven’t modified Firewall configuration or added any NAT rules yet, but I have activated/accepted data collection and HaaS via Foris/ReForis.

I have subscribed to VoIP service from my ISP. They provide instructions for firewalls but to my surprise, actually my VoIP phone is not blocked… This is confusing as I was expecting incoming calls to be rejected by firewall (UDP port 5060 for SIP).

The default rules, as seen by uci/Luci are relatively straightforward:

firewall.@zone[0].name='lan'
firewall.@zone[1].name='wan'
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[7].name='Allow-IPSec-ESP'
firewall.@rule[8].name='Allow-ISAKMP'
firewall.wan_ssh_turris_rule.name='wan_ssh_turris_rule'
firewall.wan_http_turris_rule.name='wan_http_turris_rule'
firewall.wan_https_turris_rule.name='wan_https_turris_rule'

But I have the impression that sentinel modifies IPtables directly and does bypass uci. Does that mean I need to go through the IPtables configuration to find out why my VoIP is not blocked?
Any other good way to investigate?

Testing my public IP via services like shieldsUP! shows open ports (telnet, HTTP, FTP, SMTP) but I suppose these are the honeypots. Well I hope…
Also, any reason why Turris firewall does generally REJECT instead of DROP?

Thanks,

2

My guess is that your VoIP phone is connecting to their server, establishing a connection which is recognized by the firewall as legitimate traffic. Similar to web traffic. But that’s just a guess.

1 Like
3

Yes thank you for the suggestion. I am now looking at ways to monitor traffic from the IP phone. Maybe it does keep a connection with the VoIP servers in which case the firewall just sees a connection initiated from within my network.
Now looking into tools to monitor network traffic between this phone and the router…

4

I believe it’s normal for VoIP/SIP to work even if you have no public address (even for incoming calls). I used it that way long ago.