How can I setup Mikrotik firewall for SIP-phones? I copied some rules from this article https://www.3cx.com/docs/mikrotik-firewall-configuration/ and successfully got in- and out-voice traffic (my PBX is not 3cx, there are just example rules for me). But also I’m getting spam calls now.
Questions:
- Now SIP service ports (NAT-helpers) are enabled in firewall. When I switch them off I get voice only in one direction. Shall I disable them or not?
- How can I filter out spammers with dst-nat (only need my provider’s PBX - i.e. 1.2.3.4)? I’ve added 1.2.3.4 IP address as source address in “PBX SIP UDP”-rule but voice has dissapeared completely. Calls were able btw. Did the same with “PBX Media UDP”-rule - unsuccessfully.
- This router also gives out Internet for users (separate local network, local port 3 on router). How can I disable Internet access from phones network (port 4 on router) and left only SIP-telephony there? I mean user mustn’t have a possibility to disconnect phone from switch, connect PC there and use Internet.
Also need I this “fasttrack” rule or it can be deleted? - I need to use IP-phones with addresses from 192.168.1.0/24 and 192.168.2.0/24 networks together. No problems with phones from 192.168.1.0. I get troubles only when I’m use my testing phone with address 192.168.2.10. Therefore I want to ask - how incoming calls are possible for 192.168.1.0-phones without any dstnat-rules at all? When I had empty NAT-table (only masquerade for users’ Internet) I had successfull calls to 192.168.1.0-phones from Internet-based phones.
192.168.1.1 - my PBX.
Here are my firewall rules with some disactivated rules removed:
ip firewall filter p
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked log=no log-prefix=“”
2 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid log=no log-prefix=“”
3 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp log=no log-prefix=“”
4 ;;; defconf: accept to local loopback (for CAPsMAN)
chain=input action=accept dst-address=127.0.0.1 log=no log-prefix=“”
6 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN log=no log-prefix=“”
9 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=“”
10 ;;; defconf: accept established,related, untracked
chain=forward action=accept connection-state=established,related,untracked log=no log-prefix=“”
12 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid log=no log-prefix=“”
13 ;;; defconf: drop all from WAN to LAN not DSTNATed (copied this rule from somewhere. It has never worked, has 0 counter on packets)
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=yes log-prefix=“”
ip firewall nat p
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none
2 ;;; PBX SIP UDP
chain=dstnat action=dst-nat to-addresses=192.168.1.1 to-ports=5060 protocol=udp dst-port=5060 log=yes log-prefix=“”
3 ;;; PBX SIP TCP
chain=dstnat action=dst-nat to-addresses=192.168.1.1 to-ports=5060 protocol=tcp dst-port=5060 log=no log-prefix=“”
4 ;;; PBX SIP TLS
chain=dstnat action=dst-nat to-addresses=192.168.1.1 to-ports=5061 protocol=tcp dst-port=5061 log=no log-prefix=“”
5 ;;; PBX Media UDP
chain=dstnat action=dst-nat to-addresses=192.168.1.1 to-ports=9000-20999 protocol=udp in-interface-list=WAN dst-port=9000-20999 log=no log-prefix=“”
