SIP (5060 or others) port is not blocked between VLAN and LAN, but other ports are
-
Hey,
I'm running PfSense & FreePBX in a lab for testing.
PfSense is on 192.168.3.1
FreePBX is on 192.168.3.13
And there is one Yealink phone on 192.168.10.100, which is VLAN 10.I didn't set any allow rules, yet the phone (192.168.10.100) is able to register with the PBX (192.168.3.1) without any issues, even if I manually add block rules. When I change the listening port of freepbx to 5020 for example, the phone still manages to register with the PBX. Other ports and services (NTP for example) or ICMP requests are blocked, unless I add an allow rule.
What am I missing here?
I appreciate your help.
Thank you and have a happy new year!
-
@eaglex Did you have a rule and remove it? Open states are unaffected by rule changes.
Can you verify the phone config by logging in to the phone web GUI?
-
@steveits Hey Steve, thank you for the quick reply.
I can, I am managing it through there.
I did indeed forget to add that there was a rule allowing 5060 for a very short time.
I haven't thought about open states, good idea, but even after rebooting the phone and setting to connect to a different port, it connected. Shouldn't an open state, if exists, only relate to one port, 5060 in that case, and not the one that was never allowed in the first place (5020)?
Thanks.
-
@eaglex Yeah it would just be the one port. Restarting the phone would not clear states but you can see/delete them in pfSense or restart pfSense.