Defining restricted dynamic ports for outbound NAT?

dhoffman98

I'm finding that Snort is reporting alerts on incoming connections on 5060 for devices that are not my PBX. I think what is happening is that when an internal machine is communicating through NAT, they get assigned a dynamic port number for that connection, and sometimes luckly happens to be assigned port 5060. Then when the remote site responds back to the firewall, it sends its traffic on 5060, and then Snort intercepts it because it's on the SIP port and the pre-proc tests it for SIP rules.

I know I could disable the spp_sip preprocessor in Snort. I'd like to see if there is a better (or alternative) option.

I COULD also just block all inbound traffic on 5060 (because I have my trunk vendor sending incoming connections on a custom port).

Is there a way to do one of the following:

Force outbound NAT from source port 5060 to rewrite the outbound port to a different number?
Define a list of ports that can never be used by NAT?
Force the Snort pre-proc to inspect incoming traffic on a different custom port instead of 5060?

I think I like the idea of #2 best, and I know I could write a rule that blocks all outbound traffic from a specific port number, but not sure what that ends up doing to connections that are given the restricted port number, and then have it blocked.... I think that would cause that connection to fail and not be successful until it is tried again with a different dynamic port number.

Does any of that make sense to any of you pfSense gurus? I hope I explained it clearly enough.

Thanks in advance for any guidance.

-David

viragomann

@dhoffman98 said in Defining restricted dynamic ports for outbound NAT?:

Then when the remote site responds back to the firewall, it sends its traffic on 5060, and then Snort intercepts it because it's on the SIP port and the pre-proc tests it for SIP rules

Not sure if that is really the case, but yes, you can add an outbound NAT rule to translates the source port in case of 5060 to another one out of a given range. That is one of the things outbound NAT rules usually can do.