Firewall issues

**olaf** · 07-24-2009 10:16 AM

I had an issue yesterday when my PAPT2 failed to reregister after I rebooted my router. I submitted a ticket, the response was prompt, and they enabled a STUN server and set NAT keep-alive packets to be sent every 5 minutes to help prevent the problem from happening again. They also recommended that I disable the SPI firewall on my router because it may cause intermittent problems, even if it seems to be working.

I rebooted the router again today, and when the PAPT2 again failed to register (with the SPI firewall still on), I experimented a bit with putting the PAPT2 in a DMZ vs. turning off the firewall completely. As far as I could tell, the DMZ did not let it reregister, but shutting the firewall off did.

I'm not crazy about leaving the firewall off, but I suppose I could use an iptables-based firewall instead of the SPI firewall (I am using DD-WRT firmware). I'm just wondering if others out there have thoughts & experience on the pros & cons of an SPI firewall and other router security measures while using VOIP.

Thanks.

**fisamo** · 07-24-2009 10:52 AM

Which version of DD-WRT are you running?

**olaf** · 07-24-2009 11:02 AM

Which version of DD-WRT are you running?

v24-sp2 standard, build 12188 (05/21/09).

**Xponder1** · 07-24-2009 02:58 PM

Firmware: DD-WRT v24-sp2 (01/01/09) micro
I use this version with no problems at all. It was one of the most recommended builds.

**olaf** · 07-24-2009 03:10 PM

Originally Posted by Xponder1

Firmware: DD-WRT v24-sp2 (01/01/09) micro
I use this version with no problems at all. It was one of the most recommended builds.

And you leave the SPI firewall on?

I've had no trouble with the router for anything else, just an intermittent registration issue in the last couple days while the firewall is on.

**ptrowski** · 07-24-2009 03:29 PM

I have a similar configuration and leave the SPI firewall off. It has not created extra issues with my other laptops, PC's etc from a security aspect.

**voipinit** · 07-24-2009 04:02 PM

Curious - correctly setting up a DMZ should bypass your router firewall altogether.

**scott2020** · 07-24-2009 05:55 PM

Originally Posted by Xponder1

Firmware: DD-WRT v24-sp2 (01/01/09) micro
I use this version with no problems at all. It was one of the most recommended builds.

I think the newest release was to address an exploit that would give hackers full control of the router. I saw a news release about it yesterday.

**fisamo** · 07-24-2009 06:17 PM

Originally Posted by scott2020

I think the newest release was to address an exploit that would give hackers full control of the router. I saw a news release about it yesterday.

That's comforting...

I asked the OP about version, because I have SPI on with no issues whatsoever. One key difference, though, is that as a former beta tester, I'm able (and choosing) to connect with my own equipment (PBX-in-a-Flash), not a Voipo-supplied ATA. My DD-wrt version is shown below:

Code:

Router Model         Asus WL-520GU/GC
Firmware Version     DD-WRT v24-sp2 (06/09/09) mini-usb - build 12268M NEWD Eko

I don't know as if the hardware would make a difference, but what brand and model router are you running?

**mdlawler** · 07-25-2009 08:36 AM

I'm running dd-wrt nokaid 07-22-09 on a Linksys WRT54GS and I saw several UDP packets from the Voipo servers to ports 5060 and 5061 being dropped. I forwarded these ports to my PAP2T and that solved all of my problems. I think that the default for dd-wrt is to close UDP connections after 120 seconds to prevent the number of connections which I have at 4096 from overflowing. I see no drawback of forwarding those two ports as it avoids this issue completely. The only possible drawback is that it allows any connections to hit the ATA not just ones from Voipo so it puts more security risk on the ATA.