Tons of calls from four digit numbers

Forums › VoIP › Tons of calls from four digit numbers

ElectronicFerret

125 posts

Master Geek
+1 received by user: 9

#178960 20-Aug-2015 18:50

I've just ported my phone number over to a VoIP provider (2talk reseller) and now get tons of calls from four digit numbers.

The numbers seem random and It's so many calls overnight that I've had to unplug the phone.

Any ideas what I can do? Never had this issue while on a standard land line.

johnr

19282 posts

Uber Geek
+1 received by user: 2526
Inactive user

#1371059 20-Aug-2015 18:57

Who or what is on the end when you answer them?

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1371060 20-Aug-2015 19:01

Let me take a guess about your setup.. You have a Cisco ATA and have port 5060 forwarded on your firewall to the ATA.

Am I right? If I am I'll tell you what your problem is.

richms

29097 posts

Uber Geek
+1 received by user: 10206

Trusted

Lifetime subscriber

#1371064 20-Aug-2015 19:14

I have 8 numbers with 2talk and get no more calls than on a standard landline. Except I can block anonymous on 2talk, which if you have the phone open to the whole internet will not help you.

Richard rich.ms

speed

296 posts

Ultimate Geek
+1 received by user: 101

#1371067 20-Aug-2015 19:25

Hey Steve, I get your reference to open SIP port from the public internet, but just wondering what made you think it was a Cisco ATA? Are they more prone to accepting unauthenticated inbound IP calls than other devices or is there some other reason for your suspicions?

Pete

ElectronicFerret

125 posts

Master Geek
+1 received by user: 9

#1371069 20-Aug-2015 19:36

No ports open, but it is an ATA (Grandstream) and the router has UPNP and SIP ALG enabled.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1371070 20-Aug-2015 19:36

speed: Hey Steve, I get your reference to open SIP port from the public internet, but just wondering what made you think it was a Cisco ATA? Are they more prone to accepting unauthenticated inbound IP calls than other devices or is there some other reason for your suspicions? Pete

Cisco ATA's are by far the most common.. But I'm just interested to hear what the OP's setup is before I post any more.

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1371072 20-Aug-2015 19:37

ElectronicFerret: No ports open, but it is an ATA (Grandstream) and the router has UPNP and SIP ALG enabled.

So my pick would be you're exposing port 5060 to the internet and your ATA is being targeted by SIP bots.

You should go back to the reseller and ask them to securely configure your VoIP solution for you.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1371074 20-Aug-2015 19:39

speed: Hey Steve, I get your reference to open SIP port from the public internet, but just wondering what made you think it was a Cisco ATA? Are they more prone to accepting unauthenticated inbound IP calls than other devices or is there some other reason for your suspicions? Pete

If you want some fun have a look at the number of Cisco ATA's in Shodan that are fully exposed to the Internet. It's no wonder VoIP fraud is such a big thing...

ElectronicFerret

125 posts

Master Geek
+1 received by user: 9

#1371079 20-Aug-2015 20:03

sbiddle:
ElectronicFerret: No ports open, but it is an ATA (Grandstream) and the router has UPNP and SIP ALG enabled.

So my pick would be you're exposing port 5060 to the internet and your ATA is being targeted by SIP bots.
You should go back to the reseller and ask them to securely configure your VoIP solution for you.

So is this in the VoIP ATA, or in my ethernet router?

ferg_nz

175 posts

Master Geek
+1 received by user: 18

#1371086 20-Aug-2015 20:12

The Grandstream ATA's can do upnp and as such if your router has it enabled then port 5060 will be forwarded from the public internet to your ATA and will cause the issue you are getting.

Log in to the ATA and turn off the UPNP Nat type. either set it to use stun and set a stun server. you could also try to set it to none.