We have an issue where one of our yealink t54w phones keep ringing and displaying sequential numbers on the phone starting with 2001, then 2002, 2003, 2004, etc. You pick it up and then hang up it starts right back at ringing and ringing. No activity is in the pbx cdr. Allow anonymous SIP calls is set to NO. Any ideas?
TIPS IncrediblePBX 2027-D extension keeps ringing? Attack??
- Thread starter kmcdaniel
- Start date
Firewall. You are getting ghost calls.
But nothing is open, is there something specific in the firewall I should be looking for?
atsak
Guru
- Joined
- Sep 7, 2009
- Messages
- 2,473
- Reaction score
- 487
https://www.yay.com/faq/voip-phones/ghostcallingyealink/ has a couple screenshots you can use. The phone is probabaly opening pinholes.
Otherwise on your PBX disable anonymous inbound calls in the sip settings (shouldn't be on by default but you might have enabled that at some point).
Otherwise on your PBX disable anonymous inbound calls in the sip settings (shouldn't be on by default but you might have enabled that at some point).
Thanks! I made the adjustments, we'll see if it comes back. Thank you for your help!
That is not true. Your phones create NAT holes to accept traffic from the other side. Your network is being scanned.
Makes sense. Is there anything that I can do to prevent this?
As stated before, only allow SIP traffic from known IPs.
we had the same issue. Changed my sip port from 5060 and it went away. It drove us crazy. Only happened to one extension (Grandstream) and rang constantly. Asked about it on here at the time and went with the change.
just in case anyone thinks all transports are equally compromised , you are statistically on the wrong side of prophylaxis, just never listen to UDP/5060
ostridge
Guru
- Joined
- Jan 22, 2015
- Messages
- 1,813
- Reaction score
- 625
In the IPBX Just in case iptables isn't 'UP'
from the Linux CLI, To check for "Chain INPUT (policy DROP)" to test that /etc/iptables/rules-v4 is loaded
To check for "5060:5069" to test that /usr/local/sbin/iptables/iptables-custom is loaded (i.e. the whitelist)
That should look like:
from the Linux CLI, To check for "Chain INPUT (policy DROP)" to test that /etc/iptables/rules-v4 is loaded
Code:
iptables -nL | grep Chain INPUT (policy DROP)
Code:
iptables -nL | grep 5060:5069
Code:
root@incrediblepbx:~# iptables -nL | grep 5060:5069
ACCEPT udp -- 204.216.109.55 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 35.85.225.96/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 3.101.177.224/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 3.99.65.224/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 44.199.94.192/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 3.144.141.64/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 35.215.45.65 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 35.209.126.210 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 35.212.222.157 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 35.85.225.96/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 3.101.177.224/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 3.99.65.224/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 44.199.94.192/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 3.144.141.64/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 35.215.45.65 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 35.209.126.210 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 35.212.222.157 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 35.85.225.96/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 3.101.177.224/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 3.99.65.224/27 0.0.0.0/0 udp dpts:5060:5069
ACCEPT udp -- 44.199.94.192/27 0.0.0.0/0 udp dpts:5060:5069
# As well as loads more ... ... ...
Last edited:
Get 3CX - Absolutely Free!
Link up your team and customers 
Phone System Live Chat Video Conferencing
Hosted or Self-managed. Up to 10 users free forever. No credit card. Try risk free.
Verify your Email
Check your inbox!
We’ve sent you an email. Click on the button in the email body to verify your email address – (if you can not find it, check your spam folder).
Upon verification you will be directed to the 3CX setup wizard.