FYI Clearly Anywhere softphone

[LaRoadrash]

After adding all the IPs as directed in CA's documentation, I still couldn't connect except from my office wifi (trusted source IP on hosted pbx (crown cloud). Support suggested opening port 5060... I've got somewhat severe concerns on this. Using Crown Cloud's Incredible PBX 2027-U image, I'm seeing the following traffic in asterisk:

===================================================================================
-- Executing [2000000972592563144@from-sip-external:1] NoOp("PJSIP/anonymous-0000007a", "Received incoming SIP connection from unknown peer to 2000000972592563144") in new stack
-- Executing [2000000972592563144@from-sip-external:2] Set("PJSIP/anonymous-0000007a", "DID=2000000972592563144") in new stack
-- Executing [2000000972592563144@from-sip-external:3] Goto("PJSIP/anonymous-0000007a", "s,1") in new stack
-- Goto (from-sip-external,s,1)
-- Executing [s@from-sip-external:1] GotoIf("PJSIP/anonymous-0000007a", "1?setlanguage:checkanon") in new stack
-- Goto (from-sip-external,s,2)
-- Executing [s@from-sip-external:2] Set("PJSIP/anonymous-0000007a", "CHANNEL(language)=en") in new stack
-- Executing [s@from-sip-external:3] GotoIf("PJSIP/anonymous-0000007a", "1?noanonymous") in new stack
-- Goto (from-sip-external,s,5)
-- Executing [s@from-sip-external:5] Set("PJSIP/anonymous-0000007a", "TIMEOUT(absolute)=15") in new stack
-- Channel will hangup at 2023-05-05 12:35:56.007 CDT.
-- Executing [s@from-sip-external:6] Set("PJSIP/anonymous-0000007a", "receveip=pjsip,remote_addr") in new stack
-- Executing [s@from-sip-external:7] Log("PJSIP/anonymous-0000007a", "WARNING,"Rejecting unknown SIP connection from 185.224.128.31:5074"") in new stack
[2023-05-05 12:35:41] WARNING[6839][C-0000007b]: Ext. s:7 @ from-sip-external: "Rejecting unknown SIP connection from 185.224.128.31:5074"
-- Executing [s@from-sip-external:8] Answer("PJSIP/anonymous-0000007a", "") in new stack
> 0x7f4b78043ad0 -- Strict RTP learning after remote address set to: 185.224.128.31:5075
-- Executing [s@from-sip-external:9] Wait("PJSIP/anonymous-0000007a", "2") in new stack
-- Executing [s@from-sip-external:10] Playback("PJSIP/anonymous-0000007a", "ss-noservice") in new stack
-- <PJSIP/anonymous-0000007a> Playing 'ss-noservice.ulaw' (language 'en')
-- Executing [s@from-sip-external:11] PlayTones("PJSIP/anonymous-0000007a", "congestion") in new stack
-- Executing [s@from-sip-external:12] Congestion("PJSIP/anonymous-0000007a", "5") in new stack
== Spawn extension (from-sip-external, s, 12) exited non-zero on 'PJSIP/anonymous-0000007a'
-- Executing [h@from-sip-external:1] Hangup("PJSIP/anonymous-0000007a", "") in new stack
== Spawn extension (from-sip-external, h, 1) exited non-zero on 'PJSIP/anonymous-0000007a'
===================================================================================
This will occur as the remote server steps through a number of ports and finally gives up.

Do I like it? No. Apparently Clearly IP's documentation hasn't kept up to date with their source servers, so their solution is to request wide open 5060 access. I'm somewhat concerned that this IP address isn't listed in iptables (iptables -S | grep 185.224.128.31) and it's only touched port 5060 once. Assuming that the already established connection is allowed to keep reconnecting on other ports?

Opening 5060 to everyone gives me a ridiculous number of "WARNING[11335]: res_pjsip_registrar.c:1189 registrar_on_rx_request: Endpoint 'anonymous' (178.62.18.11:5103) has no configured AORs" errors.

I can't help but think that the issues above ought to make me walk away from Clearly Anywhere... Or am I just being a bit too paranoid?

 

[KNERD]

You can disable anonymous connections in SIP Settings

 

[billsimon]

Looks like their documentation (https://kb.clearlyip.com/FreePBX/Configuring-Clearly-Anywhere-Module.html#Ports_and_Registration) is missing these two IPs (from list: https://faq.acrobits.net/ip-sipis )

165.227.190.186
165.227.210.221

 

[wardmundy]

Fixed. Thanks.