sip module only works for a short time

Hello initB10r

Good day!!

Kindly disable the UDP Flood from the DoS & spoof protection or bypass SIP Communication ports (TCPor UDP) from DOS bypass rules.

Navigate to Administrator > >Intrusion prevention >> DoS & spoof protection

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/IPSDoSAndSpoofProtection.html

For more information about "Sophos Firewall: Turn on or off the Session Initiation Protocol (SIP) module", please check this link also : https://support.sophos.com/support/s/article/KB-000035917

Hope this helps!

Hello NM_1987 ,

Here is a screenshot of the overview page:

It doesn't look like something is being blocked.

This is the current configuration:

If I understand correctly, spoof protection is disabled and nothing has been blocked in DoS.

Or am I misunderstanding this?

Regards
Marc

Looks good, now please provide an expanded screenshot of your voip firewall rule.

ian

I don't have such a rule yet, because telephony always works after reloading the sip module.

rfcat_vk How should this rule look like?

No idea? What about the voip firewall rule, how should this rule look like?

My version is something like this

lan, voip network, wan, voip provider servers network address, any service. Application voip, ips lan to wan or configure your own.

you can refine the any service to your tcp/udp ports after a day of so of data to improve security.

ian

Currently I have everything very open for the LAN and there is only one outgoing rule. Therefore, the proposed rule should be covered by the default.

Here is this rule:

Or is there something I am missing here?

I would make a voip policy that does not use the dpi function.

ian

I have now deactivated everything as a test. Nevertheless, it does not work.

Thank you for trying. What does logviewer show for the attempts?
ian

Thank you for trying. What does logviewer show for the attempts?
ian

I got this error at 13:52:06 and 13:52:08 in /var/tslog/syslog.log

Sep 17 13:52:06 localhost kernel: [629954.088001] ip_nat_sip_expected: doing self nating: <212.227.124.70>
Sep 17 13:52:08 localhost kernel: [629956.539844] ip_nat_sip_expected: doing self nating: <212.227.124.70>

But I can't find anything in the log viewer at this time:

Hi,

how many Nat rules do you have in place and are any of them linked?
ian

Hier sind alle meine NAT rules:

The 4th is connected to the Default Firewall Rule from above

Hi,

this might not be the answer, but linked Nat rules take precedence regardless of where they sit in the Nat order. Also why do you have linked rules, they are really only needed if you have multiple wan links?

ian

There is no specific reason for this. It came with the basic installation of XG.

I have unlinked everything, but unfortunately the problem persists. :-(

Maybe I am missing something, but your error message is from your voip device not the XG, correct? So maybe you need to disable Nat on your voip device?

the error message would imply that you have the voip device wan interface connected to the XG, not the lan interface.
ian

No, the log is from the XG itself:

SFVH_SO01_SFOS 18.5.1 MR-1-Build326# tail -f /var/tslog/syslog.log
Sep 19 10:00:01 localhost kernel: [788829.597191] 750:appdev_open:dev open 3
Sep 19 10:00:01 localhost kernel: [788829.597214] 703:appdev_write:ptr U 8,ACCEPT
Sep 19 10:00:01 localhost kernel: [788829.597215] 75:appfiltermap_adt_parser: buff U 8,ACCEPT
Sep 19 10:00:01 localhost kernel: [788829.597219] 711:appdev_write:count 10
Sep 19 10:00:01 localhost kernel: [788829.597222] 758:appdev_release:dev open 3
Sep 19 10:00:01 localhost kernel: [788829.597223] 771:appdev_release:counter 8 size 128
Sep 19 10:00:01 localhost kernel: [788829.597224] 774:appdev_release:dev open 0
Sep 19 10:58:27 localhost nsgsig-verify: /sdisk/u2d/downloads/avira_4.00_1.0.417524_immdiff.tar.gz.gpg: not an NSGSIG file
Sep 19 11:16:23 localhost kernel: [793411.148074] ip_nat_sip_expected: doing self nating: <212.227.124.6>
Sep 19 11:16:25 localhost kernel: [793413.607723] ip_nat_sip_expected: doing self nating: <212.227.124.6>

It seems that I found a solution now.

I have set in the Fritzbox "Keep port forwarding of the Internet router active for telephony" from 5 minutes to 30 seconds.

Many thanks to all for the support.