Inbound NAT

[milton24]

Looking for some help with this issue. Possibly an aspect of NAT/Networking that I am not understanding. I have VOIP devices that are exposing themselves to the internet and I cannot find a way to deny unwanted inbound traffic wan>lan. This is happening even though the devices are not being port forwarded or use a virtual IP (made by me). But I am able to complete port connection tests to the source NAT port from remote IPs that are not on the destination NAT table... how? My logs say that the wan>lan traffic enters via the same policyID that allows them to connect outbound.

This policy is locked to a specific set of IP addresses on SIP so it should not be allowing connections to anything else (if anything).

[Toshi_Esumi]

No one would be able to comment without seeing the VIP and policy config (CLI) in question.

[Dave_Hall]

I agreed with Tosh, though reading the description itself of the problem, it's more a VOIP issue - At the back of my head, I keep thinking the issue may be related to the SIP ALG or SIP session helper.

[milton24]

Thanks for the replies. I'll check out the SIP links.

Log output from an accepted external connection to my VOIP phone: type="traffic" subtype="forward" level="notice" srcip=<external IP> srcport=61567 srcintf="wan1" srcintfrole="wan" dstip=<my wan IP> dstport=<dynamic NAT port> dstintf="lan" dstintfrole="lan" sessionid=14297519 proto=6 action="accept" policyid=13 policytype="policy" poluuid="610e0e98-b6d6-51e7-9796-633a14f4af69" service="tcp/<dynamic NAT port>" trandisp="dnat" tranip=<internal VOIP device IP> tranport=<dynamic NAT port> duration=261 sentbyte=0 rcvdbyte=0 sentpkt=0 rcvdpkt=0 appcat="unscanned" sentdelta=0 rcvddelta=0

Policy 13 ACCEPT: config firewall policy edit 13 set name "VOIP-Outbound" set uuid 610e0e98-b6d6-51e7-9796-633a14f4af69 set srcintf "lan" set dstintf "wan1" set srcaddr "VOIP-PhoneRange" set dstaddr "VOIP-Services-Group" set action accept set schedule "always" set service "SIP" "NTP" set utm-status enable set ssl-ssh-profile "certificate-inspection" set dnsfilter-profile "default" set ips-sensor "high_security" set logtraffic all set nat enable next end

VIP settings, they are whitelisted to external IPs and tested to only accept from them. The dynamic NAT port is not being forwarded here and the VOIP device IP is also not here. config firewall vip edit "MobileDomain-VIP" set uuid 8532f9a4-b952-51e7-a122-c18b82547b69 set extip <fortigate lan interface IP> set extintf "lan" set mappedip <internal server IP> next edit "PortForward10000" set uuid 47bd21f4-e3b2-51e8-6112-166c02ce0a72 set extip <wan IP> set extintf "wan1" set portforward enable set mappedip <internal server IP> set extport 10000 set mappedport 10000 next edit "PortForward443" set uuid 6925bdb2-f38c-51e8-7fbf-bd43d6b4ef7b set extip <wan IP> set extintf "wan1" set portforward enable set mappedip <internal server IP> set extport 443 set mappedport 443 edit "PortForward-22" set uuid 516e8ede-f390-51e8-c380-23c37e3991d9 set extip <wan IP> set extintf "wan1" set portforward enable set mappedip <internal server IP> set extport 22 set mappedport 22 next end

[lobstercreed]

Dave is right, this is a SIP session helper thing.  I would be willing to bet that the source and destination ports that you obfuscated are within the normal RTP range of 16384 - 32767 and that if you did a packet capture on the SIP traffic (port 5060) allowed by this session you would find SDP packets with the relevant IPs and ports.  If these calls do not match expected incoming or outgoing calls, then you'll want to look at how your SIP gateway is set up, but I don't think the firewall is doing anything unexpected or wrong here.