{"id":3726,"date":"2020-07-20T14:50:32","date_gmt":"2020-07-20T12:50:32","guid":{"rendered":"http:\/\/&p=3726"},"modified":"2020-07-20T14:50:32","modified_gmt":"2020-07-20T12:50:32","password":"","slug":"configuring-inbound-rules-on-firewalls","status":"publish","type":"docs","link":"https:\/\/www.winet.ch\/en\/support\/wiki\/konfiguration-inboundrules-auf-firewalls\/","title":{"rendered":"Recommended Firewall Settings for Winet"},"content":{"rendered":"

Required Ports & Settings for VoIP Service (All Firewall Models)<\/h1>\n

For Winet SIP Trunk<\/h2>\n

Phone system or phone terminals on the customer's LAN<\/p>\n

\n\n\n\n<\/colgroup>\n\n\n\n\n\n
SIP<\/td>\nPort\u00a05060<\/strong>\u00a0UDP on the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , both incoming and outgoing<\/td>\n<\/tr>\n
RTP<\/td>\nPorts\u00a010,000 \u2013 20,000<\/strong>\u00a0UDP on the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , both incoming and outgoing<\/td>\n<\/tr>\n
UDP Timeout<\/td>\nat least 300 seconds\u00a0<\/strong><\/td>\n<\/tr>\n
SIP-ALG<\/td>\ndisable<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

For Winet Ayrix & hostedPBX<\/h2>\n
\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n
SIP<\/td>\nPorts\u00a05060\u00a0<\/strong>UDP on the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , both incoming and outgoing<\/td>\n<\/tr>\n
RTP<\/td>\nPorts\u00a010000 \u2013 20000\u00a0<\/strong>UDP on the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , both incoming and outgoing<\/td>\n<\/tr>\n
CTI Clients<\/td>\nPorts\u00a05038<\/strong>\u00a0<\/strong>TCP on the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , both incoming and outgoing<\/td>\n<\/tr>\n
UDP Timeout<\/td>\nat least 300 seconds<\/strong><\/td>\n<\/tr>\n
SIP-ALG<\/td>\ndisable<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Additional Settings for Specific Firewall Models<\/h1>\n

Here you'll find screenshots and quick guides for the most common firewalls.<\/p>\n

Fortigate (Fortinet)<\/h2>\n

We recommend following these instructions:\u00a0http:\/\/kb.fortinet.com\/kb\/documentLink.do?externalID=FD33271<\/a><\/p>\n

How to Disable SIP-ALG (SIP Helper) on Fortinet<\/strong><\/p>\n

Open the FortiGate CLI from the dashboard. Enter the following commands in the FortiGate CLI:<\/p>\n

  config system settings\n  set sip-helper disable\n  set sip-nat-trace disable\n  reboot the device<\/pre>\n
Reopen the FortiGate CLI and enter the following commands (do not enter the text after \/\/)<\/p>\n
  config system session-helper\n  show \/\/ You need to find the entry for SIP, usually 12, but it may vary\n  delete 12 \/\/ or the number you identified from the previous command<\/pre>\n
<\/span><\/p>\n
Create a rule and configure it as shown in the image above. Reboot the device, and you should be all set.<\/p>\n
Disable RTP processing as follows<\/p>\n
  config voip profile\n  edit default\n  config sip\n  set rtp disable<\/pre>\n
Depending on what is configured as the default support, SIP support can be completely disabled.
\nThe following code sets the SIP SessionHelper as the \u00abdefault\u00bb support and then removes it.
\nAs a result, the Fortigate can no longer provide SIP support because the session helper it is configured to use no longer exists.<\/p>\n
Set the base support to the SessionHelper (kernel-helper-based):<\/p>\n
  config system settings\n  set default-voip-alg-mode kernel-helper-based\n  end<\/pre>\n
Delete the SIP session helper (as described above):<\/p>\n
  config system session-helper\n  show\n ...\n edit \n set name sip\n set protocol 17\n set port 5060\n next\n    ...\n  delete \n  end<\/pre>\n
You can find a complete guide to VoIP configuration for FortiOS 5.6 in this document:\u00a0https:\/\/docs.fortinet.com\/uploaded\/files\/3611\/fortigate-sip-56.pdf<\/a><\/p>\n
pfSense<\/h2>\n
pfSense does not include SIP-ALG by default.<\/p>\n
Adjust the UDP session timeout:
\n<\/span><\/p>\n
SonicWall<\/h2>\n
SonicOS 6.5<\/h3>\n
SIP-ALG is called \u00abSIP Transformations\u00bb in SonicWall. Please\u00a0disable<\/strong>\u00a0Try this setting:
\n<\/span><\/p>\n
Adjust the UPD session timeout (at least 300s):
\n\"image2019-5-24_10-27-6.png\"<\/span><\/p>\n
SonicOS 5.9<\/h3>\n
SIP-ALG is called \u00abSIP Transformations\u00bb in SonicWall. Please\u00a0disable<\/strong>\u00a0Try this setting:
\n<\/span><\/p>\n
Adjust the UPD session timeout (at least 300s):
\n\"image2019-5-24_10-28-8.png\"<\/span><\/p>\n
Sophos<\/h2>\n
On the Sophos firewall, the UDP session timeout setting is changed via the console using the following command (set it to at least 300 seconds):<\/p>\n
\n\n\n<\/colgroup>\n\n\n
console><\/code>set<\/code>packetfilter timeout ip_conntrack_udp_timeout 300<\/code><\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
or<\/p>\n
\n\n\n<\/colgroup>\n\n\n
console><\/code>timeout\u00a0<\/code>set<\/code>packetfilter ip_conntrack_udp_timeout 300<\/code><\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
Disable the SIP module (also known as SIPALG) as follows:<\/p>\n
1. Log in to the CLI using Telnet or SSH. You can also access the CLI from admin > Console in the upper-right corner of the Admin Console screen.<\/p>\n
2. Select an option4. Device Console<\/strong>.<\/p>\n
3. Run the following command(s):<\/p>\n
\n\n\n<\/colgroup>\n\n\n
console> system system_modules sip unload<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
Zyxel USGxx<\/h2>\n
Adjust Settings via the GUI<\/h4>\n
Adjust the UDP session timeout (to at least 300 seconds):
\n<\/span><\/p>\n
SIP-ALG\u00a0disable<\/strong>:
\n<\/span>
\nAfter this setting has been adjusted, a\u00a0Restarting the firewall is required<\/strong>.<\/p>\n
If any of these settings are not available, you must first perform a firmware upgrade to the latest version.<\/p>\n
Check and Adjust the UDP Session Timeout via Telnet<\/h4>\n
    \n
  1. Enable Telnet on USG
    \n\"image2019-5-24_11-11-48.png\"<\/span><\/li>\n
  2. Enable the Telnet client on your PC (Control Panel -> Programs & Features)<\/li>\n
  3. Configure the following settings via Telnet: - Zywall IP address - Username: admin - Password:\n
    \u2013 configure terminal (Switch to command mode)<\/p>\n
    \u2013 show session timeout udp (Check values; default values: Connect 9, Deliver 300 sec.)<\/p>\n
    \u2013 session timeout udp-connect 300 (change the UDP connection timer)<\/p>\n
    \u2013 session timeout udp-deliver 300 (change the UDP deliver timer if it is not set to 300 seconds)<\/p>\n
    \u2013 show session timeout udp (Check the values; both must be 300 sec.)<\/p>\n
    \u2013 exit (exit command mode)<\/p>\n
    \u2013 exit (end the Telnet connection)
    \n<\/span><\/li>\n<\/ol>\n
    The following ZyWall script also works:<\/strong><\/p>\n
    configure terminal \nsession timeout udp-deliver 300\nsession timeout udp-connect 300 \nno alg sip transformation \nno alg sip inactivity-timeout \nno alg sip \nwrite<\/pre>\n
     <\/p>\n
     <\/p>\n
     <\/p>","protected":false},"excerpt":{"rendered":"
    Ben\u00f6tigte Ports & Einstellungen f\u00fcr VoIP Dienst (alle Firewall Modelle)  …<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"doc_category":[42],"doc_tag":[],"class_list":["post-3726","docs","type-docs","status-publish","hentry","doc_category-sip-trunk-anbindungen"],"acf":[],"year_month":"2026-11","word_count":662,"total_views":"35","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"admin-unmwoaed","author_nicename":"admin-unmwoaed","author_url":"https:\/\/www.winet.ch\/en\/author\/admin-unmwoaed\/"},"doc_category_info":[{"term_name":"SIP Trunk Anbindungen","term_url":"https:\/\/www.winet.ch\/en\/wiki-category\/sip-trunk-anbindungen\/"}],"doc_tag_info":[],"yoast_head":"\nEmpfohlene Firewall Einstellungen Winet - Winet<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.winet.ch\/en\/support\/wiki\/configuring-inbound-rules-on-firewalls\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Empfohlene Firewall Einstellungen Winet\" \/>\n<meta property=\"og:description\" content=\"Ben\u00f6tigte Ports & Einstellungen f\u00fcr VoIP Dienst (alle Firewall Modelle) ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.winet.ch\/en\/support\/wiki\/configuring-inbound-rules-on-firewalls\/\" \/>\n<meta property=\"og:site_name\" content=\"Winet\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.winet.ch\\\/support\\\/wiki\\\/konfiguration-inboundrules-auf-firewalls\\\/\",\"url\":\"https:\\\/\\\/www.winet.ch\\\/support\\\/wiki\\\/konfiguration-inboundrules-auf-firewalls\\\/\",\"name\":\"Empfohlene Firewall Einstellungen Winet - Winet\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.winet.ch\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.winet.ch\\\/support\\\/wiki\\\/konfiguration-inboundrules-auf-firewalls\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.winet.ch\\\/support\\\/wiki\\\/konfiguration-inboundrules-auf-firewalls\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kb.iway.ch\\\/download\\\/attachments\\\/2032341\\\/foritgate.png?version=1&modificationDate=1490255231302&api=v2\",\"datePublished\":\"2020-07-20T12:50:32+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.winet.ch\\\/support\\\/wiki\\\/konfiguration-inboundrules-auf-firewalls\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.winet.ch\\\/support\\\/wiki\\\/konfiguration-inboundrules-auf-firewalls\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.winet.ch\\\/support\\\/wiki\\\/konfiguration-inboundrules-auf-firewalls\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kb.iway.ch\\\/download\\\/attachments\\\/2032341\\\/foritgate.png?version=1&modificationDate=1490255231302&api=v2\",\"contentUrl\":\"https:\\\/\\\/kb.iway.ch\\\/download\\\/attachments\\\/2032341\\\/foritgate.png?version=1&modificationDate=1490255231302&api=v2\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.winet.ch\\\/support\\\/wiki\\\/konfiguration-inboundrules-auf-firewalls\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.winet.ch\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Docs\",\"item\":\"https:\\\/\\\/www.winet.ch\\\/wiki-sgdnckyfnvgdfhye\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Empfohlene Firewall Einstellungen Winet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.winet.ch\\\/#website\",\"url\":\"https:\\\/\\\/www.winet.ch\\\/\",\"name\":\"Winet\",\"description\":\"The VoIP Professionals\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.winet.ch\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Recommended Firewall Settings for Winet - Winet","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.winet.ch\/en\/support\/wiki\/configuring-inbound-rules-on-firewalls\/","og_locale":"en_US","og_type":"article","og_title":"Empfohlene Firewall Einstellungen Winet","og_description":"Ben\u00f6tigte Ports & Einstellungen f\u00fcr VoIP Dienst (alle Firewall Modelle) ...","og_url":"https:\/\/www.winet.ch\/en\/support\/wiki\/configuring-inbound-rules-on-firewalls\/","og_site_name":"Winet","og_image":[{"url":"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.winet.ch\/support\/wiki\/konfiguration-inboundrules-auf-firewalls\/","url":"https:\/\/www.winet.ch\/support\/wiki\/konfiguration-inboundrules-auf-firewalls\/","name":"Recommended Firewall Settings for Winet - Winet","isPartOf":{"@id":"https:\/\/www.winet.ch\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.winet.ch\/support\/wiki\/konfiguration-inboundrules-auf-firewalls\/#primaryimage"},"image":{"@id":"https:\/\/www.winet.ch\/support\/wiki\/konfiguration-inboundrules-auf-firewalls\/#primaryimage"},"thumbnailUrl":"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2","datePublished":"2020-07-20T12:50:32+00:00","breadcrumb":{"@id":"https:\/\/www.winet.ch\/support\/wiki\/konfiguration-inboundrules-auf-firewalls\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.winet.ch\/support\/wiki\/konfiguration-inboundrules-auf-firewalls\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.winet.ch\/support\/wiki\/konfiguration-inboundrules-auf-firewalls\/#primaryimage","url":"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2","contentUrl":"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2"},{"@type":"BreadcrumbList","@id":"https:\/\/www.winet.ch\/support\/wiki\/konfiguration-inboundrules-auf-firewalls\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.winet.ch\/"},{"@type":"ListItem","position":2,"name":"Docs","item":"https:\/\/www.winet.ch\/wiki-sgdnckyfnvgdfhye\/"},{"@type":"ListItem","position":3,"name":"Empfohlene Firewall Einstellungen Winet"}]},{"@type":"WebSite","@id":"https:\/\/www.winet.ch\/#website","url":"https:\/\/www.winet.ch\/","name":"Winet","description":"The VoIP Professionals","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.winet.ch\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/docs\/3726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/comments?post=3726"}],"version-history":[{"count":0,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/docs\/3726\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/media?parent=3726"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/doc_category?post=3726"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/doc_tag?post=3726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}