{"id":3726,"date":"2020-07-20T14:50:32","date_gmt":"2020-07-20T12:50:32","guid":{"rendered":"https:\/\/www.winet.ch\/?post_type=docs&p=3726"},"modified":"2022-07-12T11:50:18","modified_gmt":"2022-07-12T09:50:18","password":"","slug":"konfiguration-inboundrules-auf-firewalls","status":"publish","type":"docs","link":"https:\/\/www.winet.ch\/en\/docs\/konfiguration-inboundrules-auf-firewalls\/","title":{"rendered":"Recommended firewall settings Winet"},"content":{"rendered":"

Required ports & settings for VoIP service (all firewall models)<\/h1>\n

For Winet SIP Trunk<\/h2>\n

Telephone system or telephone terminals in the customer's LAN<\/p>\n

\n\n\n\n<\/colgroup>\n\n\n\n\n\n
SIP<\/td>\nport\u00a05060<\/strong>\u00a0UDP to the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , incoming as well as outgoing<\/td>\n<\/tr>\n
RTP<\/td>\nPorts\u00a010'000 - 20'000<\/strong>\u00a0UDP to the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , incoming as well as outgoing<\/td>\n<\/tr>\n
UDP timeout<\/td>\nmin. 300s\u00a0<\/strong><\/td>\n<\/tr>\n
SIP-ALG<\/td>\ndisable<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

For Winet Ayrix & hostedPBX<\/h2>\n
\n\n\n\n<\/colgroup>\n\n\n\n\n\n\n
SIP<\/td>\nPorts\u00a05060\u00a0<\/strong>UDP to the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , incoming as well as outgoing<\/td>\n<\/tr>\n
RTP<\/td>\nPorts\u00a010000 - 20000\u00a0<\/strong>UDP to the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , incoming as well as outgoing<\/td>\n<\/tr>\n
CTI clients<\/td>\nPorts\u00a05038<\/strong>\u00a0<\/strong>TCP to the\u00a0Subnet 185.109.0.0\/22<\/strong>\u00a0(255.255.252.0) , incoming as well as outgoing<\/td>\n<\/tr>\n
UDP timeout<\/td>\nmin. 300s<\/strong><\/td>\n<\/tr>\n
SIP-ALG<\/td>\ndisable<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Additional settings for individual firewall models<\/h1>\n

Here you can find screenshots and quick guides to the most common firewalls.<\/p>\n

Fortigate (Fortinet)<\/h2>\n

It is recommended to follow the following instructions:\u00a0http:\/\/kb.fortinet.com\/kb\/documentLink.do?externalID=FD33271<\/a><\/p>\n

How to disable SIP-ALG (SIP Helper) on Fortinet<\/strong><\/p>\n

Open the Fortigate CLI from the dashboard. Enter the following commands in FortiGate's CLI:<\/p>\n

  config system settings\r\n  set sip-helper disable\r\n  set sip-nat-trace disable\r\n  reboot the device<\/pre>\n
Reopen the FortiGate CLI and enter the following commands (do not enter the text after \/\/)<\/p>\n
  config system session-helper\r\n  show \/\/ you need to find the entry for SIP, usually 12, but it may vary\r\n  delete 12 \/\/ or the number that you identified from the previous command<\/pre>\n
<\/span><\/p>\n
Create a rule and set it like in the picture above Reboot the device and you should be ready<\/p>\n
Disable RTP processing as follows<\/p>\n
  config voip profile\r\n  edit default\r\n  config sip\r\n  set rtp disable<\/pre>\n
Depending on what is configured as basic support, SIP support can be turned off completely.
\nSubsequently, the SIP Sessionhelper is set as \"basic\" support and deleted.
\nWith this, the Fortigate can no longer provide SIP support because the session helper it is configured to no longer exists.<\/p>\n
Base support on the session helper (kernel-helper-based):<\/p>\n
  config system settings\r\n  set default-voip-alg-mode kernel-helper-based\r\n  end<\/pre>\n
Delete SIP Sessionhelper (as above):<\/p>\n
  config system session-helper\r\n  show\r\n     ...\r\n     edit \r\n         set name sip\r\n         set protocol 17\r\n         set port 5060\r\n     next\r\n    ...\r\n  delete \r\n  end<\/pre>\n
A complete VoIP configuration guide for FortiOS 5.6 can be found in this document:\u00a0https:\/\/docs.fortinet.com\/uploaded\/files\/3611\/fortigate-sip-56.pdf<\/a><\/p>\n
pfSense<\/h2>\n
The pfSense does not contain a SIP ALG by default.<\/p>\n
Adjust UDP session timeout:
\n<\/span><\/p>\n
Sonicwall<\/h2>\n
SonicOS 6.5<\/h3>\n
SIP-ALG is called \"SIP Transformations\" at Sonicwall. Please\u00a0disable<\/strong>\u00a0you this setting:
\n<\/span><\/p>\n
Adjust UPD session timeout (at least 300s):
\n\"image2019-5-24_10-27-6.png\"<\/span><\/p>\n
SonicOS 5.9<\/h3>\n
SIP-ALG is called \"SIP Transformations\" at Sonicwall. Please\u00a0disable<\/strong>\u00a0you this setting:
\n<\/span><\/p>\n
Adjust UPD session timeout (at least 300s):
\n\"image2019-5-24_10-28-8.png\"<\/span><\/p>\n
Sophos<\/h2>\n
For the Sophos firewall, the UDP session timeout setting is changed via the console with the following command (set at least 300s):<\/p>\n
\n\n\n<\/colgroup>\n\n\n
console><\/code>set<\/code>packetfilter timeout ip_conntrack_udp_timeout 300<\/code><\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
or<\/p>\n
\n\n\n<\/colgroup>\n\n\n
console><\/code>timeout\u00a0<\/code>set<\/code>packetfilter ip_conntrack_udp_timeout 300<\/code><\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
Disable the SIP module (a.k.a. SIPALG) as follows:<\/p>\n
Log in to the CLI using Telnet or SSH. You can also access the CLI from admin > Console in the upper right corner of the Admin Console screen.<\/p>\n
2. choose option4. device console<\/strong>.<\/p>\n
Execute the following command(s):<\/p>\n
\n\n\n<\/colgroup>\n\n\n
console> system system_modules sip unload<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
Zyxel USGxx<\/h2>\n
Adjust settings via GUI<\/h4>\n
Adjust UDP session timeout (to at least 300s):
\n<\/span><\/p>\n
SIP-ALG\u00a0disable<\/strong>:
\n<\/span>
\nAfter this setting has been adjusted a\u00a0Restart of the firewall mandatory<\/strong>.<\/p>\n
If one of these settings is not available, a firmware upgrade to the latest firmware must be made first.<\/p>\n
Check and adjust UDP session timeout via Telnet<\/h4>\n
    \n
  1. Enable Telnet on USG
    \n\"image2019-5-24_11-11-48.png\"<\/span><\/li>\n
  2. Activate Telnet client on PC (Control Panel -> Programs & Features)<\/li>\n
  3. Via Telnet make the following settings- IP address of the Zywall- Username: admin- Password:\n
    - configure terminal (switch to command mode)<\/p>\n
    - show session timeout udp (check values, default values: Connect 9, Deliver 300 sec.)<\/p>\n
    - session timeout udp-connect 300 (change the connect UDP timer)<\/p>\n
    - session timeout udp-deliver 300 (change the deliver UDP timer if it is not 300 sec.)<\/p>\n
    - show session timeout udp (check values, both must be 300 sec.)<\/p>\n
    - exit (exit the command mode)<\/p>\n
    - exit (terminate the telnet connection)
    \n<\/span><\/li>\n<\/ol>\n
    The following ZyWall script also works:<\/strong><\/p>\n
    configure terminal\r\nsession timeout udp-deliver 300\r\nsession timeout udp-connect 300\r\nno alg sip transformation\r\nno alg sip inactivity-timeout\r\nno alg sip\r\nwrite<\/pre>\n
     <\/p>\n
     <\/p>\n
     <\/p>","protected":false},"excerpt":{"rendered":"
    Ben\u00f6tigte Ports & Einstellungen f\u00fcr VoIP Dienst (alle Firewall Modelle) F\u00fcr Winet SIP Trunk Telefonanlage oder Telefon-Endger\u00e4te im LAN des  […]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"doc_category":[62],"doc_tag":[],"class_list":["post-3726","docs","type-docs","status-publish","hentry","doc_category-sip-trunk-anbindungen"],"acf":[],"year_month":"2026-05","word_count":662,"total_views":"6066","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Daniel Maier","author_nicename":"windama","author_url":"https:\/\/www.winet.ch\/en\/author\/windama\/"},"doc_category_info":[{"term_name":"SIP Trunk Anbindungen","term_url":"https:\/\/www.winet.ch\/en\/docs-category\/sip-trunk-anbindungen\/"}],"doc_tag_info":[],"yoast_head":"\nEmpfohlene Firewall Einstellungen Winet | Winet<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.winet.ch\/en\/docs\/konfiguration-inboundrules-auf-firewalls\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Empfohlene Firewall Einstellungen Winet\" \/>\n<meta property=\"og:description\" content=\"Ben\u00f6tigte Ports & Einstellungen f\u00fcr VoIP Dienst (alle Firewall Modelle) F\u00fcr Winet SIP Trunk Telefonanlage oder Telefon-Endger\u00e4te im LAN des [...]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.winet.ch\/en\/docs\/konfiguration-inboundrules-auf-firewalls\/\" \/>\n<meta property=\"og:site_name\" content=\"Winet\" \/>\n<meta property=\"article:modified_time\" content=\"2022-07-12T09:50:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.winet.ch\\\/docs\\\/konfiguration-inboundrules-auf-firewalls\\\/\",\"url\":\"https:\\\/\\\/www.winet.ch\\\/docs\\\/konfiguration-inboundrules-auf-firewalls\\\/\",\"name\":\"Empfohlene Firewall Einstellungen Winet | Winet\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.winet.ch\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.winet.ch\\\/docs\\\/konfiguration-inboundrules-auf-firewalls\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.winet.ch\\\/docs\\\/konfiguration-inboundrules-auf-firewalls\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kb.iway.ch\\\/download\\\/attachments\\\/2032341\\\/foritgate.png?version=1&modificationDate=1490255231302&api=v2\",\"datePublished\":\"2020-07-20T12:50:32+00:00\",\"dateModified\":\"2022-07-12T09:50:18+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.winet.ch\\\/docs\\\/konfiguration-inboundrules-auf-firewalls\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.winet.ch\\\/docs\\\/konfiguration-inboundrules-auf-firewalls\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.winet.ch\\\/docs\\\/konfiguration-inboundrules-auf-firewalls\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kb.iway.ch\\\/download\\\/attachments\\\/2032341\\\/foritgate.png?version=1&modificationDate=1490255231302&api=v2\",\"contentUrl\":\"https:\\\/\\\/kb.iway.ch\\\/download\\\/attachments\\\/2032341\\\/foritgate.png?version=1&modificationDate=1490255231302&api=v2\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.winet.ch\\\/docs\\\/konfiguration-inboundrules-auf-firewalls\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.winet.ch\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Docs\",\"item\":\"https:\\\/\\\/www.winet.ch\\\/docs\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Empfohlene Firewall Einstellungen Winet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.winet.ch\\\/#website\",\"url\":\"https:\\\/\\\/www.winet.ch\\\/\",\"name\":\"Winet\",\"description\":\"The VoIP Professionals.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.winet.ch\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Recommended firewall settings Winet | Winet","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.winet.ch\/en\/docs\/konfiguration-inboundrules-auf-firewalls\/","og_locale":"en_US","og_type":"article","og_title":"Empfohlene Firewall Einstellungen Winet","og_description":"Ben\u00f6tigte Ports & Einstellungen f\u00fcr VoIP Dienst (alle Firewall Modelle) F\u00fcr Winet SIP Trunk Telefonanlage oder Telefon-Endger\u00e4te im LAN des [...]","og_url":"https:\/\/www.winet.ch\/en\/docs\/konfiguration-inboundrules-auf-firewalls\/","og_site_name":"Winet","article_modified_time":"2022-07-12T09:50:18+00:00","og_image":[{"url":"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.winet.ch\/docs\/konfiguration-inboundrules-auf-firewalls\/","url":"https:\/\/www.winet.ch\/docs\/konfiguration-inboundrules-auf-firewalls\/","name":"Recommended firewall settings Winet | Winet","isPartOf":{"@id":"https:\/\/www.winet.ch\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.winet.ch\/docs\/konfiguration-inboundrules-auf-firewalls\/#primaryimage"},"image":{"@id":"https:\/\/www.winet.ch\/docs\/konfiguration-inboundrules-auf-firewalls\/#primaryimage"},"thumbnailUrl":"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2","datePublished":"2020-07-20T12:50:32+00:00","dateModified":"2022-07-12T09:50:18+00:00","breadcrumb":{"@id":"https:\/\/www.winet.ch\/docs\/konfiguration-inboundrules-auf-firewalls\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.winet.ch\/docs\/konfiguration-inboundrules-auf-firewalls\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.winet.ch\/docs\/konfiguration-inboundrules-auf-firewalls\/#primaryimage","url":"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2","contentUrl":"https:\/\/kb.iway.ch\/download\/attachments\/2032341\/foritgate.png?version=1&modificationDate=1490255231302&api=v2"},{"@type":"BreadcrumbList","@id":"https:\/\/www.winet.ch\/docs\/konfiguration-inboundrules-auf-firewalls\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.winet.ch\/"},{"@type":"ListItem","position":2,"name":"Docs","item":"https:\/\/www.winet.ch\/docs\/"},{"@type":"ListItem","position":3,"name":"Empfohlene Firewall Einstellungen Winet"}]},{"@type":"WebSite","@id":"https:\/\/www.winet.ch\/#website","url":"https:\/\/www.winet.ch\/","name":"Winet","description":"The VoIP Professionals.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.winet.ch\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/docs\/3726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/comments?post=3726"}],"version-history":[{"count":0,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/docs\/3726\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/media?parent=3726"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/doc_category?post=3726"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/www.winet.ch\/en\/wp-json\/wp\/v2\/doc_tag?post=3726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}