Block PRIVATE Unknown # - OBIHAI OBi202 ATA

[Vincent B]

Hi Support,
I have encountered a problem. I receive around 3 – 4 calls per hour from a PRIVATE Unknown #, this situation has lasted for several days. My ATA is OBIHAI OBi202. Could you please suggest how to solve this problem with my ATA?

Thanks

[Mango]

Check your call logs on the Freephoneline website. Do the calls appear there? Let us know as the troubleshooting is different depending on how the calls are arriving to your device.

[Vincent B]

These calls do not appear in the call logs on Freephoneline website.

[Mango]

Thanks for confirming this. In that case, the calls are from SIP scanners. To solve the problem, please set the following:

Voice Services >> SPx Service:

X_UserAgentPort: 52720
The above number is a random number; you can use any valid UDP port number.

X_InboundCallRoute: {>1xxxxxxxxxx:ph}

Note: replace 1xxxxxxxxxx with your FPL number.

After you make these changes, reboot your device, and make a test call to yourself with your cell phone to be sure things still work properly.

[kevinck]

The default obihai user agent port is 5080. And i assume sip scanners are targetting that port.

Is there any downside to switching to a random upper range UDP port even if you're not currently getting scanner calls? Or is it a 100% everyone should do it good practice to at least be a first line of defense?

[adit]

You don't need to do both. You can keep the standard port, if you use the second option ("Oleg's method"). On newer firmware there is even a build in option (default is disabled, however). Read details here: http://obitalk.com/forum/index.php?topic=5467.0

[Mango]

Is there any downside to switching to a random upper range UDP port even if you're not currently getting scanner calls? Or is it a 100% everyone should do it good practice to at least be a first line of defense?

In my opinion there is zero downside and I think it is good practice. Even if you're using the Oleg Method and your phone doesn't ring for scanner calls, if you're using a common port number the scanners can still attempt to brute force and/or DoS your ATA.

If you're not receiving scanner calls and your InboundCallRoute is set to ph (i.e. you're not using the Oleg Method) perhaps your router operates restricted cone NAT. This means your router's firewall is protecting your ATA. This is a good thing! In that case it doesn't matter if you use a common port number because the firewall will drop any unsolicited traffic. I have a restricted cone NAT router, but I have my X_UserAgentPort set to a high/random number as a matter of course, in case for example I one day travel with the adapter and it gets installed behind a full cone NAT router.

Edit to add: using a high/random port number may bypass your router's SIP ALG if it has one, and you will need to update any SIP URIs if you are receiving direct SIP calls. This will not apply to the vast majority of home users, who will use registration for NAT traversal and inbound calls.

[kevinck]

You don't need to do both. You can keep the standard port, if you use the second option ("Oleg's method"). On newer firmware there is even a build in option (default is disabled, however). Read details here: http://obitalk.com/forum/index.php?topic=5467.0

Very informative thread thanks. I notice you say newer firmware has a built in option. I cannot find this? I would think there must be a checkbox and if checked it just appends the oleg bit onto your route.

I am using the obitalk expert portal to set things. So i had to override the obitalk settings for X_InboundCallRoute to implement oleg's method and that works fine. But now if i use the portal to, for example, add a new trusted caller, my overrided settings are not updated and i won't have the new trusted caller unless i go and make the change manually in obitalk expert or turn off my manual change and go back to obitalk defaults.

Sip Provider : freephoneline.ca
ModelName OBi200
HardwareVersion 1.4
SoftwareVersion 3.0.1 (Build: 4477)

[adit]

The latest firmware can be downloaded from here: http://www.obitalk.com/forum/index.php?topic=9.0. I think OBI20x have the option (not sure, I have the "old" Oleg's method on mine and did not feel like changing it. There is some discussion about the feature in one thread in the firmware section of that forum.I think the option is called X_EnforceRequestUserID and it is a checkbox. From what I remember reading , the options "needs provider support" (but looks like FPL has the required support) and Oleg's method works with any provider. If you have time and want to play with it you can try both.

Also as a note, I specifically have opened ports for my ATA (see OBI FAQs for which ports you need) , if not I had the one way audio problem. I'm not an expert, but depending of different configurations you may have your router firewall blocking the SIP scanners (if you manage to get the ATA working without any ports opened).