2

I have the current rules in an attempt to open port 5060 and 10000-20000 for my VoIP provider. We are on a Cisco 1921 router. This ACL is applied to the WAN port on the router facing the ISP. Nmap port scan shows these ports as closed.

  1. Can anyone help verify my ACL and correct my rule if necessary?
  2. Do I need an outbound ACL to open up the port as well since this is for a hosted VoIP PBX?
  3. Is Nmap not detecting the open port because I am not the specific host for the ACL? I tried some other ports that are not specific to a public IP and Nmap also shows as closed.
  4. Do my L3 switches behind the router also need an ACL to open ports if they are between the PC and the router?

Router Config

interface GigabitEthernet0/0
 description WAN
 ip address x.x.x.x 255.255.255.240
 ip access-group 101 in
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 description LAN
 ip address 192.168.1.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
access-list 101 permit udp host x.x.x.x any eq 5060
access-list 101 permit udp host x.x.x.x any range 10000 20000

Nmap Port Scan

Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-04 16:24 PST
Nmap scan report for
Host is up (0.022s latency).
PORT     STATE  SERVICE
5060/udp closed sip

Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-04 16:24 PST
Nmap scan report for 
Host is up (0.023s latency).
PORT      STATE  SERVICE
10000/udp closed ndmp


Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-04 16:24 PST
Nmap scan report for wsip-184-191-183-54.sd.sd.cox.net (184.191.183.54)
Host is up (0.026s latency).
PORT      STATE  SERVICE
20000/udp closed unknown
Improve this question
8
  • Do UDP ports show up as open during an Nmap scan? Especially for services like VoIP where the actual service on the port would only be active while in use.
    – cpt_fink
    Commented Mar 5, 2015 at 5:36
  • Nmap does not show the ports open
    – Kev
    Commented Mar 5, 2015 at 5:42
  • Obviously you've stated that... On a functioning system, will UDP ports that are not ACL'd show as open if a service is not actively running?
    – cpt_fink
    Commented Mar 5, 2015 at 5:43
  • Yes, port scanners like Nmap create packets that simulate an attempted connection to the ports and reports if it receives an acknowledgement
    – Kev
    Commented Mar 5, 2015 at 5:45
  • 1
    Just because packets don't get "bounced back" doesn't mean the port is open; you only get this behavior when a firewall is configured to reject packets. ACLs will generally drop packets and not send a reject, so on a closed port packets won't be "bounced back."
    – YLearn
    Commented Mar 5, 2015 at 18:04

1 Answer 1

Reset to default
2

You should not need an outbound ACL, based on the configuration shown the outbound path is not restricted.

You quote two lines of the inbound ACL:

access-list 101 permit udp host x.x.x.x any eq 5060
access-list 101 permit udp host x.x.x.x any range 10000 20000

I assume the external IP X.X.X.X can reach any internal IP, using 5060 or 10000-20000 as the internal destination's port.

If that's correct then that's fine (it's not clear to me from the question). However, if it's the source port (on the external server) that's using 5060 or 10000 to 20000 and the destination port doesn't happen to be the same then you'd need something like:

access-list 101 permit udp host x.x.x.x eq 5060 any
access-list 101 permit udp host x.x.x.x  range 10000 20000 any

Also, I would refer to the hosted PBX's instructions on NAT because if they are trying to reach into VoIP devices on your network without them first reaching out, then there may be issues.

Improve this answer
1
  • I accepted Mike's answer because he wrote up an explanation. VoIP companies suck, just get a stateful firewall or add "established" to your ACLs which is less secure.
    – Kev
    Commented Oct 20, 2017 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.