How to block incoming VOIP traffic that appears to be hacking attempts

How to block incoming VOIP traffic that appears to be hacking attempts

How to block incoming VOIP traffic that appears to be hacking attempts
How to block incoming VOIP traffic that appears to be hacking attempts
a week ago
Model: Archer VX1800v  
Hardware Version: V1
Firmware Version: 0.13.0 2.0.0 v6092.0 Build 240925 Rel.11089n

Hi there, I'm posting about some suspicious network traffic that I believe may be causing regular disconnections for us. The system log regularly reports a barrage of the following:


2025-02-25 04:10:37 [6] VoIP: can not find any account forthe incoming call

 

We will then see an error suggesting that we've had our connection terminated by the network. I've restarted the router since, so I don't have an exact log. The DSL light will go orange, and then eventually reconnect.
 

We don't use the VoIP service that our ISP (iiNET) provides, there's nothing configured in our router to allow incoming or outgoing calls, plus I've set a 24/7 DnD, even though it's unlikely to do anything in this instance.

 

I want to try and blog ports 5060 and 5061 since they are the ports used for VoIP, but I can't find a way to do that for incoming, only outgoing in the Service Filtering page. I'm using the Access Control page to set a whitelist the router, our Deco Mesh base device, and a couple of our PCs, so we can maintain and check the router status, etc.

 

Is there a way to block ports for incoming data with the VX1800v, and how so? I'd like to try and get this sorted to ensure that it's not these attempts at incoming connections that's causing us disconnections, and I can then push on iiNET/NBN to do more about the issue. And if it is these attacks I can at least stop the issue in it's tracks.

 

Thanks in advance for any and all help provided. ;) 

 

  0      
  0      
#1
Options
5 Reply
Re:How to block incoming VOIP traffic that appears to be hacking attempts
Tuesday - last edited Wednesday

  @LonePhantom 

 

Have you tried to disable the service in the Basic=>Telephony menu ?

Also you may try disabling the SIP ALG - details.

Check your Advanced=>NAT Forwarding=>Virtual Servers for open ports.

If the ports in question are not explicitly open, they are closed by default.

Check your Advanced=>NAT Forwarding=>DMZ for any configuration and disable if necessary.

Disable Advanced=>NAT Forwarding=>UPnP if enabled.

If this was helpful click on the arrow pointing upward to make it blue. If this solves your issue, click the star to make it blue and mark the post as a "Recommended Solution".
  0  
  0  
#2
Options
Re:How to block incoming VOIP traffic that appears to be hacking attempts
Tuesday

  @terziyski Thanks for your response. The first option wasn't in my basic telephony menu, but I've disabled SIP ALG, and I'll keep an eye on what happens there.

  0  
  0  
#3
Options
Re:How to block incoming VOIP traffic that appears to be hacking attempts
Tuesday

  @terziyski I just checked my log, and the same VoIP entries are coming through. :(

  0  
  0  
#4
Options
Re:How to block incoming VOIP traffic that appears to be hacking attempts
Wednesday - last edited Wednesday

  @LonePhantom 

 

The message " VoIP: can not find any account for the incoming call " is not a particular concern because you don't have any configuration settings for the VoIP service from your ISP - VX1800v just notifies you about this.

All you have to do is to make sure that you've reviewed the settings from my first post for any open ports on your VX1800v.

The disconnections that you're describing can be caused from an ISP unstable service and they may have nothing to do with a service (VoIP) that you're not using at all.

Contact your ISP and ask to be advised about these disruptions to pinpoint the root cause of the issue.

If this was helpful click on the arrow pointing upward to make it blue. If this solves your issue, click the star to make it blue and mark the post as a "Recommended Solution".
  0  
  0  
#5
Options
Re:How to block incoming VOIP traffic that appears to be hacking attempts
Wednesday
@terziyski Nothing set up in Virtual Servers. Nothing enabled or set in DMZ And I disabled UPnP a few days ago. So would my actual disconnections not be related to that bombardment of VoIP related logs? My reading is that hackers do use VoIP ports to gain access, hence my concern. Thanks again for your assistance.
  0  
  0  
#6
Options