%20and%20domain%20names%20(e.g.webp)
WiFi calling is an essential feature that ensures seamless voice calls when cellular signals are weak. However, if you have a firewall with strict outbound filtering, WiFi calling might not work properly unless you allow the necessary ports and domains.
In this guide, I’ve compiled the correct firewall rules for enabling WiFi calling on the three major U.S. carriers AT&T, Verizon, and T-Mobile as well as Google Fi. This information is often scattered across forums and carrier support pages, so my goal is to provide a centralized reference.
Why Your Firewall Might Block WiFi Calling
WiFi calling depends on specific ports and protocols to securely connect your mobile device to the carrier's network. Many firewalls block or inspect IPSec, SIP, and HTTPS traffic, which can interfere with call setup and quality. Configuring your firewall to allow the correct traffic ensures uninterrupted WiFi calling.
WiFi Calling Firewall Rules by Carrier
Verizon WiFi Calling Settings
- Ports to Allow:
- UDP 500, 4500
- TCP 143
- Destination FQDNs (Fully Qualified Domain Names):
spg.vzw.comwo.vzwwo.comsg.vzwfemto.com
AT&T Wireless WiFi Calling Settings
- Ports to Allow:
- UDP 500, 4500
- TCP 143
- Destination FQDNs:
epdg.epc.att.netsentitlement2.mobile.att.netvvm.mobile.att.net
Google Fi WiFi Calling Settings
- Ports to Allow:
- UDP & TCP 5060, 5061
- TCP 443
- Destination FQDNs:
voice.google.com
T-Mobile WiFi Calling Settings
- Ports & Destination Networks:
- UDP 500, 4500, and TCP/UDP 5061 →
208.54.0.0/16 - TCP 443, 993 →
66.94.0.0/19
- UDP 500, 4500, and TCP/UDP 5061 →
Best Practices for Configuring Your Firewall
- Allow outbound UDP traffic on required ports (especially 500, 4500 for IPSec tunneling).
- Ensure TCP/UDP 5060, 5061 are open for SIP signaling (Google Fi and T-Mobile).
- Whitelisting carrier FQDNs and IP ranges can help avoid issues with content filtering.
- Disable deep packet inspection (DPI) on IPSec traffic, if your firewall supports it.
- Enable NAT traversal (NAT-T) to avoid issues with UDP encapsulation.
- Ensure a valid NTP source as some carriers rely on time synchronization.
Final Thoughts & Future Updates
This is a preliminary guide, and I plan to update it as I gather more information or test additional configurations. If you have any firewall settings that have worked for other carriers, let me know in the comments!
By properly configuring your firewall, you can enjoy seamless WiFi calling without sacrificing network security. Stay tuned for updates as I refine this guide with more details.
There is a new flavor of protocol reflection attacks on the streets!
The TCP Middlebox reflection attack is the first reflection attack to utilize the TCP protocol. Traditionally the TCP protocol was not susceptible to spoofed source packets because of its state based nature (three way handshake). Researchers at University of Maryland and the University of Colorado discovered that many network devices, such as load balancers, proxies, and firewalls, could be susceptible to specifically-crafted packets that could generate amplified traffic (up to 65x) at a victim. These devices could be inherently susceptible to the spoofing because many of these devices have to contend with Asynchronous network traffic and out of order packets.
Akamai did a really great write up on what they saw and how they mitigated the attack. https://www.akamai.com/blog/security/tcp-middlebox-reflection
Shadow Server also has a write up. https://www.shadowserver.org/news/over-18-8-million-ips-vulnerable-to-middlebox-tcp-reflection-ddos-attacks/
So on to your firewalls:
The out of the box Palo Alto Firewalls do not appear to have any mitigation configured by default to protect against this attack. But its not the end of the world. Palo Alto and many other security vendors have low level TCP protection that basically normalizes TCP traffic and cuts out the flood attacks, malformed protocol attacks, etc., before they are even processed by your firewall. This minimizes impact on the device resources like CPU and memory for these types of attacks.
In the Palo Alto world this is called "Zone Protection Profiles". If you run BPA (Best Practice Assessment) - which you should - then the Zone Protection Profiles are often flagged if you don't have them configured.
The zone protection profile is pretty strait-forward to set up but, before you start, you need to do a little research and investigation into your device
- You need to determine the maximum CPS or connections per second your device can handle. This is a list of devices and their specs on the Palo Alto Networks site. https://www.paloaltonetworks.com/products/product-selection
- Next you will want capture some metrics around how many CPS your devices are seeing. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/zone-protection-and-dos-protection/zone-defense/take-baseline-cps-measurements-for-setting-flood-thresholds/how-to-measure-cps
- Next you will want to do a few calculations and configure your zone protection profile. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/zone-protection-and-dos-protection/zone-defense/zone-protection-profiles
Here is the "Cool SH*T Props" to Palo Alto Networks...when you create a zone protection profile, by default under the Packet Based Protection > and > 'TCP Drop the TCP SYN with Data' and 'TCP SYN ACK with Data' are already checked. This means when you apply your newly configured zone protection profile to your security zone it will protect you from current Middlebox vulnerability by dropping any of the cleverly crafted SYN packets because they would be larger then 0 bytes.
Yeah!
So I wanted to post a little bonus. Here is a quick and easy flood protection calculator I threw together in google sheets, just add your average CPS.
Symptoms
As people become more focused on securing their home network, the idea of a "enterprise" firewall for home use is not out of the ordinary. Of course, this focus has grown over time because of teleworking/job requirements but also because some people realize that securing their home network is just as important as securing their "enterprise" network. Of course for us gamers, this causes an issue. I have be given the benefit to use my own Palo Alto Networks (PAN) PA-220 firewall for home use. While the initial setup didn't cause any issues, I had one major issue which was almost make or break for keeping the PA-220. The issue of course was my Xbox One did not function properly and I could not update games, group chat, or do anything an Xbox One should do.Issue
When connecting to the Xbox Live service or PlayStation Network the console establishes client connections to the service. When hosting some games, or using some applications, a connection from the Xbox Live service or PlayStation Network inbound to the console is required. If these inbound connections can not be established then the console will report that strict NAT has been detected.The consoles are compatible with uPnP devices to allow dynamic opening of TCP and UDP ports to forward traffic required for connectivity to the service. uPnP-enabled routers allow port forwarding to be configured on the device dynamically based on requests coming from internal devices. In a uPnP environment, the console will request the appropriate ports be forwarded to allow the traffic.
Palo Alto Networks firewalls are not compatible with uPnP. Requests from a console via uPnP to open ports will be ignored by the firewall. A 1-to-1 static NAT mapping must be created to forward the appropriate ports to the console from the Xbox Live service or PSN.
Resolution
The following is my configuration setup to fix my Xbox One as well as other gaming consoles which need Universal Plug and Play (UPnP).Quick Tangent: While UPnP is a great idea to make home networking easier, it opens up the inside resources to many potential attacks. At a basic level, UPnP allows devices to discover each other on the same network dynamically so that all devices can communicate with each other for data sharing and entertainment purposes. While this sounds good, the security risk is that UPnP also dynamically adds port forwarding to the home router without human invention. This dynamic port forwarding allows for any and all ports to have access inside the network from the outside Internet without no protection. It is for this reason that any "enterprise" firewall will NEVER support UPnP. Of course, when it comes to gaming and our relaxation time, we don't care about the risks we just want our games to work.
The following configuration assumes that all basic connectivity has already been configured on your PA-220. The following configuration is my current setup and has never had any issues since the day I configured it.
The below is an extremely basic PA-220 configuration but the security policy that I want to highlight is the Outbound-Xbox Rule.
All firewall polices are created under Polices>>Security>>Add
Note: The Outbound-Xbox NAT must be above the general Outbound Internet Rule otherwise the Xbox traffic will never hit the dedicated Xbox NAT rule (this to be created next).
Xbox Security Rule:
I configured my Xbox Security Policy to use the dedicated or reserved ip address, this will be the source address (Creating a DHCP address reservation is not covered in this article)
- The source is my dedicated Xbox/Gaming reserved address as I only wanted to NAT my Xbox traffic
- The destination is to my UnTrust Zone or Outside security zone.
- Application: This is the bread and butter of Palo Alto's Next Generation Firewall
- The list in the image below are the applications which I have fingerprinted at the time of this article. As applications default ports change and Microsoft adds more application, this field will need to be updated from time to time.
- Please note: A Layer 4 firewall rule will work but what is the point in having a Ferrari in the garage if you're not going to use it to its potential.
- Action; of course allow
The below is an extremely basic PA-220 configuration but the NAT policy that I want to highlight is the Xbox_NAT rule.
All firewall NAT polices are created under Polices>>NAT>>Add
Xbox NAT Rule:
I configured my Xbox NAT Policy to have a dedicated source address (Creating a DHCP address is not covered in this article)
- The packet source is from the Trust/Inside Network
- The packet destination is to my UnTrust Zone or Outside
- The packet destination interface is the interface facing my ISP/Dynamic Client
- The source is my dedicated Xbox/Gaming reserved address as I only wanted to NAT my Xbox traffic
- The packet destination and service are set to ANY as we want all traffic from the Xbox to be NAT'd
- Translated Packet
- The source translated packet must be a fixed static-ip address
- The IP missing below MUST be the IP address given to your home "modem" now firewall by the ISP.
- NOTE: If the address assigned to your Internet Layer3 link ever changes, this NAT rule MUST be updated. Since having this implemented for over a year, I have never had to change this address as the ISP want to be stable and followings the basic rules of DHCP. My ISP always assigned me the same address when my DHCP reservation renews
- The last major configuration is to check "bi-drectional: yes".
If the above NAT rule and security policy are configured with the proper information, all UPnP issues with be a problem of the past. I have never had an issue except to add applications to my security policy from time-to-time. I have used this configuration on multiple PA-220s and it works every time without any issues. Without the above rules, some games might work but group chat will always be broken.
For information on how to configure a static 1-to-1 destination NAT policy, or bi-directional NAT mapping please refer to the Understanding PAN-OS NAT document.
Please enjoy and hopefully this will help anyone avoid the headaches and research that I went through along with trail and error. Also, hopefully this configuration will allow everyone, including myself, the ability to keep our games but also make sure we are securing and protecting on valuable resources on the inside of the network. With this configuration, we have the ability to function without any issues as well as protect the network from UPnP vulnerabilities that all gaming systems rely on; especially Xbox/Microsoft.
Two cool new exploits have been released complete with cool names and graphics. Welcome Meltdown and Spectre, these critical vulnerabilities exploit pretty much all modern processors. Even though these hardware vulnerabilities have been around forever, four independent groups of researchers discovered these vulnerabilities simultaneously. Meltdown and Spectre at a high level allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs.
Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. But what about our network and security equipment using modern processors, are they vulnerable? Below is a list I put together of links to vendors sites and their responses to the vulnerabilities. I imagine most of them will keep these pages up to date as they discover new information. This is a complicated and low level issue so most vendors are going to need time to really evaluate their products and create patches.
Luckily in most cases it is an attack that is performed through the management access, so if you follow the best practice of limiting device management access from only trusted IPs or networks you should be good until the patches are released.
PaloAlto Networks
"Our initial review of the vulnerabilities disclosed in the research concludes that all PAN-OS/Panorama platforms are not directly impacted by these attacks. There are no immediate plans to release a software update to PAN-OS in response to these issues at this time"F5
"ImpactFor products with None in the Versions known to be vulnerable column, there is no impact. For products with ** in the various columns, F5 is still researching the issue and will update this article after confirming the required information. F5 Technical Support has no additional information about this issue.
BIG-IP
All three vulnerabilities require an attacker capable of providing and running binary code of their choosing on the BIG-IP platform. This raises a high bar for attackers attempting to target BIG-IP systems over a network and would require an additional, un-patched, user-space remote code execution vulnerability to exploit these new issues. The only administrative roles on a BIG-IP system that can execute binary code or exploitable analogs, such as JavaScript, are the Administrator and Resource Administrator roles. These users already have nearly complete access to the system and all secrets on the system not protected by hardware-based encryption. F5 believes that the attack with the highest impact may occur in multi-tenancy Virtual Clustered Multiprocessing (vCMP) configurations, running single-core guests owned by different administrative domains on a single BIG-IP system. In this scenario, Spectre Variant 2 may allow an attacker in one administrative domain to collect privileged information from the host or guests owned by another administrative domain, if the attacker's guest is configured as a single-core guest. The BIG-IP system always maps both hyper-threads of a given core to any guest with the "Cores Per Guest" configuration set to 2 or more, but single-core guests may execute on the same processor core as another single-core guest or host code. This threat may be mitigated by setting the "Cores Per Guest" configuration to 2 or more for all guests."
Cisco
"Cisco is investigating its product line to determine which products may be affected by these vulnerabilities. As the investigation progresses, Cisco will update this advisory with information about affected products, including the Cisco bug ID for each affected product."Juniper
"Juniper SIRT is actively investigating the impact on Juniper Networks products and services.”Brocade
Citrix/Netscaler
"Citrix NetScaler SDX: Citrix believes that currently supported versions of Citrix NetScaler SDX are not at risk from malicious network traffic. However, in light of these issues, Citrix strongly recommends that customers only deploy NetScaler instances on Citrix NetScaler SDX where the NetScaler admins are trusted."
It is curious to see how different company choose to incorporate and document opensource software in their products. But that is a different rant for a different time.
Today is the day engineers around the world hit the internet looking through pages and pages of documentation. I have done some research and wanted to add what I found to hopefully shorten someones search.
Cisco ASA 8.4 code is running openssl 0.9.8f Safe
- To view for your self SSH to your LTM log in as root and run "openssl version"