Firewall rules for T38 fax

Fax Flow T38 example between fax server and Ribbon SBC

To understand what firewall rules are required is best illustrated by looking at a T38 fax flow diagram. 

• T.38 uses UDP with packet redundancy.   
• SIP signalling uses port 5060
• RTP  T38 ports are defined based on the required security design. 

In the above example a port range for RTPT38 starting at 16384 was defined in the fax server

A typical port range might be 16384 to 20000   or 40000 to 60000.  Speak to your firewall team to see if they have standards already defined. 

Port ranges can be different from fax to SBC versus from the SBC to the fax server.

Recommend you keep it simple and set a common port range.    

Given the above your firewall port rules could look like this

Allow All ICMP packets from 192.168.0.71 to 192.168.0.156

Allow All ICMP packets from 192.168.0.156 to 192.168.0.71

Allow UDP port 5060  from 192.168.0.71 to 192.168.0.156

Allow UDP port 5060  from 192.168.0.156 to 192.168.0.71

Allow UDP port 16384 to 20000 from 192.168.0.71 to 192.168.0.156

Allow UDP port 16384 to 20000 from 192.168.0.156 to 192.168.0.71