Port Forwarding

! ── RingQ Port Forwarding — Cisco IOS ──
! Replace <SERVER_IP> with your RingQ PBX IP

! SIP Signaling (TCP + UDP)
ip access-list extended RINGQ_IN
 permit udp any host <SERVER_IP> eq 5060
 permit tcp any host <SERVER_IP> eq 5060
 permit tcp any host <SERVER_IP> eq 5061

! RTP Media
 permit udp any host <SERVER_IP> range 16384 32767
 permit udp any host <SERVER_IP> range 9000 10999

! Secure Web / WSS
 permit tcp any host <SERVER_IP> eq 443
 permit tcp any host <SERVER_IP> eq 7443
 permit tcp any host <SERVER_IP> eq 8443

! Push Notifications
 permit tcp any host <SERVER_IP> eq 9999

! RingQ Meet
 permit tcp any host <SERVER_IP> eq 9886
 permit tcp any host <SERVER_IP> eq 8445

! Secure Tunnel Port
 permit tcp any host <SERVER_IP> eq 6010

! Apply to WAN interface (replace GigabitEthernet0/0)
interface GigabitEthernet0/0
 ip access-group RINGQ_IN in

! ── RingQ Port Forwarding — DrayTek Vigor ──
! Replace SERVER_IP with your RingQ PBX LAN IP

! Enable Port Redirection via CLI
ip nat portmap add tcp 5060 5060 SERVER_IP
ip nat portmap add udp 5060 5060 SERVER_IP
ip nat portmap add tcp 5061 5061 SERVER_IP
ip nat portmap add tcp 443 443 SERVER_IP
ip nat portmap add tcp 7443 7443 SERVER_IP
ip nat portmap add tcp 8443 8443 SERVER_IP
ip nat portmap add udp 16384 32767 SERVER_IP
ip nat portmap add udp 9000 10999 SERVER_IP
ip nat portmap add tcp 9999 9999 SERVER_IP
ip nat portmap add tcp 9886 9886 SERVER_IP
ip nat portmap add tcp 8445 8445 SERVER_IP
ip nat portmap add tcp 6010 6010 SERVER_IP

! Save config
sys commit

<!-- pfSense Alias — paste in Diagnostics > Backup/Restore -->
<aliases>
  <alias>
    <name>RINGQ_TCP_PORTS</name>
    <type>port</type>
    <address>443 7443 8443 5060 5061 9999 9886 8445 6010</address>
    <descr>RingQ TCP Ports</descr>
  </alias>
  <alias>
    <name>RINGQ_UDP_PORTS</name>
    <type>port</type>
    <address>5060 16384:32767 9000:10999</address>
    <descr>RingQ UDP Ports</descr>
  </alias>
</aliases>

! ── RingQ — SonicWall SonicOS CLI ──
! Replace SERVER_IP with RingQ PBX LAN IP
! Replace PUBLIC_IP with your WAN IP

configure
  address-object ipv4 RINGQ_PBX host SERVER_IP zone LAN

  service-object tcp RINGQ_SIP_TCP port 5060 5060
  service-object udp RINGQ_SIP_UDP port 5060 5060
  service-object tcp RINGQ_SIP_TLS port 5061 5061
  service-object tcp RINGQ_HTTPS port 443 443
  service-object tcp RINGQ_WSS1 port 7443 7443
  service-object tcp RINGQ_WSS2 port 8443 8443
  service-object udp RINGQ_RTP port 16384 32767
  service-object udp RINGQ_TRUNK port 9000 10999
  service-object tcp RINGQ_PUSH port 9999 9999
  service-object tcp RINGQ_MEET1 port 9886 9886
  service-object tcp RINGQ_MEET2 port 8445 8445
  service-object tcp RINGQ_TUNNEL port 6010 6010

  service-group RINGQ_ALL
    service RINGQ_SIP_TCP
    service RINGQ_SIP_UDP
    service RINGQ_SIP_TLS
    service RINGQ_HTTPS
    service RINGQ_WSS1
    service RINGQ_WSS2
    service RINGQ_RTP
    service RINGQ_TRUNK
    service RINGQ_PUSH
    service RINGQ_MEET1
    service RINGQ_MEET2
    service RINGQ_TUNNEL
  exit

  access-rule from WAN to LAN action allow
    source any
    destination RINGQ_PBX
    service RINGQ_ALL
  exit
commit

! ── RingQ — WatchGuard Fireware CLI ──
! Connect via SSH or WSM CLI

! Create host alias
alias RINGQ_PBX {
  host SERVER_IP
}

! Create packet filter policy
policy RINGQ_INBOUND {
  type packet-filter
  from { any-external }
  to { RINGQ_PBX }
  protocol tcp { 5060 5061 443 7443 8443 9999 9886 8445 6010 }
  protocol udp { 5060 16384-32767 9000-10999 }
  action allow
  log enable
}

! Outbound for APNs
policy RINGQ_APNS_OUT {
  type packet-filter
  from { RINGQ_PBX }
  to { any-external }
  protocol tcp { 5223 }
  action allow
}

save

! ── RingQ — FortiGate FortiOS CLI ──
! Replace SERVER_IP with RingQ PBX LAN IP
! Replace PUBLIC_IP with WAN IP

! ── STEP 1: Disable SIP ALG (CRITICAL) ──
config system settings
  set sip-helper disable
  set sip-nat-trace disable
end

config system session-helper
  delete 13
end

! ── STEP 2: Create address object ──
config firewall address
  edit "RINGQ_PBX"
    set type ipmask
    set subnet SERVER_IP 255.255.255.255
  next
end

! ── STEP 3: Create Virtual IP (Port Forward) ──
config firewall vip
  edit "VIP_RINGQ_SIP"
    set extip PUBLIC_IP
    set mappedip SERVER_IP
    set extintf wan1
    set portforward enable
    set protocol tcp
    set extport 5060
    set mappedport 5060
  next
  edit "VIP_RINGQ_RTP"
    set extip PUBLIC_IP
    set mappedip SERVER_IP
    set extintf wan1
    set portforward enable
    set protocol udp
    set extport 16384-32767
    set mappedport 16384-32767
  next
  edit "VIP_RINGQ_TUNNEL"
    set extip PUBLIC_IP
    set mappedip SERVER_IP
    set extintf wan1
    set portforward enable
    set protocol tcp
    set extport 6010
    set mappedport 6010
  next
end

! ── STEP 4: Create firewall policy ──
config firewall policy
  edit 0
    set name "RINGQ_INBOUND"
    set srcintf wan1
    set dstintf internal
    set srcaddr all
    set dstaddr "RINGQ_PBX"
    set action accept
    set schedule always
    set service ALL
    set nat enable
  next
end