🗄Connecting phone systems and routers

Aurora Hive registers on your phone system like a desk phone located outside the office. Every system needs the same four things for this:

1. An extension for a generic SIP phone — not for a particular manufacturer’s model, and without automatic provisioning.
2. Permission to register from outside the office network. Many systems only allow extensions on the local network by default.
3. Port forwarding on the router for SIP to the phone system, if the system sits behind a router.
4. An exception in the system’s block list for the exchange’s address, 217.154.165.69 — otherwise it locks the exchange out after a few failed attempts.

Then enter in the wizard: the system’s public address (DynDNS name or fixed IP), the extension user and the password. If the port differs, enter it under “Advanced (port, transport)”.

If a partner looks after your system, send them exactly this list.

The exchange registers via SIP, usually on port 5060 (UDP or TCP) or 5061 with TLS. The router in front needs to forward this port to the phone system.

To stop this becoming an open door:

• Allow only one sender address where the router supports it: 217.154.165.69.
• A long random password for the Aurora Hive extension — never the extension number as password.
• Keep the block list on, but add the exchange’s address as an exception.
• Restrict the extension’s outside-line permissions to what is needed — for example no international calls if you do not call abroad.
• Switch off SIP ALG (a router feature that rewrites SIP) on the router if your phone system’s manufacturer recommends it; it often causes one-way audio.

The sound itself usually needs no additional inbound forwarding as long as the phone system is allowed outgoing connections. Your system manufacturer’s help pages have the details.

Aurora Hive is created in 3CX as an extension (user) with a generic SIP phone.

1. In the 3CX management console, create a new user or extension for Aurora Hive.
2. Take the authentication ID and password from the extension’s details.
3. In the extension’s restrictions, switch off the option “Disallow use of extension outside the LAN”. It is on by default and blocks direct SIP registration from outside.
4. Make sure the 3CX can be reached for SIP from outside (port 5060, or 5061 for encrypted) and that the exchange’s address does not end up on the block list.
5. In the wizard, enter the 3CX’s public name, the authentication ID as user and the password.

If a provider runs your 3CX for you, the provider carries out these steps. We have taken the labels from 3CX partner documentation and the 3CX forum; they may change with new versions.

Manufacturer help: the 3CX manual on 3cx.com, or your 3CX partner.

STARFACE accepts third-party SIP phones as manually created phones.

1. In the STARFACE administration, under Phones, create a phone manually, device type Standard SIP.
2. Give the phone a name (it is also the SIP user) and set or take over a password.
3. Assign the phone to the user or number that Aurora Hive is to use for calls.
4. For devices outside the office network, STARFACE recommends setting the phone’s NAT option to “Standard” or “Yes”.
5. On the router, forward SIP (5060, or 5061 with TLS) to the STARFACE, if possible only for 217.154.165.69. STARFACE also recommends switching off SIP ALG on the router.
6. In the wizard, enter the STARFACE’s public name, the phone’s name as user and the password.

Manufacturer help: STARFACE knowledge base, articles on manual phone accounts and port usage

Auerswald calls this an external extension.

1. On the system, create a subscriber of type Standard VoIP telephone and give it a subscriber password.
2. Make the system reachable via a DynDNS name or fixed address and forward port 5060 on the router to the system.
3. In the system’s IP block and allow list (under Administration), add 217.154.165.69 to the allow list. Otherwise the system blocks conspicuous senders automatically.
4. Restrict the subscriber’s outside-line permissions to what is needed.
5. In the wizard, enter the system’s external address, the subscriber’s internal number as user and the subscriber password.

Auerswald generally recommends a VPN tunnel for external extensions and points out the security risk of open registration. The exchange cannot set up a VPN tunnel, which makes the allow list and the password all the more important.

Manufacturer help: Auerswald: external extensions

In SwyxWare, a user can additionally register a SIP device.

1. In the Swyx administration, for the user intended for Aurora Hive, enable “Allow logon via SIP” and set a SIP user name and SIP password.
2. The system must be reachable for SIP from the internet — your Swyx partner sets this up. The Swyx RemoteConnector does not help here; it is designed for Swyx programs and certain desk phones.
3. In the wizard, enter the system’s address, the SIP user name and the SIP password.

Swyx does not guarantee compatibility with third-party devices, and in the cloud version SwyxON, registering a third-party SIP device from the internet may not be intended at all. Clarify this with your Swyx partner beforehand.

Manufacturer help: Swyx help: user configuration

AGFEO systems (ES systems, HyperVoice) accept SIP devices. Whether and how a SIP device may register from outside the office network depends on model and firmware — we have not been able to verify this for every version.

Ask your AGFEO dealer to implement the four points from “What needs to be set up on our phone system?”:

1. Create a SIP device as a subscriber and set a user and password.
2. Allow registration from outside.
3. Port forwarding on the router, if possible only for 217.154.165.69.
4. Exempt the exchange’s address from any blocking.

Then enter the system’s address, the user and the password in the wizard.

In LANCOM’s VoIP Call Manager, you create a SIP user and allow it access from the WAN.

1. In LANconfig, under VoIP Call Manager → Users → SIP users, create an entry for Aurora Hive with a number and password.
2. In the entry, set “Access from WAN” to unrestricted. The other options — VPN only or blocked — keep the exchange out.
3. Under VoIP Call Manager → General, leave the lock after failed WAN logins switched on; it protects against passwords being guessed.
4. In the wizard, enter the router’s public address, the SIP user’s number and the password.

Manufacturer help: LANCOM Knowledge Base

bintec elmeg’s be.IP systems are the basis of Telekom’s Digitalisierungsbox; the procedure is the same for both and is described in the answer about the Digitalisierungsbox.

In short: create a user with a SIP device, allow registration from the internet, restrict SIP port forwarding to 217.154.165.69, then enter the public address, SIP user and password in the wizard. Your dealer or bintec elmeg’s help pages can give you the exact menus.