I have a set of Siemens Gigaset phones with the network hub connected to 192.168.1.17 on my 2925ac router. Some years ago I signed up for a DrayTEL account and set the IP phones to use that facility when dialing any 0033 number (I used it a lot to call my friends in France but tend to Skype these days, however it worked fine). All other calls use POTS.

I have UDP ports 5060, 5065 and 5004 open to 192.168.1.17

Recently I have been receiving "phantom" IP calls, usually at about 4am. No POTS calls come in at that time as I have a call blocker on the line. As you can appreciate, being woken up by this is not amusing.

As I never wish to receive any IP calls. only make them, I set up firewall rules on both call and data to block anything coming from the WAN and headed for 192.168.1.17. However, I am still receiving phantom calls - 2 this morning at around 4.30.

Have I misunderstood how this works? Anyone any ideas on what to do to prevent these calls? When they occur there is an "IP Status" message on the phone screen, but my eyes are too blurry to see the code, which appears to be a 7xx number.

Edit:- I guess this poses some subsidiary questions :- do I actually need to open any ports in order to make outgoing Voip calls? Does an "open ports" setting override the firewall?