Set Outgoing Firewall to BLOCK.
RED is connected to the ISP-Router, so RED is Private-LAN (192.168…)
Now DECT-Phone is missing the connection.
I add
According to chatGPT v. 4
You can group them (e.g. VOIP group) before entering your firewall rules, making the process more efficient.
These are the most common ports used by VOIP, but there can be others according to different vendors. In case of problems, you can check the kernel logs by issuing this command in the console, while using the phone system:
tail -f /var/log/messages
you will see in real time the packets flowing, with the ports indicated. Ctrl-c to exit.
Thx, for the ports!
And, yes if you want to get some info from this IPFire you have to use the CLI and ignore this ^#%$!$ WebUI … 
That is because you told it to do so in the the second rule. You should of course not expose your entire PBX to the Internet.
Hm, I thought I restrict the related ports with the service group ‘VoIP’. This included the ports named by cfusco in the post above. But as you see this is not visible when IPFire displays the rules.
Just my two cents 
I think these are too many ports and I’d like to recommend you check the manual of the DECT bridge you are actually using. Opening more ports than necessary can be a security risk.
For example, a Gigaset bridge I recently set up uses only ports 5060 and 5004-5020 for RTP.
