Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




3346 posts

Uber Geek
+1 received by user: 359

Trusted

Topic # 107193 8-Aug-2012 14:23 Send private message

Hey guys,
I'm deploying my first ever Asterisk system behind NAT (done a half dozen on public IPs). For context I have the following:

2x internal subnets:
192.168.0.0/24: clients
192.168.2.0/24: servers

I have the asterisk on 192.168.2.4. This is behind Unleash ADSL through Draytek 120 in bridge and onto PFsense 2.0.

I have put a NAT rule of SIP (5060) to 192.168.2.4 and added a firewall rule that allows access from source address 58.28.20.150 to all ports.

My problem is it will work for a while and then when I try to make calls into it they get bounced with the WxC unavailable message. If I reboot the system I'm OK again. Am I missing something?





Create new topic
Awesome
4733 posts

Uber Geek
+1 received by user: 1025

Trusted
Subscriber

  Reply # 669636 8-Aug-2012 14:46 Send private message

How many concurrent SIP registrations? Do you need to open up more ports?

(Doesn't SIP use one port per reg?)




Twitter: ajobbins




3346 posts

Uber Geek
+1 received by user: 359

Trusted

  Reply # 669644 8-Aug-2012 14:57 Send private message

Yea I thought that may be the case so forwarded port 5061 aswell. But there is only a single VFX trunk registration?





 

 



Fully Operational
3238 posts

Uber Geek
+1 received by user: 1042

Trusted
Vocus
Subscriber

  Reply # 669656 8-Aug-2012 15:37 Send private message

Sounds like your box is not registering often enough to keep the registration alive.  Try shortening the re-registration period.



3346 posts

Uber Geek
+1 received by user: 359

Trusted

  Reply # 669687 8-Aug-2012 16:12 Send private message

Thanks for the idea. I've changed the following line in the TRUNK configuration:

regseconds=180 (default given by wxc)

To:

regseconds=30


I have left the following as the default WxC value:
registertimeout=20

Will report back!







3346 posts

Uber Geek
+1 received by user: 359

Trusted

  Reply # 669727 8-Aug-2012 16:58 Send private message

Na sometimes it works, sometimes it is the WxC man saying:

"the party you are trying to reach"... etc. etc.

I have a feeling it may be to do with NAT on PFSense. Just doing some searches now. Man can't wait till IPv6 is common place and no more of this NAT nonsense ;p.





Fully Operational
3238 posts

Uber Geek
+1 received by user: 1042

Trusted
Vocus
Subscriber

  Reply # 669728 8-Aug-2012 17:02 Send private message

Zeon: Na sometimes it works, sometimes it is the WxC man saying:

"the party you are trying to reach"... etc. etc.

I have a feeling it may be to do with NAT on PFSense. Just doing some searches now. Man can't wait till IPv6 is common place and no more of this NAT nonsense ;p.


Hmm, could be a NAT issue, although with port forwarding it shouldn't matter.

Are you using port 5060 on your Asterisk box to listen?

Can you send me a tcpdump from the asterisk box?  Might be able to tell what's going on.



3346 posts

Uber Geek
+1 received by user: 359

Trusted

  Reply # 669738 8-Aug-2012 17:12 Send private message

Hey guys I think it may have something to do with static port on outbound NAT in PFSense:

http://doc.pfsense.org/index.php/Static_Port

By default it is dynamic and can change however I have forced a rule to keep it static and it looks to be working.







3346 posts

Uber Geek
+1 received by user: 359

Trusted

  Reply # 669745 8-Aug-2012 17:37 Send private message

ubergeeknz:
Zeon: Na sometimes it works, sometimes it is the WxC man saying:

"the party you are trying to reach"... etc. etc.

I have a feeling it may be to do with NAT on PFSense. Just doing some searches now. Man can't wait till IPv6 is common place and no more of this NAT nonsense ;p.


Hmm, could be a NAT issue, although with port forwarding it shouldn't matter.

Are you using port 5060 on your Asterisk box to listen?

Can you send me a tcpdump from the asterisk box?  Might be able to tell what's going on.


Yea it was using port 5060. Definitely looks to be that static port issue. Seriously, NAT can DIAF. Thanks very much for the offer to check TCPDump data though Smile





9 posts

Wannabe Geek


  Reply # 669755 8-Aug-2012 18:00 Send private message

Zeon: Seriously, NAT can DIAF. Thanks very much for the offer to check TCPDump data though Smile


For the most part NAT is fine, it's when the router/firewall doing the NAT tries to be 'clever' that things like SIP start to fall down.

SIP-ALG/SIP-NAT, now that can go DIAF - causes more problems than it claims to solve.



3346 posts

Uber Geek
+1 received by user: 359

Trusted

  Reply # 670167 9-Aug-2012 16:18 Send private message

impsycho:
Zeon: Seriously, NAT can DIAF. Thanks very much for the offer to check TCPDump data though Smile


For the most part NAT is fine, it's when the router/firewall doing the NAT tries to be 'clever' that things like SIP start to fall down.

SIP-ALG/SIP-NAT, now that can go DIAF - causes more problems than it claims to solve.


Haha I think I must have gotten used to native connectivity where you only needed to worry about firewall rules.

Yea I have had problems with phones and SIP-ALG before. In this case I'm not sure 100% of what static port does but looks to randomize outgoing ports as a security measure?





12 posts

Geek


  Reply # 678034 28-Aug-2012 10:25 Send private message

Hi,
I have an SPA2102 behind pfsense, and it gave problems at first due to double-NAT (pfsense doing NAT and then the ADSL modem doing NAT too). I changed the modem to a Draytek Vigor 120 that does PPoE to PPPoA bridging, and then the pfSense box gets the public IP and all good after that.
Not sure if there's anything in that that will help you?
Cheers,
Craig

Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Telecommunications monitoring report: Are you being served?
Posted 24-May-2017 11:54


NetValue partners with CRM Provider SugarCRM
Posted 23-May-2017 20:04


Terabyte looms as Vocus users download 430GB a month
Posted 19-May-2017 14:51


2degrees tips into profit after seven lean years
Posted 19-May-2017 09:47


2degrees growth story continues
Posted 17-May-2017 15:25


Symantec Blocks 22 Million Attempted WannaCry Ransomware Attacks Globally
Posted 17-May-2017 12:41


HPE Unveils Computer Built for the Era of Big Data
Posted 17-May-2017 12:39


Samsung Galaxy S8 Plus review: Beautiful, feature-packed
Posted 16-May-2017 20:14


After ten years of mail pain Spark is done with Yahoo
Posted 15-May-2017 13:12


Warnings from security firms: do not click that link or risk your computer being infected
Posted 15-May-2017 10:11


Pushpay named NZ Hi-Tech Company of the Year 2017
Posted 15-May-2017 09:59


Passive Optical Lan means fibre to the desktop
Posted 12-May-2017 17:09


Finalists Named for 2017 CIO Awards
Posted 11-May-2017 20:00


Exhibition to showcase digital artwork from across the globe
Posted 10-May-2017 18:54


Accelerate 2017 to focus on navigating disruption with a design thinking mindset
Posted 10-May-2017 18:49



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.