Finally I have perfect telephone quality (except for latency, which can't be avoided given that radio signals take time to travel to and from a satellite) and insignificant packet loss using VFX over IPSTAR. Here are the details of what ended up being required and what was causing the problems I had.

The only things that made a difference in addition to a default configuration were 1) The ISP (ICONZ) had IPSTAR a) give me 64Kbps of CIR and b) enable CBR on the satellite gateway for traffic from the VOIP server (in the case of VFX, 58.28.20.150) to my ip address; and 2) enable CBR on my IPSTAR modem for UDP traffic from my ip address to the VOIP server.

Everything else was either a red herring or actually caused problems that didn't go away until they were undone.

The final thing in that category was the cause of the high packet loss. When I enabled CBR on my IPSTAR modem I got no response to my question about the exactl settings to use. To be sure, I enabled it for both TCP and UDP, the source ip address being my external address for my LAN on the /30 subnet that ICONZ had given me, and the destination being the VFX server at 58.28.20.150. In both I specified port 0, which means all ports. Since it had been explained to me that CBR gives priority to VOIP packets, I thought it was proper to include more than the minimum necessary range because only VOIP packets would get the priority. That was wrong.

From the behaviour, I speculate that CBR gives priority to all packets that match the configuration. I also speculate that the LinkSys SPA-2102 regularly communicates with the VFX server using TCP, but the actual VOIP communication is done over UDP. When I included TCP in the CBR configuration, there were just too many packets beig given priority, with the result that some packets of other traffic ended up being lost whenever the SPA-2102 was plugged anywhere into the network, even when it was not being used as a router for my LAN, and even when not making a phone call.

When I removed the TCP entry from the CBR configuration on the IPSTAR modem, all my packet loss problems went away. I did leave the UDP entry as specifying port 0 instead of trying to narrow it just to the ports that VFX uses for VOIP packets, as there does not seem to be enough other UDP traffic to that server to cause a problem and this way the setup will work no matter what ports VFX chooses to use in the future.

Everything else in my configuration is set to the defaults. I have my IPSTAR modem connected to the Internet port of my router and the SPA-2102's Internet port plugged into that, not using the SPA-2102's router capability, but everything works equally well when I plug my PC into the SPA-2102's LAN port and use it as a router.

Amazingly enough, even when I am downloading at full speed, using just about all the bandwidth I get from IPSTAR, there is only the tiniest noticeable effect on call quality, even not using the SPA-2102 as the router for the PC. I don't know why that works without the SPA-2102's QoS being a factor, but it does work.

Here is everything that I have configured in my IPSTAR modem to work with my /30 subnet.

ICONZ assigned me a /30 subnet xxx.xxx.xxx.180-183, which means that I have two usable external IP addresses, xxx.xxx.xxx.181 and xxx.xxx.xxx.182. The 181 address is assigned to my IPSTAR modem and the 182 address is for my LAN. They said they had to do that in order to confgure CIR, but since that was before they seemed to have got correct information from IPSTAR I don't know if it is true.

To run with the /30 subnet, I had to configure the IPSTAR modem in the Network tab disable NAT and set the Etehernet link ip address set to xxx.xxx.xxx.181 with netmask 255.255.255.252. In the DHCP tab I left DHCP enabled with pools address range of xxx.xxx.xxx.182 to xxx.xxx.xxx.182. The ethernet cable from the IPSTAR modem could then be plugged into the WAN (Internet) port of my router, which could be the LinkSys SPA-2102 or antother routher, and which could be configured either to get its address from DHCP or set to static ip address xxx.xxx.xxx.182.

In the CBR tab of the IPSTAR modem configuration screen I enabled CBR and added an entry for UDP source address xxx.xxx.xxx.182 port 0, destination address 58.28.20.150 port 0.

ICONZ charge an extra $10/month for the CIR/CBR being enabled on the gateway. On the other hand, one of the things I had tried which did not help was getting a faster, 1M/512Kbps plan, so now I am spending less to have a 256K/128Kbps plan which is more than enough for VOIP to work. Also, ICONZ do not count national data usage toward the bandwith quota so the VOIP traffic, which all goes through VFX's servers, does not add in to my monthly data usage cap.

The one thing I do not know is how it would be configured if I had only one static ip address, which was the default setup when I first got IPSTAR from ICONZ. What I would try in that case, assuming that my one external ip address was xxx.xxx.xxx.181, would be: Have the ISP configure on their gateway for me to have 64Kbps CIR and enable CBR for UDP traffic from 58.28.20.150 to xxx.xxx.xxx.181. Assuming that the IPSTAR modem is in the default configuration of NAT and DHCP server enabled and the LAN subnet is 192.168.5.x, enable CBR for UDP source 192.168.5.5 port 0, dest 58.28.20.150 port 0, and then configure the WAN (Internet) port of your router (SPA-2102 or otherwise) to have ip address 192.168.5.5. I am not in a position to try that for myself.