[WXC/VFX] Asterisk behind NAT

Forums › One NZ (including Farmside) › [WXC/VFX] Asterisk behind NAT

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#107193 8-Aug-2012 14:23

Hey guys,
I'm deploying my first ever Asterisk system behind NAT (done a half dozen on public IPs). For context I have the following:

2x internal subnets:
192.168.0.0/24: clients
192.168.2.0/24: servers

I have the asterisk on 192.168.2.4. This is behind Unleash ADSL through Draytek 120 in bridge and onto PFsense 2.0.

I have put a NAT rule of SIP (5060) to 192.168.2.4 and added a firewall rule that allows access from source address 58.28.20.150 to all ports.

My problem is it will work for a while and then when I try to make calls into it they get bounced with the WxC unavailable message. If I reboot the system I'm OK again. Am I missing something?

Speedtest 2019-10-14

ajobbins

5053 posts

Uber Geek
+1 received by user: 1279

Trusted

#669636 8-Aug-2012 14:46

How many concurrent SIP registrations? Do you need to open up more ports?

(Doesn't SIP use one port per reg?)

Twitter: ajobbins

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#669644 8-Aug-2012 14:57

Yea I thought that may be the case so forwarded port 5061 aswell. But there is only a single VFX trunk registration?

Speedtest 2019-10-14

ubergeeknz

3344 posts

Uber Geek
+1 received by user: 1041

Trusted

Vocus

#669656 8-Aug-2012 15:37

Sounds like your box is not registering often enough to keep the registration alive. Try shortening the re-registration period.

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#669687 8-Aug-2012 16:12

Thanks for the idea. I've changed the following line in the TRUNK configuration:

regseconds=180 (default given by wxc)

To:

regseconds=30

I have left the following as the default WxC value:
registertimeout=20

Will report back!

Speedtest 2019-10-14

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#669727 8-Aug-2012 16:58

Na sometimes it works, sometimes it is the WxC man saying:

"the party you are trying to reach"... etc. etc.

I have a feeling it may be to do with NAT on PFSense. Just doing some searches now. Man can't wait till IPv6 is common place and no more of this NAT nonsense ;p.

Speedtest 2019-10-14

ubergeeknz

3344 posts

Uber Geek
+1 received by user: 1041

Trusted

Vocus

#669728 8-Aug-2012 17:02

Zeon: Na sometimes it works, sometimes it is the WxC man saying:

"the party you are trying to reach"... etc. etc.

I have a feeling it may be to do with NAT on PFSense. Just doing some searches now. Man can't wait till IPv6 is common place and no more of this NAT nonsense ;p.

Hmm, could be a NAT issue, although with port forwarding it shouldn't matter.

Are you using port 5060 on your Asterisk box to listen?

Can you send me a tcpdump from the asterisk box? Might be able to tell what's going on.

Lego

Shop now for Lego sets and other gifts (affiliate link).

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#669738 8-Aug-2012 17:12

Hey guys I think it may have something to do with static port on outbound NAT in PFSense:

http://doc.pfsense.org/index.php/Static_Port

By default it is dynamic and can change however I have forced a rule to keep it static and it looks to be working.

Speedtest 2019-10-14

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#669745 8-Aug-2012 17:37

ubergeeknz:
Zeon: Na sometimes it works, sometimes it is the WxC man saying:

"the party you are trying to reach"... etc. etc.

I have a feeling it may be to do with NAT on PFSense. Just doing some searches now. Man can't wait till IPv6 is common place and no more of this NAT nonsense ;p.

Hmm, could be a NAT issue, although with port forwarding it shouldn't matter.

Are you using port 5060 on your Asterisk box to listen?

Can you send me a tcpdump from the asterisk box? Might be able to tell what's going on.

Yea it was using port 5060. Definitely looks to be that static port issue. Seriously, NAT can DIAF. Thanks very much for the offer to check TCPDump data though

Speedtest 2019-10-14

impsycho

10 posts

Wannabe Geek

#669755 8-Aug-2012 18:00

Zeon: Seriously, NAT can DIAF. Thanks very much for the offer to check TCPDump data though

For the most part NAT is fine, it's when the router/firewall doing the NAT tries to be 'clever' that things like SIP start to fall down.

SIP-ALG/SIP-NAT, now that can go DIAF - causes more problems than it claims to solve.

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#670167 9-Aug-2012 16:18

impsycho:
Zeon: Seriously, NAT can DIAF. Thanks very much for the offer to check TCPDump data though

For the most part NAT is fine, it's when the router/firewall doing the NAT tries to be 'clever' that things like SIP start to fall down.

SIP-ALG/SIP-NAT, now that can go DIAF - causes more problems than it claims to solve.

Haha I think I must have gotten used to native connectivity where you only needed to worry about firewall rules.

Yea I have had problems with phones and SIP-ALG before. In this case I'm not sure 100% of what static port does but looks to randomize outgoing ports as a security measure?

Speedtest 2019-10-14

craigdrown

12 posts

Geek

#678034 28-Aug-2012 10:25

Hi,
I have an SPA2102 behind pfsense, and it gave problems at first due to double-NAT (pfsense doing NAT and then the ADSL modem doing NAT too). I changed the modem to a Draytek Vigor 120 that does PPoE to PPPoA bridging, and then the pfSense box gets the public IP and all good after that.
Not sure if there's anything in that that will help you?
Cheers,
Craig