[pfSense] NAT-port-forwading problem in combination with SIP/RTP/VoIP

[Claudio Thomas]

Hi,
im working with a pfSense 2.1(i386) release and I'm trying to connect my
asterisk to sipgate.
The following parts already run:
- register asterisk to sipgate and qualify (trunk marked as online at
sipgate)
- outgoing calls from asterisk to POTs over sipgate (signaling and audio
-> outgoing SIP/RTP works)
But what not runs are incomming calls.
I see the SIP pakets comming on WAN with tcpdump (tcpdump -i xl0 -A -s 0
'port 5060'), but nothing goes out to LAN (tcpdump -i re1 -A -s 0 'port
5060').

So my guess is that NAT+Portforwarding is not working correctly. Can
anyone help?

Thanks, Claudio

PS: annexed some details...

asterisk <-> siproxd 0.8.0_2/pfSense 2.1(i386) <-> sipgate
10.150.0.14 <-> 10.150.0.158/(pub-ip censored) <-> 217.10.68.150

siproxd-config:
Enabled siproxd: enable
Inbound Interface: LAN
Outbound Interface: WAN
Enable RTP proxy: enable
RTP port range: 7070 - 7080
Outbound proxy hostname: sipconnect.sipgate.de
Debug Level: Everything
(missing options are empty/not checked)

1.NAT-Port-Forward-Rules:
Interface: WAN
Protocol: TCP/UDP
Destination: WAN address
Destination port range: SIP - SIP
Redirect target IP: 10.150.0.14
Redirect target port: SIP
Description: "SIP-protocol Weiterleitung an PBX"
NAT reflection: Enable (NAT + Proxy)
Filter rule association: "Rule NAT SIP-protocol Weiterleitung an PBX"

2.NAT-Port-Forward-Rules:
Interface: WAN
Protocol: TCP/UDP
Destination: WAN address
Destination port range: 10000 - 20000
Redirect target IP: 10.150.0.14
Redirect target port: 10000
Description: "RTP-protocol Weiterleitung an PBX"
NAT reflection: Enable (NAT + Proxy)
Filter rule association: "Rule NAT RTP-protocol Weiterleitung an PBX"

pbx2*CLI> sip show peers
Name/username Host Dyn Nat ACL Port
Status Realtime
gw_25_sipgate/2100006t0 217.10.68.150 5060 OK (14 ms)
pbx2*CLI> sip show registry
Host dnsmgr Username Refresh
State Reg.Time
10.150.0.158:5060 N ***@si 130
Registered Tue, 15 Oct 2013 13:44:11

[Vick Khera]

Post by Claudio Thomas
So my guess is that NAT+Portforwarding is not working correctly. Can
anyone help?
Thanks, Claudio
PS: annexed some details...
asterisk <-> siproxd 0.8.0_2/pfSense 2.1(i386) <-> sipgate
10.150.0.14 <-> 10.150.0.158/(pub-ip censored) <-> 217.10.68.150

Our asterisk server is connected as a client to both Vitelity and Skype for
Business. Calls work both ways just fine. No siproxyd involved at all.

I do not connect as a peer.

[Claudio Thomas]

Thanks for the fast reaction.
1. siproxd removed
2. Sipgate needs an "outboundproxy" equal to the "host". Here was one
problem with GS3.1 because it automatically removed this in case both
were equal.
The rest stays as it was:
- incoming NAT+forward rules unchanged
- no outbound NAT rules added (like Static-port)
- firewall rule exist, so that asterisk (10.150.0.14) is allowed to pass
firewall (outgoing)
- /etc/asterisk/sip.conf: no "externhost" set

Way It doesn't run with siproxd is not cleared, but for me is it good
enough that it runs (anyway) now :-)
It runs for incoming and outgoing calls, both are routed.

Thanks for the report how you have done.
Claudio

BTW: What do you mean with "client" and not "peer"? Allowed sip-types
are peer, user or friend
(http://www.voip-info.org/wiki/view/Asterisk+sip+type)

Post by Claudio Thomas
So my guess is that NAT+Portforwarding is not working correctly. Can
anyone help?
Thanks, Claudio
PS: annexed some details...
asterisk <-> siproxd 0.8.0_2/pfSense 2.1(i386) <-> sipgate
10.150.0.14 <-> 10.150.0.158/(pub-ip
<http://10.150.0.158/%28pub-ip> censored) <-> 217.10.68.150
Our asterisk server is connected as a client to both Vitelity and
Skype for Business. Calls work both ways just fine. No siproxyd
involved at all.
I do not connect as a peer.
_______________________________________________
List mailing list
http://lists.pfsense.org/mailman/listinfo/list

[Vick Khera]

BTW: What do you mean with "client" and not "peer"? Allowed sip-types are
peer, user or friend (http://www.voip-info.org/wiki/view/Asterisk+sip+type
)

My asterisk (actually it is Switchvox GUI running asterisk underneath) is
acting as if it is a multi-line phone connected to Skype SIP gateway. That
is skype service does not route calls via my public IP address by
initiating a SIP connection. It just uses the existing connected client to
ring the call. I do not know if the internal name for that is user or
friend. It is definitely not a peer.

Glad you sorted out your connection.