NAT Port Forwarding to Internal host UDP port 5060 not working as expected
-
At the trunks I register with, where the numbers are configured, I have all the incoming calls directed at port 5060, which is the only sip related port I have open, along with the extension/DID of the inbound call. Those hit asterisk which either sends the incoming call to IVR, the phone being called if the inbound DID matches an extension (Could be either SIP or IAX2 extension), or drops the call if its no match on my network. This works well for me because at least my trunk providers are either non-NATed or has a better NAT solution than me. Audio is good for me.
Actually, I'd love to have separate public IPs for every whim I get. It would make things easier, but being poor makes one creative.
-
I just got a PM from somebody having this same problem.
I've not been here in forever! but I am back.
I still believe it's a serious bug.
Like a number of people have stated, it's a braindead portforward and it's not working as expected and as other portforward rules are working.It should not EVER matter what in the doggone SIP headers, I don't know why that was even being discussed.
At the end of the day I think it's this "outbound port randomizer thing" that's causing the headaches and for whatever reason it's only seems to be happening
with UDP5060 SIP.It's not working like most people would expect it to work.
I did get around it as stated earlier by following the early suggestions.-Steve
-
Like a number of people have stated, it's a braindead portforward and it's not working as expected and as other portforward rules are working.
This ^^
At the end of the day I think it's this "outbound port randomizer thing" that's causing the headaches and for whatever reason it's only seems to be happening with UDP5060 SIP.
And this ^^
Are completely unrelated.
The port forward may work fine, but that's inbound NAT. Outbound port randomization/changing is outbound NAT. A port forward does nothing for outbound NAT, and outbound NAT does not control port forwarding.
If you want both in one rule, you use 1:1 NAT, otherwise you use manual outbound NAT and setup static port for the outbound SIP traffic in combination with a port forward.
It should not EVER matter what in the doggone SIP headers, I don't know why that was even being discussed.
Should not, yes, but it does in common setups. Some SIP trunks will send traffic to where the VIA headers say, not trusting the actual source IP/port of the packet. With those setups is where you need static port outbound NAT for your PBX for sure (or 1:1 NAT)
I talked to two people this week that had to have the same thing setup because if you watched a packet capture, the far side SIP trunk was sending the traffic back where it believed it should go, not where it actually came from.
-
Still didn't see a clear answer.
Is this the way the outbound nat rule should look like?WAN 10.0.10.0/24 * * 5060 WAN address * YES SIP - LAN to WAN
My voip server is on the 10.0.10.0 network.
Eric
-
no one ??
-
I must share the frustration expressed by others with this issue.
NAT rule to forward all UDP traffic from the VOIP provider to the Trixbox(Asterisk). Outbound calls from the Trixbox work fine. Inbound trunk calls all fail.
Wireshark monitoring shows SIP INVITEs coming into the WAN interface and NOTHING going out the LAN interface. The packets are being eaten by pfsense. No port rewrites. No nothing.
Tried the suggestions in this thread to no effect. If I had hair…
-
If it doesn't work, then something must have been misconfigured/overcomplicated/enabled without knowing it would conflict.
Go over every point in https://doc.pfsense.org/index.php/Port_Forward_Troubleshooting and make sure you have it all correct.
Seeing the SIP invites hit WAN in a capture tells you very little - your NAT rule could still be wrong/not matching, or firewall rules, or some other part of the puzzle.
-
Thanks for the reply. Went through the list. Still puzzled.
The Trixbox continues to register correctly with the VOIP carrier through that port.
NAT and Firewall rules attached, but they don't seem terribly complicated. Similar rules work flawlessly for other services.
The incoming packets definitely have the correct IP source and destination, UDP and port 5060. There are some differences between the registration packets that traverse pfsense and the invitations that do not.
The envelope has [DF] set (but does not appear fragmented and I selected the strip [DF] on fragmented packets option). It also has tos=0x010 for what that's worth.
-
Is the traffic actually being sourced from an IP in the Junction alias?
If you check the state table, is a state created when a call tries to come in?
-
Yes, the source IP is in the Junction alias.
Good idea checking the states table. :) None is created. -
No state confirms that the rule is not being matched. If it were matched, you'd have a state.
Look in the firewall logs - if you see a block to the public IP - then the NAT didn't match
If you see a block to the private IP - the NAT matched but somehow the firewall rule did not. -
I just ran into this issue on the latest firmware. Some packets forward and some don't in sip. Identical ssh forward rule to the same host work perfectly.
-
Hi,
i know that its been a while sense the last post but i got the same problem and a possible solution.
so the problem for me was that i set up a nat rule the translate every incomming udp packet to port 5060 on my wan IP address to my internal asterisk box.
my sip provider have my IP address so i dont even need to register, he just sends me invites when i have a call from the PSTN.i couldn't get incoming calls. when i called my PSTN number i could see the invite packets on my pppoe0 interface but no packets were sent to my DMZ interface.
i did a little test and tried to send a udp packet from my home computer to the pfsense to port 5060, to my wonder it worked and the packet was sent to the DMZ interface and reached the asterisk machine.
after some more digging around (and rebooting the asterisk and pfsense) i decided to look for the connection state (under Diagnostics –> States).
i searched for my SIP provider and found 2 states, one incoming and one outgoing.
i don't remember the exact state they were in (i think that the incomming was direct from the SIP provider to the asterisk, without the WAN ip in the middle, but i could be mistaken).anyhow, after deleting the 2 states i tried to dial my PSTN number and it worked.
all packets flowed and my call was received by the PBX and eventually the SIP phone :-)for right now its working but i don't know if it will last (i hope it will).
keep you guys posted.
-
Are you using manual outbound NAT and static port on 5060, 5061 and all the sip related transport ports?
-
Automatic outbound Nat
Regular inbound Nat from wan IP to server ip on port 5060 udp and another Nat rule for the rtp. -
Static port setting on the manual outbound NAT for sip related ports…. First in list.
-
I'm glad I found this thread, it cleared up some mystery for me. I remember back in 2012, I was pulling my hair out because of this issue. Spent long hours reconfiguring/reconfiguring pfsense. It never worked so I went to a different router/firewall.
I like pfsense, the interface, the lightweight os, the robustness (compatibility); But because of this SIP port-forwarding behind pfsense problem, I'm not using pfsense in production. My 2010 linksys wireless router did not have this issue, port-forwarding for sip worked fine there. Wondering if 2.2 fixed this issue. If it did, I'll give pfsense another try.
-
I'm still a bit baffled what is so hard about port forwarding, manual outbound NAT and static port.
-
Since the time of this old thread, we have added the following doc to the wiki:
https://doc.pfsense.org/index.php/PBX_VoIP_NAT_How-to
-
Thats awesome. Should help the new guys alot.
