Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Problem with asterisk/elastix server behind pfsense firewall

    Scheduled Pinned Locked Moved Firewalling
    9 Posts 3 Posters 2.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      drvirus
      last edited by

      hi all,
      i have an internal pbx asteriks on elastix with sip trunk timeout issues.
      my topology is as below :

      pbx–----pfsense--------------internet

      forsometime i find pbx is okay with my sip trunk , but after sometime , trunk get down and i see that there is timeout log  messages on my elastix server like :

      [Jul 23 22:52:38] NOTICE[2603] chan_sip.c:    – Registration for 'xxxxxx@sipgate.co.uk' timed out, trying again

      (Attempt #5018)

      ================================

      i will say what i didn on elastix and wt i didn on pfsenese :
      1- on elastix

      i added  to sip_nat.conf file
      nat=yes
      externip=(MY PUBLIC IP ADRESS)
      localhost=192.168.1.0/255.255.255.

      also i added qualify=no  on  sip trunk settings.

      2-on pfsense

      i disabled  src port  rewrite
      i allowed ports 5060 & range 10000-20000 udp ports

      i made portforward to those ports to my local pbx
      on advanced settings of pfsense i Set Conservative state table optimization
      on advanced settings of pfsense scrubbing needs disabled

      now , i can register okay from outside the pfsense and its fine
      but i have an issue with my trunk , after sometine it get down

      now if i reboot pfsense , it work for sometime ... but after sometinme the trunk get down !

      can  you help ?

      is sipproxd mandatory in my case here ?????

      plz advice me

      regards

      1 Reply Last reply Reply Quote 0
      • I
        indecided
        last edited by

        This is a known issue with PFSense and its handling of state tables. Assuming you have a dynamic IP - when your IP changes, PFSense has a habit of retaining the previous state tied to your previous dynamic IP.

        You can manually fix this each time this happens by removing the stale state, or run a script to wipe all states/specific states each time your external IP changes.

        https://forum.pfsense.org/index.php?topic=18053.0

        1 Reply Last reply Reply Quote 0
        • D
          drvirus
          last edited by

          hi ,
          thank you for reply ,

          but i have a fixed ip from the ISP !

          1 Reply Last reply Reply Quote 0
          • D
            drvirus
            last edited by

            also , want to tell u something .

            if i go to pfsense ==>states==> then clear the current sessions of firewall

            then asterisk works fine ??!!

            does that make sense ?

            1 Reply Last reply Reply Quote 0
            • I
              indecided
              last edited by

              Hmm. Since you're behind a NAT, you should probably set qualify=yes for the trunk on your Elastix box. qualify really needs to be yes almost anytime you're behind a NAT to keep the UDP session open. Give that a try and see if that fixes your problem.

              BTW, what's your qualifyfreq set to?

              1 Reply Last reply Reply Quote 0
              • G
                georgeman
                last edited by

                This could also be generated by the firewall dropping the states due to inactivity. You can try setting the "firewall optimization options" to "conservative" on System, Advanced, Firewall/NAT

                If it ain't broke, you haven't tampered enough with it

                1 Reply Last reply Reply Quote 0
                • D
                  drvirus
                  last edited by

                  hi ,
                  thanks alot for reply .

                  want to mention :
                  1- qualify was = yes , but due to the problem still exist , i put it =no
                  so , whatever yes or no the problem exist.

                  2-i have  already "conservative" option set in firewall

                  3""what's your qualifyfreq set to?"""" ===> i dont know this and not sure if i set it in my config , will this help me ?

                  agian , if i removed the current connecitons of firewall or reboot the pfsense  , it work for sometime , then it get back agian !!

                  i have fixed ip also , !!

                  any luck if

                  1 Reply Last reply Reply Quote 0
                  • G
                    georgeman
                    last edited by

                    You will probably need to run a packet capture to see what is going on. You might be hit by the "SIP packets are randomly not being NAT'ed anymore" issue which has been mentioned several times on the forum, and I am not really sure someone ever found the root cause or solved it…

                    If it ain't broke, you haven't tampered enough with it

                    1 Reply Last reply Reply Quote 0
                    • D
                      drvirus
                      last edited by

                      @georgeman:

                      You will probably need to run a packet capture to see what is going on. You might be hit by the "SIP packets are randomly not being NAT'ed anymore" issue which has been mentioned several times on the forum, and I am not really sure someone ever found the root cause or solved it…

                      thank you , but van u  guid me to similar problems to my problem ? :P :P

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.