Resolved: T-Mobile CellSpot connectivity issues
-
Have you tried a different Ethernet cable? Solid light would seem to indicate no connection to your switch..
Yeah ..lol. I can see it acquires an IP address in the DHCP leases table. I can ping it. Moved to LAN subnet and it works the same way. Same cable used to connect directly to the modem and it works.
-
https://support.t-mobile.com/docs/DOC-24271 I was just reading this doc..
Your cellspot is making a VPN connection to the Tmobile servers as proven by your state table.
Your cellspot is not making an connection inside the VPN as shown by your blinking orange light.
Something is messing up the VPN packets. Can you try connecting the cellspot direct to your pfsense box without the switch? Have an extra interface?
Just trying to rule things out.
-
Yep, just tried it. Plugged in the VoIP interface straight… no go :(
-
And to verify- No static DHCP setting for it is there?
Your not blocking DNS in any way? These devices unless you see different as it starts, tend to use their own DNS so your DNS should not matter
-
This seems like a 100% problem for t-mobile to solve. Too bad their support is so unhelpful and ignorant.
-
And to verify- No static DHCP setting for it is there?
Your not blocking DNS in any way? These devices unless you see different as it starts, tend to use their own DNS so your DNS should not matter
Wide open same as default LAN.
IPv4 * VOIP net * * * * none Default allow VoIP to any rule
-
This seems like a 100% problem for t-mobile to solve. Too bad their support is so unhelpful and ignorant.
Sounds like the device is not set for NAT operation.
Many people here including myself (for my office and two other customers) have these femtocell devices up and running behind our pfsense boxes with no issue. If this was an issue with pfSense there would be tons of posts with complaints of the same. But it just works for me and seemingly everyone else.
To test my NAT therory.. do you have a SOHO router hanging around? Your not double NATted are you?
-
There are generally zero configurable options on these things.
-
There are generally zero configurable options on these things.
Yea- has to be done by the carrier.
-
No double NAT. Just different subnets for LAN, VoIP and Video. I used a simple Asus SOHO router and it connected in matter of mins. Right now I have plugged it in directly behind the modem and that works as well. Just the moment I move it behind pfSense it hits a block. Firewall logs (when logging enabled for VoIP subnet rules) show a green check for the CellSpot IP.. means it passed through.
What I have not tried yet is force opening port 53 for the CellSpot even though the VoIP subnet (like the LAN) is wide open. I have even tried keeping on default LAN on a fresh plain install.. same issue.
What baffles me is that, nothing changed on my network except moving to v2.3.2. I may have to go back to v2.2 if this issue is not resolved.
-
What I have not tried yet is force opening port 53 for the CellSpot even though the VoIP subnet (like the LAN) is wide open. I have even tried keeping on default LAN on a fresh plain install.. same issue.
Your interface the cellspot is on needs full access to the internet. Basically it needs to be able to surf to anything it wants to. Rule= Voipnet any port any destination any port. Block nothing if you have not already. You really need nothing on WAN for it at all.
Other thing- Go to System/Advanced/Firewall&NAT TFTP Proxy. Enable that for your VOIP interface.
Another thing you could try is to make your devices port 4500 static in the outbound NAT page.
Im off to work in the field today so good luck!
-
Tried everything except for the TFTP Proxy. Will see if it does anything.
My VoIP Rule is like LAN.. [ IPv4 * VOIP net * * * * none Default allow VoIP to any rule ]
No change in data counters with port forwards for 4500, 500 and 123 directing to the CellSpot.
-
As I said before. Those port forwards might be screwing things up. They are 1000% not required for outbound connections.
I would get rid of all of that, get good two-way traffic on the IPsec session (500 and 4500 - whether it keeps increasing or not - look at all states on all interfaces filtering on whatever public IP you're connecting to) and call T-mobile and see whether they can see your unit connecting.
-
As I said before. Those port forwards might be screwing things up. They are 1000% not required for outbound connections.
I would get rid of all of that, get good two-way traffic on the IPsec session (500 and 4500 - whether it keeps increasing or not - look at all states on all interfaces filtering on whatever public IP you're connecting to) and call T-mobile and see whether they can see your unit connecting.
What I meant was port forwards didn't help. The system is on the default build state with no user changes.
Had called T-Mobile, but they said the CellSpot is not visible once behind the router and no connection requests are seen. Data counters are not showing any improvements. The CellSpot leaves the old connections and then tries with a new server every few mins.
-
If you have states to them and two-way traffic to them and no connection requests are seen by them, not sure what to tell you really.
You could packet capture but all you will be able to see is probably some DNS then the outside of an IKE/IPsec tunnel. You might do it and see if things seem to break down when packet sizes increase past about 1400 or something.
-
Tell us more about the hardware you are running pfSense on..
Especially the interface types.
-
What I have not tried yet is force opening port 53 for the CellSpot even though the VoIP subnet (like the LAN) is wide open. I have even tried keeping on default LAN on a fresh plain install.. same issue.
Your interface the cellspot is on needs full access to the internet. Basically it needs to be able to surf to anything it wants to. Rule= Voipnet any port any destination any port. Block nothing if you have not already. You really need nothing on WAN for it at all.
Other thing- Go to System/Advanced/Firewall&NAT TFTP Proxy. Enable that for your VOIP interface.
Another thing you could try is to make your devices port 4500 static in the outbound NAT page.
Im off to work in the field today so good luck!
FINALLY !!!! I can see the counters increasing steadily !!
It wasn't the TFTP Proxy.. but the MFS (Maximum Frame Size) on the network. Not sure why this happened now in pfSense v2.3.2 but I have the network config on 9216 (9000K) since 2012 with zero issues and the CellSpot worked just fine all these months. I installed an older v2.2 copy of pfSense last night on a backup server and the CellSpot connected fine once I restored the old config on it.
Definitely a frame size issue on v2.3.2. I confirmed this twice by changing the MFS to 9K and see the CellSpot disconnect. Tried putting a 9000 MTU on the interface but it didn't help.
-
ALL devices on a jumbo frame segment have to support, and be configured for, the jumbo frame size. Not quite sure how you are doing that on the cell spot with no config knobs.
-
Yeah, the CellSpot has 100Mbps port and not gigabit.
Along with changing the MFS to 1518 I had to enable (uncheck) the default set on the interface : Hardware TCP Segmentation Offloading & Hardware Large Receive Offloading.
Since I have intel 4 port NIC, I thought enabling it wouldn't hurt.
-
Yeah, the CellSpot has 100Mbps port and not gigabit.
Along with changing the MFS TO 1518 I had to enable (uncheck) the default set on the interface : Hardware TCP Segmentation Offloading & Hardware Large Receive Offloading.
Since I have intel 4 port NIC, I thought enabling it wouldn't hurt.
Intel drivers are generally just fine with those two checked. Is it em, igb or ?? Are you sure it's a real intel card and not a far-east knockoff?