Strange wifi calling problem
-
@teamits Sorry, Android 10 and private address is turned off. Also happening with the wifes Android phone.
-
Wifi calling is a VPN issue rather than a VoIP almost always.
And usually it's due to a static outbound NAT requirement.
You could be hitting an existing state preventing the new connection. UDP states in conservative mode can stay open a long time.
Next time you hit this try resetting the state table instead of rebooting.
If that works try to manually remove states until you find the offending one. Probably one using port 500 or 4500.
Steve
-
@stephenw10 Thanks. Been tinkering with this issue all day. I reinstalled pfsense just to rule that out. It seems its Suricata related. Disabling Suricata now lets wifi calling work as it should. Any tips where i start to troubleshoot Suricata?
-
Is something getting blocked? Turn off blocking for a while and see if it still happens. Do you have Suricata running in legacy (the default) or inline mode? Legacy should just make a copy of the packet so shouldn't interfere with anything.
-
It should show in the Suricata alerts then if it's doing anything at all with it.
-
@stephenw10 Yes it did. I removed it from the block list and added it to supressed. I have uninstalled Suricata and have installed Snort...with the same rules.....all is working fine!
Its something im doing wrong on there probably. But its beaten me unforunately.
Just odd that im having no issues with snort with same rules.
-
Take the win!
-
@stephenw10 Thanks for the advice along the way. Merry Christmas to you.
If anyone does know what i was doing wrong, i would be gratefull of you could let me and anybody else who may have the same problem in the future know.
-
@chris79 The alert/block will specify the rule that triggered it. Per the package maintainer Suricata can't process quite all Snort rules (a few error out on load) so it is possible they were different. Once suppressed the alert shouldn't trigger the block anymore though.
-
@teamits Thank you. If i come back to Suticata i will try what you suggest. Things seem to be working now with snort so i may resist the temptation of playing more and digging another bottomless hole for myself!
