Incoming RTP traffic being dropped at pfsense (Cisco VCS-E)

[yyaghi]

Hi All,

I have a Video/Voice (Cisco VCS-E) server sitting in my environment, I can make outgoing calls and UDP connections are fine (Voice/Video from my units are reaching remote destination) but the traffic from the remote destinations are being dropped.

I setup my pfsense to have a virtual IP that was provided from my ISP, created a 1:1 NAT Rule and opened the following ports:

• 5060

• 5061

• and the Media Port range the server is using

First 2 are TCP and the last is UDP.

Initially, looking at the logs in the firewall rules, outgoing UDP ports were being blocked, but I enabled that. But I can't seem to figure out why incoming UDP ports from my WAN interface is being dropped.
I even did a packet capture on the interfaces. I see the UDP traffic hitting my WAN interface, but when I run the PCAP on my Internal Interface, I don't see them.

Oh, I forgot to mention, I also created an outbound rule for traffic to from that server to only go though my public IP. So not sure what is going on. I've seen a bunch of forums but none are really helping.

Any ideas are welcome :D

Regards!

[chpalmer]

I setup my pfsense to have a virtual IP that was provided from my ISP, created a 1:1 NAT Rule and opened the following ports:

• 5060

• 5061

• and the Media Port range the server is using[/l][/l]
  If you create a 1:1 NAT  then you do not need to port forward.  Only create firewall rules to the LAN address..

[yyaghi]

Hi chpalmer,

I don't believe I did any port forwarding. I created FW rules on the WAN interface to allow the ports provided above.
The image labeled 7 should reflect that unless I did that incorrectly.

Thanks

[chpalmer]

@yyaghi:

Hi chpalmer,

I don't believe I did any port forwarding. I created FW rules on the WAN interface to allow the ports provided above.
The image labeled 7 should reflect that unless I did that incorrectly.

Thanks

Ah-  i misunderstood your comment.

VOIP was never designed to be behind NAT originally..  It was a later addition to the VOIP standards.  Im not sure this is affecting you in any way right now.  But something to keep in the back of your head.

Im curious what would happen if you were to move your RTP rule on WAN above the SIP rule.  Just a simple test.

[yyaghi]

While that is true, the Cisco VCS-E actually has a "NAT" IP and everything to allow for NAT'ing to work more efficiently.

Let me try that and I'll get right back to you. Sorry - I fell asleep :)

[yyaghi]

That didn't work :(

[andphil2]

Hi @yyaghi -

Do you have a network diagram?

Did you permit the ports in both directions?

[yyaghi]

Hi @andphil2,

Attached is a Visio of my network. My VCS-E is on the LAB Network. Hope that helps!

The ports 5060/5061 and the media ports have WAN rules to come in. Outgoing, I'm allowing everything.