problems unblocking my sip provider

chpalmer

http://siproxd.sourceforge.net/ for some details if your so inclined.

randomaustralian

chpalmer: Cheers mate. trying it out and testing it.

i thought i should have provided this from the very get go.

pretty sure i said before they don't officially support this, but this is the information i found online to get it working originally.

https://crowdsupport.telstra.com.au/t5/Modems-Hardware/ports-for-firewall-in-front-of-telstra-router/m-p/720153#M36304

randomaustralian

doesn't seem to do anything.
In fact i couldn't even make outgoing calls.

THIS
is the bit that is confusing me the most.

the traffic is being sent from port 5060 to 23625(seems to be randomly generated). no matter what i put into pfSense i cant write the rules so that ANY traffic that comes from port 5060 to ANY port on my firewall is forwarded to my SIP device. I am sure this is what i have to do to get this to work.

If I am understanding what I am doing here correctly we are writing rules so any packet that get sent to port 5060 on my firewall gets redirected. This is not what my provider is actually doing.
can i just make it so any packet that was transmitted from port 5060 to my wall get redirected to my sip device without any other conditions?

chpalmer

Im reading through the Telstra forum post right now. Does not look solved to me.

But- If you have SIProxd in place and the system is still trying to connect to a port other than the 5060 to 5080 range as in your picture above then the box is not connecting to the proxy. I would take it that you do not have anything showing up in "registered devices". You might leave it off the air overnight and then try again in the morning. Your SIP server and device are probably holding on to an earlier registration.

You can set up a static port in the router at Firewall/Nat Outbound NAT tab. Make the whole LAN address of the device "static" and see what that does for you. If this box connects correctly your firwall will show connections to your LAN device and never your WAN address. That is why I think they are doing something hinky.

chpalmer

Redirect Target Port is a numerical input and not what you have typed. If you want a 1:1 then do a 1:1. Otherwise do a port forward for each port or range of ports.

chpalmer

I can't show you a port forward example because I never port forward to an ATA or phone. But the same idea can be seen from one of my spur office ATA setups..

randomaustralian

The ports in the answer worked perfectly on my previous software firewall IPFire. pfSense is just more tightly programmed.

1:1 doesn't work either. the firewall still blocks it.

even when i try this

it still doesn't work. but nothing shows up in the firewall logs

chpalmer

The states from that box

chpalmer

Have you tried a Static port?

randomaustralian

there are heaps of states from that device... but it also runs other services from my provider. the IP address to the sip server shows up nothing.

https://justpaste.it/4rnti

randomaustralian

that wont work either because the information is not being sent to port 5060 at my end

chpalmer

Remember that when you make a change and it somehow registers then you have to sometimes wait for the registration to clear out of your providers server..

One thing I had to do at one point was to turn on TFTP proxy on so that some of my devices could get their config files.. That one stumped me for a bit.

But if it already has its file I wouldn't see that as an issue. If it has registered ever it should.

Systemm/Advanced/Firewall&NAT twards the bottom.

chpalmer

@randomaustralian said in problems unblocking my sip provider:

that wont work either because the information is not being sent to port 5060 at my end

Its coming from the firewall at that port. Thats a randomized port that the firwall does by default. Thats what the static port would stop.

randomaustralian

but the logs read like its coming from the source at port 5060 and arriving at my firewall on a random port

chpalmer

@randomaustralian said in problems unblocking my sip provider:

but the logs read like its coming from the source at port 5060 and arriving at my firewall on a random port

Its trying to report back to where its told to go. If you do a static port that will change.

chpalmer

Do you have any WAN rules pointed at 10.0.0.150 now?

randomaustralian

i put it in as you had it in the picture and its "being ignored" i cant activate it

and no id didnt auto create a new WAN rule

chpalmer

@randomaustralian

Create a WAN rule with source (their server) destination 10.0.0.150 any on the ports.
Put it on top of all your rules.

Log the rule..

Then if anything is happening between the boxes then it will show up in your firewall logs.

randomaustralian

the phone is still not ringing for incoming calls

chpalmer

@randomaustralian

Now you need to find out where your RTP comes from.

Make a call and watch the states. When you call out it will probably connect to a different server.. Some do some dont. Depends on the carrier.

If you look at my WAN rules above from 30 minutes ago you will see that I have rules for RTP for at least a couple of different locations.