Strange wifi calling problem
-
Hi. First post here and a new pfsense user (came from ipfire), so go easy on me!
I have pfsense set up just the way i want it, Suricata and pfblocker devel. Everything is working fine apart from a weird wifi calling issue.
On a fresh boot of pfsense, wifi calling works fine and will continue to work fine until i toggle airplane mode or leave the house and come back, i.e when i loose connection to the router.
The only way i can get wifi calling to re enable is to re boot pfsense.
Ive tried to disable Suricata and pfblocker, again the only way to get wifi calling back again is to reboot pfsense.
Maybe there is some parts of Suricata and pfblocker that are not fully disabled when i was testing it?
Is there some obscure setting that i am missing? Ive even tried to give my phone a static ip, but that didnt work either.
I have Firewall Optimization Options set to conservative and Disable Firewall Scrub activated.
Please help!
-
I don't think I've run into that since putting in a pfSense at home earlier this year. However I have seen threads on it: https://forum.netgate.com/topic/152744/tip-i-solved-my-wifi-calling-issues
-
@teamits Thanks for the reply. Yes, ive seen that post. Ive tried it along with every other thread on the internet it seems!
I cant understand why it connects at first boot just fine and will stay connected forever until i drop wifi connection.
Surely if it connects fine in the first place then it should connect every time.
At a loss really.
-
I don't think you said what phone OS you have but does it have the "private address" feature turned on for Wi-Fi? (which generates a new MAC address for each connection/network)
-
@teamits Sorry, Android 10 and private address is turned off. Also happening with the wifes Android phone.
-
Wifi calling is a VPN issue rather than a VoIP almost always.
And usually it's due to a static outbound NAT requirement.
You could be hitting an existing state preventing the new connection. UDP states in conservative mode can stay open a long time.
Next time you hit this try resetting the state table instead of rebooting.
If that works try to manually remove states until you find the offending one. Probably one using port 500 or 4500.
Steve
-
@stephenw10 Thanks. Been tinkering with this issue all day. I reinstalled pfsense just to rule that out. It seems its Suricata related. Disabling Suricata now lets wifi calling work as it should. Any tips where i start to troubleshoot Suricata?
-
Is something getting blocked? Turn off blocking for a while and see if it still happens. Do you have Suricata running in legacy (the default) or inline mode? Legacy should just make a copy of the packet so shouldn't interfere with anything.
-
It should show in the Suricata alerts then if it's doing anything at all with it.
-
@stephenw10 Yes it did. I removed it from the block list and added it to supressed. I have uninstalled Suricata and have installed Snort...with the same rules.....all is working fine!
Its something im doing wrong on there probably. But its beaten me unforunately.
Just odd that im having no issues with snort with same rules.
-
Take the win!
-
@stephenw10 Thanks for the advice along the way. Merry Christmas to you.
If anyone does know what i was doing wrong, i would be gratefull of you could let me and anybody else who may have the same problem in the future know.
-
@chris79 The alert/block will specify the rule that triggered it. Per the package maintainer Suricata can't process quite all Snort rules (a few error out on load) so it is possible they were different. Once suppressed the alert shouldn't trigger the block anymore though.
-
@teamits Thank you. If i come back to Suticata i will try what you suggest. Things seem to be working now with snort so i may resist the temptation of playing more and digging another bottomless hole for myself!
