Inbound VoIP calls not connecting due to fragmentation

phming

@Uglybrian Thanks for your reply. I tried creating an outbund NAT with static port, perhaps my settings are wrong:

outbound_NAT.png
source being the phone (SIP client)

Timeouts are not a cause I am pretty sure of this. I set conservative optimization and increased UDP timeouts manually.

@chpalmer Curious, right? I reset the device.

I launched the capture before starting the call, it seems like the the first part of the call is just getting dropped silently.

Uglybrian

Everything looks right to me. I don’t think it’ll help but, try changing your source and destination ports to any and only use one rule. Keep your rules wide open, and once things start to work, then narrow them down.

JonathanLee

Fix mtu

phming

@Uglybrian Yea I don't think NAT rules or firewall rules are causing this. To be certain I opened up UDP any in general for the local IP phone and also set UDP any for the outbound NAT rule -- no change. Like I said already I disabled the firewall completely to test.

@JonathanLee I reset MTU on the pfsense back to default and set 1500 on the bridge, like would be 'normal' or 'expected' but it doesn't help.

I haven't yet tried to configure the modem as a router but if that would solve the problem I could just go back to using the default ISP router. I'm not even sure it's an issue on my end. With other deployments using different ISP I never had such problems. From my experience it seems that only with this ISP you have no other way but to use their devices. There is a tutorial of someone using opnsense in a similar fashion which was shown to work but I doubt that there would be a big difference compared to pfsense.

JonathanLee

Did you ping test the MTU?

chpalmer

@JonathanLee I say yes try the siproxd package. If you need help setting it up I can help you.

The other thing you can try is to force your client device to use static IP.

SIP was not originally designed to be behind NAT. In order for companies like Vonage to start selling to consumers they had to hack NAT into it. It's still not pretty and double NAT could give you twice a headaches if not more.

phming

@JonathanLee No I didn't. If you don't mind could you give an example for how to test please.

@chpalmer I'll try to see if it works better with siproxd but I probably won't have time to test until next weekend.

JonathanLee

@phming Like this

https://kb.netgear.com/19863/Ping-Test-to-determine-Optimal-MTU-Size-on-Router

w0w

https://www.iea-software.com/products/mtupath/

phming

@JonathanLee @w0w

thanks I'll give this a try