IAX2 not going out after a while
-
Hello,
I've experienced this same issue with a number of pfsense boxes:
I have an Asterisk VOIP server sitting on the LAN port of a very simple PFSense firewall system. So simple, it could be the default configuration. The VOIP server communicates with a VOIP provider via an IAX2 UDP connection.
This works fine, but after a few days, suddenly the IAX2 packets stop going out to the WAN. I've used tcpdump to verify that the IAX2 packets come in the LAN port, but never exit the WAN port.
I did a search thru the rules - nothing blocking. I did a search on the states for the IP address of the IAX2 provider, nothing. Yet when I reset the states, it starts working again... For an undetermined amount of time, then stops again.
This happens on multiple PFSense boxes, so I know its not just a fluke with one. I've also seen a few other messages with people having similar situations, with no apparent resolve. How can I help to resolve this?
Bob
-
Check for open states when it stops passing the traffic. If packets arrive at the LAN port there should be at least a state for it there unless the firewall is blocking it for some reason.
If there are states but it never leaves the WAN then it's either: trying to use some other route, has no route at all, is being collected by IPSec, or is blocked outbound for some reason.
-
@stephenw10
I checked for any open states for the IP address of the IAX2 server, but nothing. That is what is so puzzling!Is there some maximum length of a state?
Bob
-
Yes there are. They are defined in pf. You can set longer timeouts or choose a firewall mode that has longer timeouts already defined, like 'conservative', in Sys > Adv > Firewall.
But that only applies to states not passing traffic.
-
IAX2 traffic should have keepalive packets going. And they typically do. So far, I'm at 2 weeks now that it has been up and working, but I bet within the next week or two, it will die again. That has been the pattern. And the strange thing is, it's not just one PFSense box. I've seen this exact thing happen on other boxes as well, most of them having almost no variation from the default config, except customized LAN and WAN addresses.
-
Mmm, you'll probably have to wait for it to fail and check what states are still there. I'd expect it to just re-connect if the states timed out and start to fail.
