VoIP - PBX // Login successful but no connection
-
Hi everyone,
I've been racking my brain over this VoIP issue and can't seem to find a solution.
Maybe someone can spot where I'm going wrong.
I have a PBX (Gigaset GO-BOX 100) with a static IP address. (With a fiber-optic connection.)Different ports are required for outbound traffic than for inbound traffic.
I currently have the necessary ports open.I followed the instructions in the documentation (Configuring NAT for a VoIP PBX).
The difference is that I don't create a linked rule for port forwarding because of the different ports (inbound and outbound).
After restarting the Sense and the PBX, I can update basic configurations via the PBX.
I can also assign my provider and log in successfully.Externally, the called phone rings. However, an answer or rejection is not transmitted.
Internally, no connection is established at all. There is silence, and after a while, a message appears stating that the number is unreachable.A packet capture shows that the incoming call reaches the destination and is within an open port range.
I suspect the issue is related to NAT - but I just can't figure out what I'm doing wrong.
Does anyone have a similar configuration or any tips? -
@deleted Can you show some screenshots of your various related settings?
Did you set up static port for the PBX?
-
Hi @chpalmer Thanks for lokking.
VoIP is the PBX.
Port Forwards:
Outbound NAT - Hybrid Mode:
Rules for WAN Income:
The stats have been reset and the entire system has been restarted.
I haven't made any changes to the preconfigured profile on the PBX. I only enabled DNS SRV lookup.
However, enabling it had no effect.The ports are currently set to “random,” so random ports are being used.
-
@deleted said in VoIP - PBX // Login successful but no connection:
Hi @chpalmer Thanks for lokking.
VoIP is the PBX.
The ports are currently set to “random,” so random ports are being used.
If I was trying to troubleshoot I would set my PBX IP for static port. Everything on it. That would at least rule out any tomfoolery by the PBX software..
On the other end.. what is your IP phone behind for an internet connection including router type?
-
@deleted said in VoIP - PBX // Login successful but no connection:
The difference is that I don't create a linked rule for port forwarding because of the different ports (inbound and outbound).
That seems like a problem. Your manually added rule is for a different ports alias than the NAT rule. So it's possible they will not match and hence not pass traffic.
However I would also check the ports and IP being sent via SIP. When hitting call problems with a PBX behind pfSense it is very often because the PBX is sending bad info to the client. Some firewalls include a VoIP/SIP ALG or proxy that will automatically correct that on the fly and it masks a bad;y configured PBX. pfSense doesn't.
-
Thanks for your replies.
I’ll take another look at the IP addresses, but I’m pretty sure it’s probably due to the rule IDs.
If it’s due to the PBX and I replace it with a working one, the problem with the rule IDs will still remain.
I’ll have to figure out how to resolve that first.However, thank you very much for your help and information.
-
Your reasoning for not using a linked rule on the port forward doesn't make sense to me. Have you tried just adding a linked rule with the port forward?
-
I'm not sure if I understand exactly what you mean; are you saying I should create a standard linked rule?
If I do that, the output port is also set in the rule. However, I can't change it anymore because the field is grayed out.Or what exactly do you mean?
-
Yes I mean just use the auto-added linked rule. Those are greyed out because they are set by the port forward. You would change the ports defined in the port forward dircetly if they need to be different.
Using the the linked rule traffic matching the port forward will always be passed. -
@stephenw10
I've read through this several times now and also looked at the configuration directly in Sense.However, it's confusing me.
The rules are linked so that they work together, aren't they?I can't find a suitable option anywhere.
Could you please send me a screenshot of the configuration, or show me where to set these options? -
The default setting on a port forward is to add a linked firewall rule with it:
I only mentioned this because you said that you specifically don't create that rule and add a rule manually instead. Still unclear to me why you would need to do that.
-
@stephenw10
Oh, okay, I know what you mean. Then we're talking about different things.My main issue is a PBX (Gigaset GO-BOX 100).
The VoIP for the fiber-optic connection is supposed to run through it.I looked through the documentation from the sense and recreated the setup. However, I can’t get a connection.
I can make outgoing calls, but calls can’t be answered or hung up.
Incoming calls don’t work at all.The port issue only came up because my provider requires different ports for incoming and outgoing traffic. Since I don’t really want to open any ports, I naturally wanted to limit it to the next available ones.
Currently, however, I’ve created a standard linked rule with all the necessary ports. It still doesn’t work, though.
I have no idea what I could have done wrong.
-
Hmm, so the PBX shows as registered with the provider?
I would be running some packet caps on pfSense to see what's actually arriving and being forwarded. Or not.
If you can't answer calls it seems like the handsets are not able to send SIP traffic to the PBX.
-
@stephenw10
I'm pretty sure it's due to NAT or the transmission.I can confirm that the handset is connected to the PBX, as the correct status indicators are displayed.
Since I can connect to an external line—at least the phone rings—this confirms that I'm registered with the provider.
When I capture the packet flow, I can also see that the call is coming in on the correct port.
But then it stops. I don’t see any blocks in the logs, but it doesn’t ring.
I couldn’t find any errors in my configuration.I suspect it really is the PBX.
Or can you think of anything else?I’m probably better off with a small system and freePBX.
-
It could well be NAT. VoIP hates NAT!
Can you call between internal extensions correctly?
If it is a NAT issue then it's usually because the PBX is sending the wrong IP data in the SIP packets for remote devices to respond to. Usually it's sending it's internal IP.
You should be able to see that in a packet capture of the SIP traffic though.
-
@stephenw10
I have to say I don't see anything.I can't say whether it works internally.
I only have one handset.Packet Capture:
Incoming (View Options: full // Protocol: UDP):
PPPoE [ses 0x3a] IP (tos 0xb8, ttl 57, id 29685, offset 0, flags [+], proto UDP (17), length 1492) 217.0.146.197.5060 > MY_WAN_IP.5064: SIP, length: 1464 INVITE sip:@MY_WAN_IP:5064 SIP/2.0 Via: SIP/2.0/UDP 217.0.146.197:5060;branch=z9hG4bKmavodi-0-264-eb8-3-1000000-c6480000-64f613666675b-c3b-ffffffffffffffff-7d-451e0000-64f61366205a6-2558345063-5514 Max-Forwards: 60 From: <sip:INCOMING_NUMBER@ims.telekom.de;user=phone>;tag=p65561t1779819825m890580c33004s1_2558323017-1255535506 To: <sip:my_landline_number@telekom.de;user=phone> Call-ID: p65561t1779819825m890580c33004s2 CSeq: 1 INVITE Min-SE: 900 Session-Expires: 1800;refresher=uac Supported: sec-agree Supported: replaces Supported: histinfo Supported: 199 Supported: 100rel Supported: timer Contact: <sip:mavodi-0-266-218-3-fffffff1-22b50000-64f61366665ba-c3b-ffffffffffffffff-@217.0.146.197:5060>;+g.3gpp.ps2cs-srvcc-orig-pre-alerting;+g.3gpp.mid-call;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel" Accept: application/sdp Accept: application/3gpp-ims+xml P-Early-Media: supported Allow: REGISTER,REFER,NOTIFY,SUBSCRIBE,UPDATE,INFO,MESSAGE,PRACK,INVITE,ACK,OPTIONS,CANCEL,BYE Accept-Contact: *;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel" Feature-Caps: *;+g.3gpp.trf="<unused.invalid>" Session-ID: 97c84c3b2b519ecc7c9190ac1b749e3e;remote=00000000000000000000000000000000 Record-Route: <sip:mavodi-0-266-218-3-ffffffff-22b50000-64f61366665ba-c3b-ffffffffffffffff-mavsipodi-0-26c-7d-3-451e0000-64f61366205a6-c3b@217.0.146.197:5060;transport=udp;lr;mavsipodi-0-26c-7d-3-451e0000-64f61366205a6-c3b> HI can see 2–3 attempts per call.
going out (View Options: full // Protocol: UDP):
IP (tos 0x88, ttl 128, id 52003, offset 0, flags [none], proto UDP (17), length 1047) 192.168.6.3.5064 > 217.0.146.197.5060: [udp sum ok] SIP, length: 1019 INVITE sip:outgoing_number@tel.t-online.de;user=phone SIP/2.0 Via: SIP/2.0/UDP MY_WAN_IP:5064;branch=z9hG4bKe8ae7afe9040e3604244766fc897f8bd;rport From: <sip:my_landline_number@tel.t-online.de>;tag=2796337259 To: <sip:outgoing_number@tel.t-online.de;user=phone> Call-ID: 3226527092@84_185_45_179 CSeq: 2 INVITE Contact: <sip:my_landline_number@84.185.45.179:5064> Max-Forwards: 70 User-Agent: SL450A GO/42.263.00.000.000 Supported: replaces Allow-Events: message-summary, refer, ua-profile, talk, check-sync Allow: INVITE, ACK, CANCEL, BYE, OPTIONS, INFO, SUBSCRIBE, NOTIFY, REFER, UPDATE Content-Type: application/sdp Content-Length: 379 v=0 o=- 5016 1 IN IP4 84.185.45.179 s=Mapping c=IN IP4 84.185.45.179 t=0 0 m=audio 5016 RTP/AVP 9 0 8 96 97 2 18 101 a=rtpmap:9 G722/8000 a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:96 G726-32/8000 a=rtpmap:97 AAL2-G726-32/8000 a=rtpmap:2 G726-32/8000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=ptime:20Naturally, there are a lot of entries here.
-
@deleted said in VoIP - PBX // Login successful but no connection:
I can't say whether it works internally.
I only have one handset.Hmm, this made me re-look. Is this actually a PBX at all? The device summary just looks like a cordless VoIP phone?
If it's only a phone locally you shouldn't need any setup in the firewall beyond allowing the outgoing connections. And those are allowed by default.
-
@stephenw10
I'm really glad to hear that.
I didn't want to open the ports.And yes, it's just a VoIP phone. A set with a PBX.
However, it seems clear that it isn't working or is otherwise defective.
I still can't get a connection, and I can't find any error messages. -
As far as I can see the Gigaset GO-BOX 100 is not a PBX. It's a VoIP phone that connects to some other PBX. In your case that's something external, I assume the provider is t-mobile? The PBX in this situation would be owned by them.
If that is the case then it should 'just work' as long as the SIP details are correct.
It may require a firewall rule for the outbound traffic with static ports set. Some SIP services require that but mostly much older stuff.
-
@deleted said in VoIP - PBX // Login successful but no connection:
And yes, it's just a VoIP phone. A set with a PBX.
Try the SIProxd package. I had great luck with it when I had several phones here..
I have in the past with smaller customers set up stubborn services by setting static port for the affected device and then creating firewall rules that point directly to the LAN address of said device. I always set up my VOIP devices on their own LAN so not intermingling with the production LAN.
On your WAN you can lock down access from the PBX IP to the VOIP device on your side.
I have never used any port forwards to any client type VOIP device for any of my customers anywhere. In fact my Zoom phone now connects to Zoom servers over a secure connection that I do nothing for. It just works. Id be surprised if T-Mobile did not use very similar technology..
Privacy Policy · Cookie Policy