Asterisk ON pfSense2.0.1



  • Same disclaimer as the post based on whick I'm trying to make it work: "Yes, a firewall is meant to ..firewall and nothing more. Agreed. Now pfSense is - also - about having fun and the IT security eng. in me is not that much shocked (IF configuration is done properly) about what we'll discuss here. Don't get mad."

    So I'm trying to install asterisk based on the steps described here: http://forum.pfsense.org/index.php/topic,41397.0.html
    I'm also using a nanoBsd version, on a 4GB CF card.

    Here's what I did so far:
    login with SSG, press 8 for shell, then:

    /etc/rc.conf_mount_rw
    

    For some reason I get stuck at step a.). (as described in the above linked post)

    pkg_add -vr asterisk

    fails, because "No such file or directory". Tried```
    pkg_add -vr asterisk18

    
    Noticed that it pkg_add was looking in 8.2 repository, so I changed with this:
    

    setenv PACKAGESITE ftp://ftp-archive.freebsd.org/pub/FreeBSD-Archive/old-releases/i386/8.1-RELEASE/packages/

    but still no luck…
    
    Tried```
    pkg_add -vr asterisk-1.4.29_4
    

    this one seemed to install, but when going on to step b.), can't seem to find any /usr/local/etc/rc.d/asterisk file to rename. During installation porcess I've seen many "seek failed" messages - but can't say which files were affected, because shell scrolled quickly.

    Can you give me any hints please.

    Many thanks in advance.



  • Hey!

    I am glad to help!
    Still using this configuration, and it just rocks (for 6 IP phones and 2 analog/ATA)  :-*

    Yes, the PACKAGESITE is by default wrong: I'll find it back for you.  :-\

    My post is blocked?  ;D
    Is it because of the lamer intervention?
      ???



  • Try from my repo, I've compiled asterisk 1.8.8.1 to run on pfsense.

    amd64
    pkg_add -r http://e-sac.siteseguro.ws/packages/amd64/8/All/asterisk18-1.8.8.1.tbz

    i386
    pkg_add -r  http://e-sac.siteseguro.ws/packages/8/All/asterisk18-1.8.8.1.tbz

    to fix PACKAGESITE var to use 8.1 package repo, use

    amd64
    setenv PACKAGESITE "http://ftp-archive.freebsd.org/pub/FreeBSD-Archive/ports/amd64/packages-8.1-release/Latest/"

    i386
    setenv PACKAGESITE "http://ftp-archive.freebsd.org/pub/FreeBSD-Archive/ports/i386/packages-8.1-release/Latest/"



  • Thanks marcelloc, I'll try your bins too.

    Meanwhile, did anybody try this nice little AsteriskGUI from FIVN?
    http://www.fivn.com/products/asterisk.html

    It runs on basic routers with dd-wrt, so I guess it shouldn't have any problems with a full-blown pfSense…



  • No success  >:(

    /etc/rc.conf_mount_rw
    
    pkg_add -r  http://e-sac.siteseguro.ws/packages/8/All/asterisk18-1.8.8.1.tbz
    
    

    I got various errors:

    /var: write failed, filesystem is full
    lib/perl5/5.12.4/unicore/mktables.lst: Seek failed
    ...
    lib/perl5/5.12.4/warnings/register.pm: Seek failed
    tar: (Empty error message)
    tar: Error exit delayed from previous errors.
     Done.
    ...
    tar: lib/perl5/5.12.4/warnings/register.pm: Cannot stat: No such file or directory
    tar: Error exit delayed from previous errors.
    Removing stale symlinks from /usr/bin...
        Skipping /usr/bin/perl
        Skipping /usr/bin/perl5
    Done.
    ...
    WARNING: Failed to create /usr/local/etc/sasldb2
    
    

    etc…

    Disk usage was at 10% on Dashboard when first errors came up. At finish 16%, and no /usr/local/etc/rc.d/asterisk....

    Any ideas?



  • df -h:

    Filesystem           Size    Used   Avail Capacity  Mounted on
    /dev/ufs/pfsense0    1.8G    266M    1.4G    16%    /
    devfs                1.0K    1.0K      0B   100%    /dev
    /dev/md0              38M     92K     35M     0%    /tmp
    /dev/md1              58M    7.8M     45M    15%    /var
    /dev/ufs/cf           49M    452K     45M     1%    /cf
    devfs                1.0K    1.0K      0B   100%    /var/dhcpd/dev
    

    thus I don't understand the message /var: write failed, filesystem is full



  • There is a post in forum that jimp explains how to fix this smal partition used during package install, I'll try to find it and post here.

    Here is the post:
    http://forum.pfsense.org/index.php/topic,44953.msg234429.html#msg234429

    shortcut to solution:

    /etc/rc.conf_mount_rw
    setenv PKG_TMPDIR /root/
    pkg_add -r http://e-sac.siteseguro.ws/packages/8/All/asterisk18-1.8.8.1.tbz
    /etc/rc.conf_mount_ro
    
    

    Also, I think this topic should be moved to packages.



  • Thanks, I found it myself, and it seems to install fine now! I'm going on with config tests…



  • Alright! It installed smoothly.

    Next question is, how to make it start at boot?

    adding 'asterisk_enable="YES"' to the the /etc/rc.conf.local (or /etc/defaults/rc.conf) doesn't start it at boot.
    (copied /usr/local/etc/rc.d/asterisk to /etc/rc.d/asterisk.sh)



  • Edit startup script and change values from NO to YES.  :)



  • Which startup script?

    /etc/rc.conf.local  <-doesn't work
    /etc/rc.conf  <-gets deleted every time I reboot



  • asterisk script /usr/local/etc/rc.d/asterisk

    Reference:
    http://forum.pfsense.org/index.php/topic,2996.0.html



  • Cool, thanks.

    I'm used to debian…  :-\



  • Can you test and feedback if asterisk is working with no issues like one-way-audio?



  • I'm on to it. But before that, I notice stupid errors like this:

    [Jan 25 14:45:34] WARNING[22801]: db.c:115 dbinit: Unable to open Asterisk database '/var/db/asterisk/astdb': No such file or directory
    [Jan 25 14:45:34] WARNING[22801]: db.c:592 ast_db_gettree: Database unavailable
    [Jan 25 14:45:35] WARNING[22801]: db.c:115 dbinit: Unable to open Asterisk database '/var/db/asterisk/astdb': No such file or directory
    [Jan 25 14:45:35] WARNING[22801]: db.c:592 ast_db_gettree: Database unavailable
    [Jan 25 14:45:35] WARNING[22801]: pbx_spool.c:772 load_module: Unable to create queue directory /var/spool/asterisk/outgoing -- outgoing spool disabled
    [Jan 25 14:45:35] WARNING[22801]: db.c:115 dbinit: Unable to open Asterisk database '/var/db/asterisk/astdb': No such file or directory
    [Jan 25 14:45:35] WARNING[22801]: db.c:115 dbinit: Unable to open Asterisk database '/var/db/asterisk/astdb': No such file or directory
    [Jan 25 14:45:35] WARNING[22801]: db.c:115 dbinit: Unable to open Asterisk database '/var/db/asterisk/astdb': No such file or directory
    [Jan 25 14:45:35] WARNING[22801]: db.c:115 dbinit: Unable to open Asterisk database '/var/db/asterisk/astdb': No such file or directory
    [Jan 25 14:45:35] WARNING[22801]: db.c:592 ast_db_gettree: Database unavailable
    [Jan 25 14:45:35] WARNING[22801]: db.c:115 dbinit: Unable to open Asterisk database '/var/db/asterisk/astdb': No such file or directory
    [Jan 25 14:45:35] WARNING[22801]: db.c:592 ast_db_gettree: Database unavailable
    

    Is there any way to disable astdb… I'm using v1.4 in production, that one doesn't have this problem. I need to hunt this down before any further testing.

    Remember, I'm on nanobsd...



  • /var is flushed every boot, it's on ram.

    You need to change db file location to /usr for example.



  • @marcelloc:

    You need to change db file location to /usr for example.

    But that's read-only at run-time, isn't it? On nanoBsd.



  • Yes, it is.

    You will have to find a way to create or copy/backup db on asterisk startup and shutdown



  • Since my asterisk setup is quite simple, no database used really, I redirected everything that needs to be written to /tmp, don't mind if that's lost at reboot. Hope that workaround will be suitable.



  • I didn't bind Asterisk to any interface. It binds to all, so no firewall settings are required at all.

    Phones connect through LAN, telco providers connect through WAN. Asterisk itself routes the SIP/RTP traffic.



  • So, It's working as expected(sip gateway/proxy/server) with no audio issues?



  • @marcelloc:

    So, It's working as expected(sip gateway/proxy/server) with no audio issues?

    Running with no issues so far for 4 days:

    • gateway/router/nat
    • OpenVPN server and client simultaneously
    • asterisk

    I also plan running Snort, but I need to upgrade RAM on the box first…



  • I wrote a small php status page integrating in pfSense's webGUI, for anyone interested.



  • Some tweaks, to make Asterisk 1.8.8.1 run smoothly on pfSense box. In my case, it's a nanobsd-system, but they should work just as well on normal systems.

    /usr/local/etc/asterisk/asterisk.conf:

    [directories]
    astetcdir => /usr/local/etc/asterisk
    astmoddir => /usr/local/lib/asterisk/modules
    astvarlibdir => /usr/local/share/asterisk
    astdbdir => /tmp
    astkeydir => /usr/local/share/asterisk
    astdatadir => /usr/local/share/asterisk
    astagidir => /usr/local/share/asterisk/agi-bin
    astspooldir => /tmp
    astrundir => /var/run/asterisk
    astlogdir => /var/log/asterisk
    

    Make sure to create all the directories above if they don't exist, they are needed in order to run properly. astlogdir contains the base path where the call logs go, if that's a read-only location, simply create a symlink cdr-csv which points to a writable directory, in my case /tmp is just fine (I don't mind if I loose the file while rebooting). So it means that asterisk will look at the factory path /var/log/asterisk/cdr-csv/Master.csv actually in /tmp/Master.csv. Main asterisk log file usually goes also in astlogdir but that can be overridden below:

    /usr/local/etc/asterisk/logger.conf by the end of the file:

    console => notice,warning,error
    ;console => notice,warning,error,debug
    ;messages => notice,warning,error
    /tmp/log_asterisk => notice,warning,error
    

    Where /tmp/log_asterisk is the logfile. Note that in my status_asterisk_log.php page it looks for this file so if you change location, don't forget to update the php script too.

    /usr/local/etc/asterisk/modules.conf:

    noload => res_ael_share.so
    noload => res_adsi.so
    noload => res_agi.so
    noload => res_calendar.so
    noload => res_crypto.so
    ;noload => res_fax.so
    noload => res_jabber.so
    noload => res_monitor.so
    ;noload => res_stun_monitor.so
    noload => res_smdi.so
    noload => res_speech.so
    noload => res_odbc.so
    noload => res_musiconhold.so
    noload => app_celgenuserevent.so
    ;noload => app_confbridge.so
    ;noload => app_minivm.so
    ;noload => app_originate.so
    ;noload => app_playtones.so
    ;noload => app_readexten.so
    ;noload => app_waituntil.so
    ;noload => bridge_builtin_features.so
    ;noload => bridge_multiplexed.so
    ;noload => bridge_simple.so
    ;noload => bridge_softmix.so
    noload => cdr_adaptive_odbc.so
    noload => chan_jingle.so
    ;noload => chan_bridge.so
    noload => chan_unistim.so
    ;noload => codec_g722.so
    ;noload => format_g719.so
    noload => format_sln16.so
    noload => format_siren14.so
    noload => format_siren7.so
    ;noload => func_aes.so
    ;noload => func_audiohookinherit.so
    ;noload => func_blacklist.so
    ;noload => func_config.so
    ;noload => func_devstate.so
    ;noload => func_dialgroup.so
    ;noload => func_dialplan.so
    ;noload => func_extstate.so
    ;noload => func_iconv.so
    ;noload => func_lock.so
    ;noload => func_module.so
    ;noload => func_shell.so
    ;noload => func_speex.so
    ;noload => func_sprintf.so
    ;noload => func_sysinfo.so
    ;noload => func_version.so
    ;noload => res_curl.so
    noload => func_vmcount.so
    noload => func_volume.so
    noload => res_clialiases.so
    noload => res_config_curl.so
    noload => res_config_ldap.so
    noload => res_config_sqlite.so
    ;noload => res_limit.so
    ;noload => res_phoneprov.so
    noload => res_realtime.so
    noload => res_timing_pthread.so
    ;noload => app_adsiprog.so
    ;noload => app_alarmreceiver.so
    ;noload => app_amd.so
    ;noload => app_authenticate.so
    ;noload => app_cdr.so
    ;noload => app_chanisavail.so
    ;noload => app_channelredirect.so
    ;noload => app_chanspy.so
    ;noload => app_controlplayback.so
    noload => app_db.so
    ;noload => app_dial.so
    ;noload => app_dictate.so
    ;noload => app_directed_pickup.so
    ;noload => app_directory.so
    ;noload => app_disa.so
    ;noload => app_dumpchan.so
    ;noload => app_echo.so
    ;noload => app_exec.so
    ;noload => app_externalivr.so
    ;noload => app_festival.so
    ;noload => app_followme.so
    ;noload => app_forkcdr.so
    ;noload => app_getcpeid.so
    ;noload => app_ices.so
    ;noload => app_image.so
    ;noload => app_macro.so
    ;noload => app_milliwatt.so
    ;noload => app_mixmonitor.so
    ;noload => app_mp3.so
    ;noload => app_morsecode.so
    ;noload => app_nbscat.so
    ;noload => app_parkandannounce.so
    ;noload => app_playback.so
    ;noload => app_privacy.so
    ;noload => app_queue.so
    ;noload => app_read.so
    ;noload => app_readfile.so
    ;noload => app_record.so
    ;noload => app_sayunixtime.so
    ;noload => app_senddtmf.so
    ;noload => app_sendtext.so
    ;noload => app_setcallerid.so
    ;noload => app_sms.so
    ;noload => app_softhangup.so
    noload => app_speech_utils.so
    ;noload => app_stack.so
    ;noload => app_system.so
    ;noload => app_talkdetect.so
    ;noload => app_test.so
    ;noload => app_transfer.so
    ;noload => app_url.so
    ;noload => app_userevent.so
    ;noload => app_verbose.so
    ;noload => app_voicemail.so
    ;noload => app_waitforring.so
    ;noload => app_waitforsilence.so
    ;noload => app_while.so
    ;noload => app_zapateller.so
    ;noload => cdr_csv.so
    noload => cdr_custom.so
    ;noload => cdr_manager.so
    noload => cdr_pgsql.so
    noload => cdr_radius.so
    noload => cdr_sqlite.so
    noload => cdr_sqlite3_custom.so
    noload => cdr_syslog.so
    ;noload => cel_custom.so
    ;noload => cel_manager.so
    noload => cel_odbc.so
    noload => cel_pgsql.so
    noload => cel_radius.so
    noload => cel_sqlite3_custom.so
    noload => cel_tds.so
    ;noload => chan_agent.so
    noload => chan_gtalk.so
    noload => chan_iax2.so
    ;noload => chan_local.so
    ;noload => chan_mgcp.so
    ;noload => chan_multicast_rtp.so
    noload => chan_oss.so
    ;noload => chan_sip.so
    noload => chan_skinny.so
    ;noload => codec_a_mu.so
    ;noload => codec_adpcm.so
    ;noload => codec_alaw.so
    ;noload => codec_g726.so
    ;noload => codec_gsm.so
    ;noload => codec_lpc10.so
    ;noload => codec_speex.so
    ;noload => codec_ulaw.so
    ;noload => format_g723.so
    ;noload => format_g726.so
    ;noload => format_g729.so
    ;noload => format_gsm.so
    ;noload => format_h263.so
    ;noload => format_h264.so
    ;noload => format_ilbc.so
    noload => format_jpeg.so
    ;noload => format_ogg_vorbis.so
    ;noload => format_pcm.so
    ;noload => format_sln.so
    ;noload => format_vox.so
    ;noload => format_wav.so
    ;noload => format_wav_gsm.so
    ;noload => func_base64.so
    ;noload => func_callcompletion.so
    ;noload => func_callerid.so
    ;noload => func_cdr.so
    ;noload => func_channel.so
    ;noload => func_curl.so
    ;noload => func_cut.so
    noload => func_db.so
    ;noload => func_enum.so
    ;noload => func_env.so
    ;noload => func_frame_trace.so
    ;noload => func_global.so
    ;noload => func_groupcount.so
    ;noload => func_logic.so
    ;noload => func_math.so
    ;noload => func_md5.so
    noload => func_odbc.so
    ;noload => func_pitchshift.so
    ;noload => func_rand.so
    ;noload => func_realtime.so
    ;noload => func_sha1.so
    ;noload => func_srv.so
    ;noload => func_strings.so
    ;noload => func_timeout.so
    ;noload => func_uri.so
    noload => pbx_ael.so
    ;noload => pbx_config.so
    ;noload => pbx_dundi.so
    ;noload => pbx_loopback.so
    ;noload => pbx_realtime.so
    ;noload => pbx_spool.so
    ;noload => res_clioriginate.so
    noload => res_config_pgsql.so
    ;noload => res_convert.so
    ;noload => res_mutestream.so
    ;noload => res_rtp_asterisk.so
    ;noload => res_rtp_multicast.so
    ;noload => res_security_log.so
    ;noload => res_snmp.so
    noload => cdr_odbc.so
    noload => cdr_tds.so
    noload => chan_h323.so
    noload => res_config_odbc.so
    

    Tons of modules there, the ones uncommented in the config file will not be loaded by Asterisk. I don't use these anyways, so less memory usage, less conflicts and no errors at all with this setup.

    /usr/local/etc/asterisk/sip.conf the most important one:

    [general]
    alwaysauthreject=yes
    language=hu
    maxexpiry=600
    defaultexpiry=100
    registerattempts=250
    registertimeout=15
    allowguest = no
    bindport=5060
    bindaddr=0.0.0.0
    localnet=192.168.1.0/255.255.255.0
    localnet=192.168.2.0/255.255.255.0
    externhost=your.domain.name.can.be.dyndns.too
    externrefresh=600
    jbenable=yes
    disallow=all
    allow=g729
    allow=ulaw
    allow=alaw
    
    

    If you have multiple LAN subnets, add them all here as localnet, if SIP phones are on them. It's important for security reasons.
    Note bindaddr=0.0.0.0, that means Asterisk will listen directly on all interfaces of pfSense box. That means no firewall configuration is needed at all (no rules, no nat etc): clients inside LAN and servers out there will be able to talk to each other through Asterisk, nothing needs to be routed anywhere.

    /usr/local/etc/asterisk/extensions.conf requires nothing special, just configure it as you wish.

    Look in your logfile periodically. If Asterisk complains about something, a Google search on the error message usually throws back usable suggestions. Any security issues may show up in the logs too if it's the case.

    Good luck!



  • I can help you on first package relase.

    It's basically a XML file That install php files, create menus and install the asterisk files.

    Isn't better start a topic on packages section instead of nat?



  • A moderator please move the topic in the right place.



  • @marcelloc:

    I can help you on first package relase.

    It's basically a XML file That install php files, create menus and install the asterisk files.

    How to do that?



  • take a look on pfsense-packages at github.com

    https://github.com/bsdperimeter/pfsense-packages

    I'll create the xml file to install your php files.



  • Sweeeet!
    I think you have achieved more stability that I coul din my original hack/post, cheers!
    Maybe 2.0.1 helps, or you VoIP provider is better/closer and/or you directory redirections help….
    I'll give a shot to these improvements.

    But most important for me, using a very poor country side 3M/128k DSL line, I really have to enable QoS in order to shut down/lower any non-VoIP traffic while a call is taking place....any input? Wizards seemed of no use for me...



  • @blietaer:

    But most important for me, using a very poor country side 3M/128k DSL line, I really have to enable QoS in order to shut down/lower any non-VoIP traffic while a call is taking place….any input? Wizards seemed of no use for me...

    In sip.conf, general section add this:

    [general]
    disallow=all
    allow=g729
    

    Make sure to keep the correct order, disallow first, allow the second.

    And of course check your SIP phones and your VoIP provider, do they support g729 codec (Linksys/Cisco and most SIP phones support it).
    g729 is actually mpeg-compressed audio in 8kpbs, while alaw and ulaw are uncompressed pcm at 64kbps - sound quality is the same. Don't use alaw and ulaw unless you have plenty of bandwidth.



  • @marcelloc:

    I'll create the xml file to install your php files.

    Thanks! I'll post a small update.



  • Concerning the /usr/local/etc/asterisk/modules.conf, you really mean this is the whole content, or do you suggest to add your snipset at the end of any existing modules.conf file ?
    same for the others ? (thouI guess you Sip.conf _is_longer than that…)



  • I posted only parts of the config files, which are affected by my modifications.

    In modules.conf, yes: just add what I posted at the end of the file.
    In sip.conf I posted my general section, which should be at the beginning of each file. The other sections are each dependent of the particular setup, because every section defines a separate SIP client account (for a SIP phone device, for example).

    There's no point thus, to post my entire config files, they are mostly irrelevant for others. What I suggested, are changes which actually make the thing work at all on pfSense nanobsd.

    But if one looks into asterisk's documentation, everything will become straight clear.



  • First package release is out.  :)

    http://forum.pfsense.org/index.php/topic,47210.msg248054.html#msg248054

    I did some changes to improve stability and checks for nanobsd or normal install.


Log in to reply