Problem with asterisk/elastix server behind pfsense firewall
-
hi all,
i have an internal pbx asteriks on elastix with sip trunk timeout issues.
my topology is as below :pbx–----pfsense--------------internet
forsometime i find pbx is okay with my sip trunk , but after sometime , trunk get down and i see that there is timeout log messages on my elastix server like :
[Jul 23 22:52:38] NOTICE[2603] chan_sip.c: – Registration for 'xxxxxx@sipgate.co.uk' timed out, trying again
(Attempt #5018)
================================
i will say what i didn on elastix and wt i didn on pfsenese :
1- on elastixi added to sip_nat.conf file
nat=yes
externip=(MY PUBLIC IP ADRESS)
localhost=192.168.1.0/255.255.255.also i added qualify=no on sip trunk settings.
2-on pfsense
i disabled src port rewrite
i allowed ports 5060 & range 10000-20000 udp portsi made portforward to those ports to my local pbx
on advanced settings of pfsense i Set Conservative state table optimization
on advanced settings of pfsense scrubbing needs disablednow , i can register okay from outside the pfsense and its fine
but i have an issue with my trunk , after sometine it get downnow if i reboot pfsense , it work for sometime ... but after sometinme the trunk get down !
can you help ?
is sipproxd mandatory in my case here ?????
plz advice me
regards
-
This is a known issue with PFSense and its handling of state tables. Assuming you have a dynamic IP - when your IP changes, PFSense has a habit of retaining the previous state tied to your previous dynamic IP.
You can manually fix this each time this happens by removing the stale state, or run a script to wipe all states/specific states each time your external IP changes.
https://forum.pfsense.org/index.php?topic=18053.0
-
hi ,
thank you for reply ,but i have a fixed ip from the ISP !
-
also , want to tell u something .
if i go to pfsense ==>states==> then clear the current sessions of firewall
then asterisk works fine ??!!
does that make sense ?
-
Hmm. Since you're behind a NAT, you should probably set qualify=yes for the trunk on your Elastix box. qualify really needs to be yes almost anytime you're behind a NAT to keep the UDP session open. Give that a try and see if that fixes your problem.
BTW, what's your qualifyfreq set to?
-
This could also be generated by the firewall dropping the states due to inactivity. You can try setting the "firewall optimization options" to "conservative" on System, Advanced, Firewall/NAT
-
hi ,
thanks alot for reply .want to mention :
1- qualify was = yes , but due to the problem still exist , i put it =no
so , whatever yes or no the problem exist.2-i have already "conservative" option set in firewall
3""what's your qualifyfreq set to?"""" ===> i dont know this and not sure if i set it in my config , will this help me ?
agian , if i removed the current connecitons of firewall or reboot the pfsense , it work for sometime , then it get back agian !!
i have fixed ip also , !!
any luck if
-
You will probably need to run a packet capture to see what is going on. You might be hit by the "SIP packets are randomly not being NAT'ed anymore" issue which has been mentioned several times on the forum, and I am not really sure someone ever found the root cause or solved it…
-
You will probably need to run a packet capture to see what is going on. You might be hit by the "SIP packets are randomly not being NAT'ed anymore" issue which has been mentioned several times on the forum, and I am not really sure someone ever found the root cause or solved it…
thank you , but van u guid me to similar problems to my problem ? :P :P