Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Update to 2.2.3 broke one of my rules

    Firewalling
    2
    3
    495
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      Dadoo last edited by

      Over the 4th of July weekend, I updated my firewall from 2.2.2 to 2.2.3. A couple of weeks later, I was told that, since the update, no one had been able to call in via long distance after hours. (All of our phone service is via SIP.) This past weekend, I tried updating to 2.2.4, but that didn't solve the problem. Finally, going back to 2.2.2 fixed it.

      After a lot of research, I discovered the only reason it was working during the day is because calling out would add a state for the SIP port (5060) to the state list, and since SIP usually uses port 5060 for both the source and destination ports, the state covered incoming calls, as well. As soon as the state expired, we lost incoming long distance. At first I thought it might be because the NAT rule to get from the Internet to the SBC is 1:1, while most of the other NAT rules use port forwarding, but our local phone service uses 1:1 NAT, too, and we didn't lose that.

      What else can I try, to figure out the source of my problem?

      1 Reply Last reply Reply Quote 0
      • jimp
        jimp Rebel Alliance Developer Netgate last edited by

        If you have all of the proper rules for inbound and outbound NAT/Firewall/etc then it should work no matter what:

        https://doc.pfsense.org/index.php/PBX_VoIP_NAT_How-to

        If it's blocked after hours it should show up in the firewall log, find the log entries and compare the source/destination with your NAT and firewall rules to see what doesn't line up.

        1 Reply Last reply Reply Quote 0
        • D
          Dadoo last edited by

          If you have all of the proper rules for inbound and outbound NAT/Firewall/etc then it should work no matter what:

          https://doc.pfsense.org/index.php/PBX_VoIP_NAT_How-to

          I read that page and verified everything was set up according to those instructions.

          If it's blocked after hours it should show up in the firewall log, find the log entries and compare the source/destination with your NAT and firewall rules to see what doesn't line up.

          I tried, but the only thing I was getting in the log for port 5060 was packets that were passed, and none of them were coming from our SIP provider. I even told pfSense to log packets that were passed and blocked by the default rules, and still didn't get anything I was looking for. What's even more odd, is that even on version 2.2.2, where it's working, I have logging checked on those packet filters, and I'm still not getting anything in the firewall log, either passed or blocked. Is there some log setting I'm missing?

          1 Reply Last reply Reply Quote 0
          • First post
            Last post

          Products

          • Platform Overview
          • TNSR
          • pfSense Plus
          • Appliances

          Services

          • Training
          • Professional Services

          Support

          • Subscription Plans
          • Contact Support
          • Product Lifecycle
          • Documentation

          News

          • Media Coverage
          • Press
          • Events

          Resources

          • Blog
          • FAQ
          • Find a Partner
          • Resource Library
          • Security Information

          Company

          • About Us
          • Careers
          • Partners
          • Contact Us
          • Legal
          Our Mission

          We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

          Subscribe to our Newsletter

          Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

          © 2021 Rubicon Communications, LLC | Privacy Policy