lust but not least I turn to all of you, after my 3/4 year VoIP odyssey.
Quite at the beginning of 2023 I migrated my complete home network from a virtual machine running pfsense, later opnsense behing an AVM FRITZ!Box to a complete mikrotik system. Last but not least I ended up installing a CRS326-24G-2S+ as my edge router and main switch. And then the journey began:
Just to inform you about my other VoIP setup: I own a Auerswald ComPACT 5020 VoIP, that worked pretty well behind the first setup with FRITZ!Box and pfsense. After using RouterOS on my edge router the problems started: Sometimes no calls from outside to my local landline accounts running on the Auerswald were possible. But sometimes everything worked pretty well. (Very nice to debug such situations
). So after trying around millions of options and settings, I figured out that the FRITZ!Box received an OTA updated, which removed the official support for pppoe tunneling (the fritzbox worked as a bare modem). After sniffing some traffic, I found out that SIP invites from outside that exceeded the pppoe MTU were somehow dropped by the fritzbox since they removed the pppoe passthrough support. After replacing the Fritzbox with a bare vigor dsl modem, the strange problems were gone .... almost. (Finding this problem took me already 6 months)Now, the internal phones are still sometimes not reachable from the outside. I will outline my current configuration and some other steps I've already done, to check whether I might have overseen something.
Basics:
The Auerswald is reachable at 10.0.0.4
The external sip connection listens at 5064 (udp)
The rtp ports reach from 49152-49408
Current setup, works most of the time. Sometimes a restart of the Auerswald is necessary to get it back working
Code: Select all
/ip/firewall/service-port/set sip ports=5064,5060DSTNAT approach, did not work
So I finally ended up setting up dstnat rules, the same way I've done for other appliances like my webserver and so on:
Code: Select all
/ip firewall nat
add action=dst-nat chain=dstnat comment="XXX TEL" dst-port=5064 in-interface=pppoe-out1 log=yes log-prefix=\
"> SIPNAT IN" protocol=udp to-addresses=10.0.0.4 to-ports=5064
add action=dst-nat chain=dstnat comment="XXX TEL" dst-port=49152-49408 in-interface=pppoe-out1 protocol=udp \
to-addresses=10.0.0.4 to-ports=49152
)One thing someone may answer is whether an outgoing connection from the Auerswald might block the port when the connection is tracked by the connection tracking? I didn't find that out by reading the docs. In pfsense there was moreover a setting to remove the port randomization with masquerading, with RouterOS I think there's no randomization, thatswhy that might not be a problem?
This were my last tries regarding the VoIP problem. The whole story within the first 6 month which consisted of complex firewall constructs, packet sniffing, adding rules to prevent ip fragementation and so on I will leave out here, because the FRITZ!Box was the problem. But I'm still kind of confused. I understand that the sip-helper does maybe a bad job, I often read advisory on not to use this feature. Maybe the two different source addresses 1&1 sends packets from might be a big problem with that.
But what am I doing wrong with the static dstnat firewall rules? Why don't they work. And is there an option to maybe rewrite the source address on incoming invites to only one static address of the first 1&1 server? I'm at the end of my tether
