MikroTik

Posted: **Wed Apr 25, 2018 10:00 am**

Hi everybody

SIP accounts cant register through my Mikrotik Router 951G updated os version 6.42.1. they will be registered successfully when I reset factory the router.

- there is no any firewall rule for SIP.
- sip 5060,5061 are enabled in service ports.

I think it happens when my internet IP changes by ISP.

As I checked /ip firewall connections, I found out all UDP connection requests on port 5060 to SIP server are not established.
this problem is disturbing me, please let me know if there is any solution to fix it out.

Thank You
Yashar

Posted: **Thu Apr 26, 2018 2:02 pm**

Maybe your ISP is filtering port 5060?
I'm running 6.42.1 and SIP is working for me (my ISP filters and I switch to port 5080).

If you are using Mikrotik SIP ALG (service port), try disabling NAT support on your client (SIP device or PBX).

Posted: **Thu Apr 26, 2018 3:30 pm**

Do I read you right that this was not happening before you've upgraded to 6.42.1?

Posted: **Thu Apr 26, 2018 5:00 pm**

Are you using PPPoE? Have you tried rebooting or copying the PPoE interface instead of resetting the entire router?

viewtopic.php?f=2&t=132980

Posted: **Thu Apr 26, 2018 5:14 pm**

From you screenshot, I can see your SIP device is destination NATed, I suspect your filrewll filter rules are preventing access

Apply a rule (amend for your environment) as per below, rule order does matter

add action=accept chain=forward comment="Allow if Destination NAT Rule" connection-nat-state=dstnat in-interface-list=WAN

Posted: **Sun Apr 29, 2018 9:38 am**

Are you using PPPoE? Have you tried rebooting or copying the PPoE interface instead of resetting the entire router?

viewtopic.php?f=2&t=132980

Hi,

Nop , its not POE

Posted: **Sun Apr 29, 2018 9:40 am**

Do I read you right that this was not happening before you've upgraded to 6.42.1?

I tried 3.39 also and same issue.

Posted: **Sun Apr 29, 2018 9:42 am**

Maybe your ISP is filtering port 5060?
I'm running 6.42.1 and SIP is working for me (my ISP filters and I switch to port 5080).

If you are using Mikrotik SIP ALG (service port), try disabling NAT support on your client (SIP device or PBX).

ISP is open and full protocol, on previous router provided by ISP it was working fine. and i have same this solution with other clients, but different router brand and they are working fine.

Posted: **Sun Apr 29, 2018 9:48 am**

From you screenshot, I can see your SIP device is destination NATed, I suspect your filrewll filter rules are preventing access

Apply a rule (amend for your environment) as per below, rule order does matter
Code: Select all
add action=accept chain=forward comment="Allow if Destination NAT Rule" connection-nat-state=dstnat in-interface-list=WAN

Hi
I have removed all firewall rules, there is no any firewall on router. still its not working...

Posted: **Sun Apr 29, 2018 10:04 am**

I have removed all firewall rules, there is no any firewall on router. still its not working...

If that includes also

/ip firewall nat

rules, not just

/ip firewall filter

ones, it cannot work. And unless the router is on the very latest software in 6.40.x or 6.41.x or 6.42.x, disconnect it from the intenet immediately and revert the firewall rules as it may get hacked otherwise. Or install the three following rules to prevent any access from outside at all:

/ip firewall filter
add chain=input action=accept connection-state=established,related
add chain=input action=accept protocol=icmp
add chain=input action=drop in-interface=your-wan-interface-name

Do I read you right that this was not happening before you've upgraded to 6.42.1?
I tried 3.39 also and same issue.

Fine, so it may be time to engage packet sniffing and Wireshark, because otherwise we don't know what exactly happens. You say that it works after router reboot and goes wrong later so it may be that the connection tracking remembers the previous WAN address after it changes, so the responses from the SIP exchange are sent back to the previous address which is not yours any more (normally use of masquerade rule resolves this, dropping all connections once the public IP address changes, but weird things may happen). Or your SIP exchange may ban re-registrations coming from a different address before the previous registration has expired. Or something else may happen.

So it would be fine to

disconnect the SIP CPE from the network,
reboot the router
configure sniffing into a file with the filter set to any interface and IP address of the SIP exchange, press [Apply]
start sniffing by pressing [Start]
connect the SIP CPE and let it register (supposingly, successfully)
wait until the SIP re-registration or call fails
stop the sniffing, download the file and use Wireshark to see what has actually happened.

But before doing all that, please post the output of

/export hide-sensitive

after replacing each occurrence of any public IP address you don't want to reveal with a distinctive pattern like

sip.server.address

,

my.public.address

etc. so that the context remains comprehensible. It is possible that there is some misconfiguration in your NAT rules which causes the phones to fight for the connection.

MikroTik

SIP Account Registration Problem

SIP Account Registration Problem

Re: SIP Account Registration Problem

Re: SIP Account Registration Problem

Re: SIP Account Registration Problem

Re: SIP Account Registration Problem

Re: SIP Account Registration Problem

Re: SIP Account Registration Problem

Re: SIP Account Registration Problem

Re: SIP Account Registration Problem

Re: SIP Account Registration Problem