call problems (maybe NAT issue?)

[xact1]

Hi all,

So here is my problem. In less than a week I need to demo a 3cx solution to a potential client. I have setup things in my office and home to simulate the environment in which 3cx will be used in production. Rather than 20 paragraphs trying to explain the topology, I have attached a drawing. Please excuse my total lack of Visio Skills.

Here is the problem I am running into:
X100 can call the pstn and x103, but not x101 or x102 (x100 shows as dialing in status)
X101 can call 100 and it will ring, but the only sound that works is hold music. X102 does not ring, PSTN and x103 are fine.
X102 can call x100, x103, PSTN, and all is fine. X101 never rings.
X103 can call the pstn no problem. X100 and x102 will work when they feel like it and x101 never rings.
The PSTN can call x103 ok. X100 and x102 will work when they feel like it and x101 never rings.

To make things more interesting “client office” will actually have ~24 phones and 4-6 soft phones. They will connect to the PSTN via Sprint(Pots lines) and Televox(sip trunks), for various reasons not very interesting.

Anticipated questions:
How do you connect to pstn?
Quintum gateway. Yah, I know. It’s getting replaced.

What router is at “client office”
They have a Linksys BEFSR41. Same thing I’m using to test. I’ve also tried a pix 501 and a Dlink something. Same result with each. Only difference is the frequency in which x101 and x102 will work when calls come in from PSTN or X103.

How is the 3cx server on the internet?
It has a single public IP (I have about 400 available if this helps) and is protected by a Linux box acting as a firewall. The firewall is passive and only restricts port access. No filtering or packet IDing is being done. The connection is an oc48 with 50Mbit available to the 3cx server (kill mosquito with canon concept).

Is everything really on the same Class B segment?
Yep. I'm sitting on the backbone of a rather large provider.

Thank you all very much in advance!
-Jason

 

[Henk]

1. make sure you can call all the extensions, at the moment you cannot call 103 but not 102 and 101. This because they are on a different network, to make that work you need stun. (assuming you do not use vpn etc).
2. The unix server is doing the firewalling, make sure that the ports are open (as you say that it only does ports). What does the 3cx firewall test tell ya.

Based upon that you call seems to be simplex and not duplex you might have to open some ports to allow for duplex conversation. It can also be that the 3cx server should handle the media (have you tried that)?

From what I see it is a firewall issue, and a nat issue. Nat is fixed with stun, but you have to allow stun to come through.

Hope this helps.

H.

 

[xact1]

1. make sure you can call all the extensions, at the moment you cannot call 103 but not 102 and 101. This because they are on a different network, to make that work you need stun. (assuming you do not use vpn etc).
2. The unix server is doing the firewalling, make sure that the ports are open (as you say that it only does ports). What does the 3cx firewall test tell ya.

Based upon that you call seems to be simplex and not duplex you might have to open some ports to allow for duplex conversation. It can also be that the 3cx server should handle the media (have you tried that)?

From what I see it is a firewall issue, and a nat issue. Nat is fixed with stun, but you have to allow stun to come through.

Hope this helps.

H.

Hi. Thanks for the tips.
1. You are correct. They are on different networks. No VPN, although I may do that as both a solution and for security. I tried turning STUN both off and on and so far no difference. I saw another posting about some NAT routers not working well with STUN at all, and the best solution could very well be a VPN. I’m doing some research on this now…

2. Firewall is defiantly not the issue. I have double checked my port permissions and even tried turning the firewall off completely. It works like a interface bridge, not a router/proxy/nat. I even went as far as to physically bypass it, no difference.

3. Know much about this “3cx proxy” ? I have never been a fan of proxy devices in general, but if it’s a simple solution, I’m willing to give it a shot.

 

[Henk]

You noticed that I am a bit quiet now .

How are these other sites connected to the internet, any firewalls with them? There might be an issue that you run out of ports for you call.

I have not used proxy myself.

H.

 

[xact1]

You noticed that I am a bit quiet now .

How are these other sites connected to the internet, any firewalls with them? There might be an issue that you run out of ports for you call.

I have not used proxy myself.

H.

This has been resolved. In the end the problem is with the NAT router. STUN or not it seams the little buggers are just not meant for VoIP. I setup a VPN tunnel with one end behind the NAT router and the other on an extra interface for the 3cx server. So far so good. All the phones are in separate IP space than the Pcs. In the end this is probably the best way to go any how. As we build out more offices its just a matter of installing a VPN router at each client site and I don’t need to bother with changing around the network.

Thanks all.

-Jason

 

[Henk]

Good stuff, thanks for posting back.

I can have my coffee now .

H>