One-way audio via VPN

[Razvan19]

Hey there,

So we have the following schema:

3CX Server running on Proxmox dedicated, with public IP set on interface (ens18 | 1.1.1.1) and LAN IP set on interface (ens19 | 10.1.1.190).

Public IP it's set directly on the virtual network device ens18 and LAN IP the same, it's set direct to the virtual network device ens19. So we have 2 virtual network cards.

Remote client connecting with SSTP to the Mikrotik router, (client IP 10.100.100.20) can reach the server (provisioning was made without any issues), but when calling, there's only one-way audio meaning that I can't hear the caller, but the caller can hear me.

There's no NAT rule on the Mikrotik router for IP Address 10.1.1.190 (3CX PBX) and the remote client it's a Polycom VVX 411 and it's configured with Local LAN.

LAN interface it's used only for remote clients for VPN. LAN IP Address has another public IP Address than the main one assigned to ens18 (1.1.1.1 in this case).

Steps made:

1. SIP ALG it's deactivated. - checked
2. Firewall checker - all tests pass without any issues since the public IP Address it's assigned directly to the server, not to the LAN.

What am I missing? It should work if the connections are not NAT'ed on both Mikrotik routers.

 

[leejor]

You may want to consider troubleshooting by employing Wireshark, at various points, to see if that can give you a clue as to why voice ports are not getting through.

 

[cobaltit]

https://www.3cx.com/blog/docs/network-configurations-supported-3cx-phone-system/

And use wireshark as @leejor mentioned. Then figure out why traffic is doing what it is doing. But you would make your life a lot easier if you only had one interface on 3CX.

 

[Razvan19]

The issue was that the 3CX PBX wasn't sending the traffic to the right IP Address until I specified a persistent route to the whole LAN Subnet.

Issue was resolved by adding the static persistent route.

 

[JohnS_3CX]

Your second NIC should not have a gateway defined if you are using 2 NICs on the PBX machine.

We outline this in the link @cobaltit posted above, under segregated networks.