Public IP's, Firewalls and VoIP Phones

[Anonymous]

Sorry for barging in

What I understand of it is:

- the phone registers but you cannot make calls?

Can you do me a favour:

- Copy the log (as requested by the sticky)
- define the problem eg, cannot make a duplex call, cannot make a simplex call etc.
- define the ip class of the : 3cx box, phone, router, modem (mask the last 3 digits just to be save).

Thanks

 

[cjammer]

Actually the phone never registers. I get a "408 request timed out."


I have been doing some checking on things today (lots of things) I was looking at the status screen of a GXP-2000 and this is what it tells me.

IP Address: 192.168.1.46
Product Model: GXP2000
Software Version: Program-- 1.1.1.14 Bootloader-- 1.1.1.5
System Up Time: 0 day(s) 0 hour(s) 9 minute(s)
Registered: Account 1: Yes
Account 2: No
Account 3: No
Account 4: No
PPPoE Link Up: disabled
detected NAT type is port restricted cone <-- Note this line[/color


From Wikipedia:
Port restricted cone NAT is like a restricted cone NAT, but the restriction includes port numbers. Specifically, an external host can send a packet to a particular port on the internal host only if the internal host had previously sent a packet from that port to the external host.

If this is the case then a phone on the outside trying to get in wont. because it was not asked to talk to the PBX 1st. To me, this says I still have a Firewall/ port forwarding issue on that router. If I place the phone outside on a public IP I get it to be open internet.

I changed it to my other router and I get this:

detected NAT type is symmetric NAT

From Wiki:
With symmetric NAT all requests from the same internal IP address and port to a specific destination IP address and port are mapped to that external source IP address and port. If the same internal host sends a packet with the same source address and port to a different destination, a different mapping is used. Only an external host that receives a packet can send a UDP packet back to the internal host.

I am pretty sure this is telling me it wont work either. But which evit is the better one to try to fix? Or is this evil I cannot over come on these two routers?

 

[nb]

Hi everyone,
We use this setup at the office very frequently - when we are abroad we connect to the office PBX that is on the office network and perform the necessary phonecalls. This is exactly your scenario isn't it??

We always set the phone/extension as an external phone in the 3CX edit extension / other options section. In previous posts I read that the phone must not be set as external.

Regards

 

[cjammer]

IT WORKS!!

Why I am not exactly sure.

But here is what I did, and yes it was nothing new over what was suggested.

I tried a different STUN server.

I got the X-lite phone to work on my laptop, but I was not sure of what I was seeing. At the time I was VPN'ed to the 3CX Server and it was working, so I killed the connection and it still worked. So this morning I moved the Hard phone back to the public IP, made the same changes in it.
Once I changed it I rebooted the phone, It registered and now is working.

So can someone explain to me why the two STUN servers would be different?

here is the ports and ranges I have opened for it.

5000-5100
7000-7500
9000-9005
3478
External extension is Checked
Bind to Media server is Not Checked

 

[DaKhalli]

thought it be a stun server issue.

Maybe the other stun server wasnt online or functioning properly.

Glad it finally solved your problem.

 

[DaKhalli]

btw try it now without the extension is external, cuz all say it should be like that but seemsto work flawless without it here..

 

[cjammer]

I removed the extension is external check mark.

I can still call all numbers that is assigned to the PBX

With it at home I can not make calls that are external on the PSTN lines from the GXP-2000, I can from the X-lite softphone. It does not matter whether the Ext. is External is check or not. the call fails both way. I have shifted the Codecs around to see if that helped and it did not.

Here is a copy of the server log from start to finish for a external call

23:23:03.473 StratLink:nHangUp Call(C:31): Ln:10000@PBX Gateway hung up call; reason: BYE
23:22:48.452 CallLegImpl:nConnected Call(C:31): Created audio channel for Ln:10000@PBX Gateway (192.168.1.52:5008) with third party (172.16.1.101:60094)
23:22:48.452 StratInOut:nConnected Call(C:31): Setup completed for call from Ext.1008 to Ln:10000@PBX Gateway
23:22:48.452 CallLegImpl:nConnected Call(C:31): Created audio channel for Ext.1008 (172.16.1.101:60094) with third party (192.168.1.52:5008)
23:22:48.436 CallConf:nProvisional Call(C:31): got response from
23:22:48.327 CallConf:nIncoming Call(C:31): Incoming call from Ext.1008 to sip:[email protected]


I did find another problem why it was not working at home. I had set up the ports in the firewall, but I did not enable the hole. My inability to make the calls may still be network related.

Over all, I have mine all working, except for this one thing now.

We know that it will work with the external extension unchecked.

Isn't experimenting FUN!!

 

[Anonymous]

Port restricted cone NAT is like a restricted cone NAT, but the restriction includes port numbers. Specifically, an external host can send a packet to a particular port on the internal host only if the internal host had previously sent a packet from that port to the external host.

This is just standard behaviour of a firewall, all requests made from internal to external will be allowed by an external answer that is just how these things work. Nothing special.

If this is the case then a phone on the outside trying to get in wont. because it was not asked to talk to the PBX 1st. To me, this says I still have a Firewall/ port forwarding issue on that router. If I place the phone outside on a public IP I get it to be open internet.

That is correct, but looks like you got that solved.

If you allow the phone IP and port on the firewall to have inbound to 3cx you will find it works ok aswell.

 

[cjammer]

I found another issue with using my GXP-2000 at home, it is another one of those I dont understand things.

When calling out on a external I could not get it to get the outside dialtone. Being still suspicious of firewall issues, I was looking at some of the other settings, the phone was set to be on a DMZ port. After I took it off of that I now get the dial tone, but when I dial the number, I hear the DTMF, but the dialtone stays. I check it with my softphone and it still works.

So something is blocking the DTMF in the audio being transmitted.

Any Ideas about this?

 

[DaKhalli]

cjammer: try to reset that phone to factory defaults and reconfigure it.

Since there was already a setting there (DMZ port) wich was wrong only god knows what else is wrong there.

With a fresh start you sure theres no config problems.

Also check the firmware version

 

[cjammer]

I have been debating the the reset thing for a few days.

I did the Firmware change of the bat and that does fix some issues.

After you play and change and change back and just try to see what if on a few settings. then forget one. Just leaves it in a device acting quirky.

I'm gonna reset it and see what happens.

 

[DaKhalli]

jup thats what i meant

 

[cjammer]

Ok, I have now done a factory rest on the phone. did not fix it. in fact I get some new issues.

As I put the config back in I played a bit with the old settings getting back to where I was.

I tried it without stun and call external checked and unchecked.
I could call all extensions on the PBX but not PSTN Lines

I added the STUN server and then I can dial the PSTN line and I get the ring and the second dialtone to call out. But it never would let the DTMF out.

New problem I found now.

I can call from the extension to a softphone ok.
If I try to call from the soft phone to the hard phone it rings and if I answer, the soft phone does not see that I have answered. When I hung it up, it would start to ring again after 15 seconds. Then I took it one step more. I exited (unloaded) the phone from the PC. The hard phone kept ringing. Once the limit that is set in 3cx is reached, the phone stops ringing and displays "one missed call."


I looked in the server log and there was no BYE sent. here is the call log

20:15:25.844 CallConf::Rejected Call(C:69) is rejected: Destination is not answering
20:15:25.844 StratInOut:nCancel Call(C:69): Call from Ext.1004 to 1008 terminated; reason: Request Timeout
20:15:25.844 CallTarget::create Forward loop detected for destination 1008Forward history:{1008}
20:14:53.406 CallConf:nIncoming Call(C:69): Incoming call from Ext.1004 to sip:[email protected]


Remember both of these phones are outside the Firewall from the 3cx PBX.

Any Ideas on this?

 

[archie]

It looks that your 1008 extension forwards to itself on no-answer. It's no good.

 

[nb]

infinite loop

Hi

There is a sort of infinite loop that is never ending and repeats itself after 30 seconds. The PBX recognizes the problem because of the increased amount of CPU power and uses mechanisims to drop the call.