SIP ALG detection failed using Mikrotik

[pichewy]

Hi, I am trying to finish up installing 3cx onto a rasberry pi. Everything went smoothly until I tried testing firewall check. All tests pass except for the following:

• testing 3cx server.... failed
• detecting SIP ALG ... failed

I have a mikrotik router and did configure the firewall settings as described in 3cx documentation, and also enabled SIP services in Mikrotik for port 5060 and 5061.
I am a bit lost on what else I should look for to fix this problem?
Any help or tip much appreciated!!

 

[mixig]

Disable SIP in IP Services on Mikrotik and try again, also you can post mikrotik firewall/nat settings here

 

[pichewy]

Thanks for your reply and help!
I did disable sip service ports in Firewall>Service Ports.

Here is the firewall print...

0 X ;;; 3CX Presence and Provisioning HTTPS
chain=dstnat action=dst-nat to-addresses=[ServerLanIP] to-ports=5001 protocol=tcp dst-port=5001 log=no log-prefix=""

1 ;;; 3CX SIP UDP
chain=dstnat action=dst-nat to-addresses=[ServerLanIP] to-ports=5060 protocol=udp dst-port=5060 log=no log-prefix=""

2 ;;; 3CX SIP TCP
chain=dstnat action=dst-nat to-addresses=[ServerLanIP] to-ports=5060 protocol=tcp dst-port=5060 log=no log-prefix=""

3 ;;; 3CX SIP TLS
chain=dstnat action=dst-nat to-addresses=[ServerLanIP] to-ports=5061 protocol=tcp dst-port=5061 log=no log-prefix=""

4 ;;; 3CX Media UDP
chain=dstnat action=dst-nat to-addresses=[ServerLanIP] to-ports=9000-10999 protocol=udp dst-port=9000-10999 log=no log-prefix=""

5 ;;; 3CX Tunnel TCP
chain=dstnat action=dst-nat to-addresses=[ServerLanIP] to-ports=5090 protocol=tcp dst-port=5090 log=no log-prefix=""

6 ;;; 3CX Tunnel UDP
chain=dstnat action=dst-nat to-addresses=[ServerLanIP] to-ports=5090 protocol=udp dst-port=5090 log=no log-prefix=""

 

[nub]

This is what I use for mikrotik

chain=dstnat dst-address=publicip dst-port=5060 protocol=udp src-address-list=voip-provider-ip-list to-addresses=serverip to-ports=5060

I just use winbox to look at what ips are slamming the firewall on 5060 when I run the test and add them to the allowed list of ips, otherwise 3cx test servers will always be blocked unless you just have 5060 open to the public.

 

[pichewy]

Thank you 3cxnub. I think I have the port 5060 opened via NAT. Unfortunately I am using Mikrotk and the dns filtering is not available.

 

[complex1]

Hi,

I use next two NAT rules in my MT

/ip firewall nat
add action=dst-nat chain=dstnat comment="3CX Phone System" \
dst-port=5090,5060,5061,5001 in-interface-list=WAN protocol=tcp \
to-addresses=[ServerLANIP]
add action=dst-nat chain=dstnat dst-port=5090,5060,9000-10999 \
in-interface-list=WAN protocol=udp to-addresses=[ServerLANIP]

and disable SIP ALG

/ip firewall service-port
set sip disabled=yes