Solved SIP trunk won't connect after restart of firewall.

[Don_Zalmrol]

Hi,

After a reboot of my firewall today, my 3CX (V18.0.1880) Debian 10 hyper-v guest will no longer connect to my Intertel (BE) SIP provider.
I receive the following message "Registration at Intertel has failed. Destination (sip:35.190.200.82:5060;lr) is not reachable, DNS error resolving FQDN, or service is not available."

A quick google returns this is usually caused by the SIP port not being filled in, however in my case this is set.

The firewall we use is Pfsense 2.5.2 and the used NAT rules are these:

As you can see I have two NAT rules for either any incoming allowed on port 5060 TCP/UDP and one scoped for my SIP trunk provider (+ 3CX).
The latter is main rule and the first is mainly used for testing in case of issues (like this occasion).

When we first set up the PBX (+- 2 years ago) I followed the guides to the letter:

• https://www.3cx.com/docs/manual/installing-debian-linux-pbx/
• https://www.3cx.com/docs/pfsense-firewall/
• https://www.3cx.com/docs/installing-microsoft-hyper-v/

And since then everything was running smoothly. Recently (+-1 month ago) we've changed the host server and in the firewall enabled PureNAT.
This is the 2nd time I encounter this issue and contacted our SIP provider Intertel (BE) and they told me that everything is working normally on their end it must be either a firewall or PBX issue.

Trying to figure out what is going on, but the logs don't show much.
The firewall test of 3CX is reporting green (OK) for every port/protocol:


Yet it still won't register:




Tried rebooting both the 3CX guest and my firewall = no result.

Any help would be greatly appreciated!

Thanks!

 

[Don_Zalmrol]

Forgot to add that a DNS lookup and DIG from the PBX works without any issues at all:

# nslookup sip0-a.voice.intertel.io
Server: 8.8.8.8
Address: 8.8.8.8#53

Non-authoritative answer:
Name: sip0-a.voice.intertel.io
Address: 35.189.231.185

# nslookup sip0-b.voice.intertel.io
Server: 8.8.8.8
Address: 8.8.8.8#53

Non-authoritative answer:
Name: sip0-b.voice.intertel.io
Address: 35.190.200.82

~# dig _sip.voice.intertel.io SRV

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> _sip.voice.intertel.io SRV
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 18084
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;_sip.voice.intertel.io. IN SRV

;; AUTHORITY SECTION:
intertel.io. 900 IN SOA ns-328.awsdns-41.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

;; Query time: 28 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Oct 03 00:15:02 CEST 2021
;; MSG SIZE rcvd: 132

 

[YiannisH_3CX]

Enable verbose logging into the Activity log of the PBX and restart your SIP server service. Check for errors for that trunk. Also check your firewall and see if there any traffic going from the 3CX PBX to your providers IP and back.

 

[Don_Zalmrol]

Enabled verbose logging and anonymized the output

10/04/2021 3:40:32 PM - Sent registration forLc:trunk_id(@Intertel[<sip:[email protected]:0/UDP>]) :ClientReg Send Req REGISTER from 0.0.0.0:0 tid=tid_id Call-ID=call-id..:

REGISTER sip:sip.voice.intertel.io SIP/2.0

Via: SIP/2.0/ ;branch=branch-number-1---tid_id;rport

Max-Forwards: 70

Contact: <sip:sip_id@static_wan_ip:5060;rinstance=rinstance_id>

To: <sip:[email protected]>

From: <sip:[email protected]>;tag=caf0e42c

Call-ID: call-id..

CSeq: 1 REGISTER

Expires: 120

Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE, UPDATE

Supported: replaces, timer

Content-Length: 0



10/04/2021 3:40:32 PM - [CM504003]: Sent registration request for Lc:trunk_id(@Intertel[<sip:[email protected]:0/UDP>])
10/04/2021 3:40:32 PM - Dev(dev_id):[sip:[email protected] / sip_id]: PBX contact is public IP: <sip:sip_id@static_wan_ip:5060/UDP>
10/04/2021 3:40:32 PM - Dev(dev_id):[sip:[email protected] / sip_id]: PBX contact is public IP: <sip:sip_id@static_wan_ip:5060/UDP>
10/04/2021 3:40:32 PM - Lc:trunk_id(@Intertel[<sip[at]:0/UDP>]): Registration postponed until target's destination is resolved
10/04/2021 3:40:32 PM - Lc:trunk_id(@Intertel[<sip[at]:0/UDP>]) Resolving targets: primary - sip:sip.voice.intertel.io, no secondary over +UDP+IPv4
10/04/2021 3:40:32 PM - Refresh registration request on the line 'trunk_id'

 

[YiannisH_3CX]

If that is all the logs you are seeing then I do not see a reply from the provider so either it is not leaving the firewall or it is blocked coming back in. Do you see any traffic on the firewall at the same time?

 

[Don_Zalmrol]

After long searching I have found the issue...

It was caused by the PBX itself, it blocked the SIP trunk IPs due to too many failed authentications. Hence you get the DNS error message, unfortunately without the mention of a block.

As a precaution I've whitelisted the IPs.


Perhaps for future updates, 3CX could include a "blocked IP" message in the logs when your trunk IP/FQDN matches with it...

Thanks for the assist!

 

[YiannisH_3CX]

Glad to see you were able to find the solution. That explains why we did not see a reply in the logs. The PBX can send to blocked IPs but ignores replies from those IPs.

Perhaps for future updates, 3CX could include a "blocked IP" message in the logs when your trunk IP/FQDN matches with it...

Thank you for the recommendation. We will see what we can do.