VPN configuration

[vanen]

Elastix version: 2.3

sip extension (ip 192.168.5.2) > vpn through router > elastix (192.168.200.2)

Do I need to edit sip.conf or sip_general_custom.conf to add these lines:

externip=xxx.xxx.xxx.xx
Localnet=192.168.200.0/255.255.255.0
Localnet=192.168.5.0/255.255.255.0

Under general?
Only these lines need to be added?


Can make call but after about 2 minutes dropped.

Any guide for vpn configuration between sip extension and server elastix?

 

[danardf]

Hi and welcome to our Elastix Forum.

You should connect on Freepbx GUI and going to "Asterisk SIP Settings" to set your nat parameters.
sip_general_custom must be blank.
Don't set anything into sip.conf file.

Set nat=yes for all remote extension using the VPN and setting nat=no for all other local devices.

 

[vanen]

Tried these configurations. Problem not solved.

 

[vikingisson]

Where is your VPN, external to the PBX?
I've been doing this for a long time without a problem (OpenVPN and IPSEC). As long as you aren't seeing an error mentioning sip_general_custom then it should work. Make sure you have added your local LAN and all directly routable LAN subnets. A nice reboot doesn't hurt either.

 

[vanen]

VPN is configured between two zyxel usg. Firewall is disabled on gateway zyxel. Already done reboot.

 

[vikingisson]

Are you positive that full routing is proper between the subnets? No NAT or packet mangling?

On mine as seen in the GUI I have the "NAT" setting as "No" , "IP Configuration" as "Static IP", "External IP" as the public IP or FQDN, and "Local Networks" as all of my remote VPN subnets including the local LAN.

 

[vanen]

Same settings. See attachment.

 

[vikingisson]

I don't see any attachments.

If I assume that the PBX is correct then I might look at the phone config itself. Normally most phones work a lot better without NAT but perhaps your device is assuming NAT? Can you try another device such as a smartphone? A smartphone with a SIP client is a great tool for testing all kinds of network configs. Sometimes a different type of device points you to a common issue or one on a specific device. I'll also assume that you can SSH across the VPN without problem.

 

[vanen]

Yes, I can ssh across vpn without problem.
Maybe problem with phone Siemens A510IP?
My Configuration on A510IP

General data for your service provider
domain: 192.168.200.95
proxy server address:
proxy server port: 5060
registration server: 192.168.200.95
registration server port: 5060
registration refresh time: 180 sec

Network data for your service provider
stun enabled: no
stun server address:
stun server port: 3478
stun refresh time: 240 sec
nat refresh time: 20 sec
outbound proxy mode: automatic
outbound proxy port: 5060

RTP port: 10002 - 20000

 

[vikingisson]

I'll have to guess it is a phone issue. If it was me I would have tried with a SIP softphone to be sure. I use my smartphone for that and used to use a laptop. it rules out the network if it works one way and not the other.

I don't see it but there must be a setting for NAT itself. My ATA has a "NAT Mapping Enable yes/no" but it works whether or not I'm on NAT or VPN so I leave it as Enable. I've had the opposite issue with Polycoms that work great on VPN but not as good over NAT.

FYI, have you tried setting the PBX extension side for "NAT = No" ?

 

[vanen]

There's no nat setting on sip phone. On PBX side i've tried both NAT = no and yes. Audio still down after few min. Tried also changing codec to G711.

 

[vikingisson]

I can only suggest to try a softphone or other device to make sure you can reproduce the same effect. If that too gives issues then I'd look at the firewall/VPN where the sessions are dropping. And what the asterisk logs show at the time it happens.