VPN One-Way Audio

[SKDamon]

Hello,

I'm having trouble with some 3CX Desktop Client users who switch between HomeOffice and normal In-Office.

When at home, they experience one-way audio while connected to the VPN and cannot hear the caller.
Their audio is transmitted just fine, and the On-Premise 3CX receives external caller audio.

However, the RTP stream is addressed to the user's Home LAN IP, not the VPN IP.
Since it's not a Site2Site VPN, there is no direct route to the Home LAN IP...



10.242.2.0/24 is the VPN IP pool,
10.20.0.30 is the 3CX LAN IP
192.168.188.56 is the User's Home LAN IP

The User Phone Settings (3CX App) are configured to use the internal DNS name as the Network Interface,
use remote tunnel connection, PBX delivers audio is NOT checked.

Internal DNS resolves to 10.20.0.30
External DNS resolves to the public IP on internal DNS server.

Manually setting the In-Office PBX IP in the client settings to the external hostname resolves the issue,
but I doubt that plays well when users use the client In-Office...

Any suggestions how this can be resolved?
The 3CX App writes the user's home LAN IP in the SIP/SDP fields "Owner address", "Connect Information - Connection Address".
There is a second "Connection Information" field with 127.0.0.1, presumably for Tunnel Connections?


Can the Client be set to always use tunnel connections, even for local networks?

 

[JohnS_3CX]

Hi,

Have you tried launching the 3CX Windows client, after the VPN connection is established?

Or was it already running from before?

 

[SKDamon]

Hey @JohnS_3CX

sorry for the long wait, I was out of office...

The capture was made after the 3CX Windows client has been restarted.
AFAIK the issues started only after the external hostname was no longer overwritten to the internal IP on internal DNS.

 

[JohnS_3CX]

Hi @SKDamon

What you said earlier is really the answer here: " Since it's not a Site2Site VPN, there is no direct route to the Home LAN IP... "

You have route from the local home IP range to reach the office, but your dont have the reverse route hence the audio packets from the PBX never reach the home.

You will need to implement a different VPN solution that addresses this or run the client outside of the VPN. Just out of curiosity, is the home user using some kind of VPN client or are you running the VPN on their router?

 

[SKDamon]

It's an OpenVPN server (Sophos UTM Firewall) with Windows Clients, so no easy way to establish routes...
I'll switch back to overwrite the external DNS name on the internal DNS server, and provision Clients using VPN to use the external DNS as primary interface (which will configure the external Domain as both "Internal server" and "External server" in the 3CX Client).

Cheapest way to mitigate the issue IMO.
Still, an option to force Tunnel mode for "local" connections, or some other way for the client to detect NAT/Masquerading on VPN connections, would be nice.

Thanks for your help @JohnS_3CX !