|
Boardercrime
|
 |
« on: October 16, 2006, 09:23:18 am » |
|
I've got a Asterisk and a SIP Adapter behind the pfsense Wrap Box.
Forwarded Natports and Firewall Rules are following:
WAN
Proto Source Port Destination Port Gateway
TCP/UPD * * IP of Asterisk 5060 *
TCP/UDP * * IP of Asterisk 10000-20000 *
IF i reset the states everything is okay, but after a while there is no connection anymore.
I disabled the traffic shaper and activated the advanced nat. Still no luck. Any hints ?
Before i had a M0n0wall on the WRAP,then the SIP worked.
|
|
|
|
« Last Edit: October 16, 2006, 09:44:15 am by Boardercrime »
|
Logged
|
|
|
|
|
|
hoba
|
|
« Reply #1 on: October 16, 2006, 09:25:36 am » |
|
What is "a while"? You might try to add a long state timeout for these firewallrules (edit the rules, statetimout option is hiding behind one of the advanced option buttons). Maybe the state times out when the connection is idle for some time.
|
|
|
|
|
Logged
|
|
|
|
|
|
Boardercrime
|
|
« Reply #2 on: October 16, 2006, 09:33:17 am » |
|
How long i should set the timeout ?
I think after 1-2 minutes it hangs..not sure.
|
|
|
|
« Last Edit: October 16, 2006, 09:36:49 am by Boardercrime »
|
Logged
|
|
|
|
|
|
hoba
|
|
« Reply #3 on: October 16, 2006, 10:08:03 am » |
|
1-2 minutes? that sounds like something is closing the state. that's just too short to be a problem with state timout imo but try something like an hour just to test if something changes.
|
|
|
|
|
Logged
|
|
|
|
|
|
Boardercrime
|
|
« Reply #4 on: October 17, 2006, 04:27:15 am » |
|
I seems the timeout settings is not the problem.
Any ideas ?
|
|
|
|
|
Logged
|
|
|
|
|
|
Helix26404
|
|
« Reply #5 on: October 17, 2006, 07:51:55 pm » |
|
In Asterisk, try setting qualify=yes for the extension that is affected. This will force Asterisk to send "keep alive" packets to the device.
|
|
|
|
|
Logged
|
|
|
|
|
|
Boardercrime
|
|
« Reply #6 on: October 18, 2006, 10:28:58 am » |
|
I've got this setting already.
|
|
|
|
|
Logged
|
|
|
|
|
|
SpLord
|
|
« Reply #7 on: April 09, 2007, 06:31:54 pm » |
|
any solution yet, same problem here.
After resetting the State table everything is working for round a day, then you has to reset the states
Carsten
|
|
|
|
|
Logged
|
|
|
|
|
|
hoba
|
|
« Reply #8 on: April 09, 2007, 06:47:42 pm » |
|
You probably need some kind of keepalive setting for your SIP-client. I have seen devices that have a setting for this (like the AVM Fritzbox for example). Check the manuals of your device to see if it supports such a setting.
|
|
|
|
|
Logged
|
|
|
|
|
|
SpLord
|
|
« Reply #9 on: April 11, 2007, 06:37:08 am » |
|
You probably need some kind of keepalive setting for your SIP-client. I have seen devices that have a setting for this (like the AVM Fritzbox for example). Check the manuals of your device to see if it supports such a setting.
keepalive is active, i'm using an asterisk server which connects too some sip providers. |
|
|
|
|
Logged
|
|
|
|
|
|
Slam
|
|
« Reply #10 on: April 11, 2007, 06:53:25 am » |
|
More settings for you guys to play with if you have a Sipura/Linksys ATA
(under NAT Support Parameters):
STUN Enable=yes, STUN Test Enable=yes, Substitute VIA Addr=yes, Send Resp To Src Port=yes, NAT Keep Alive Intvl=15, other VIA parameters=no
(under Line 1):
NAT Mapping Enable=yes, NAT Keep Alive Enable=yes
Regards
|
|
|
|
|
Logged
|
|
|
|
|
|
hoba
|
|
« Reply #11 on: April 12, 2007, 03:25:58 pm » |
|
|
|
|
|
|
Logged
|
|
|
|
|
|
SpLord
|
|
« Reply #12 on: May 06, 2007, 09:16:31 am » |
|
Nope doesn't work.
Is there a possibility to trigger a state table reset when a re-dial(PPPoe) occurs?
|
|
|
|
|
Logged
|
|
|
|
|
|
maldex
|
|
« Reply #13 on: May 09, 2007, 04:44:55 am » |
|
Try to decrease the register times to 60seconds. PFsense, along with some expesive-firewalls, have UDP timeouts of 30/60 seconds... after 60 seconds the incomming INVITE will be dropped.
Using STUN doesnt solve the problem. stun is only used to let the phone know the public(masqueraded) address, and how it can open up UDP sessions.
the public IP is needed because SIP (which is osi-layer7) does also contain the IP adress, and some SIP-devices will answer only on that and not on the layer3 ip...(workaround in asterisk is NAT=Yes)
another good idea is to create a NAT rule which does static-port-mapping on the SIP & RTP sessions so that port 5060 stay's always 5060.....
things i haven't checked yet for myself:
- SIP over TCP. TCP-sessions have much longer timeouts...but is rarely supported
- Conservative mode.
good luck
|
|
|
|
« Last Edit: May 09, 2007, 04:53:06 am by maldex »
|
Logged
|
|
|
|
|
|
pfSense Forum
