SIP NAT Issue?

[shtech]

Two opnsense firewalls. Both on latest update. One at Home and one at the office

SIP Client can register just fine using cellular data.

On wifi at my house, it will not.

Office has Nat Port forward The IP's listed are fake.
Protocol     Source       Port        Address      Ports               Destination       Ports
TCP/UDP     *                 *           5.5.5.5        5060-5090       192.168.1.10    5060-5090
UDP             *                 *           5.5.5.5        16384 - 32768  192.168.1.10  16384 - 32768

I can see the traffic getting to the server behind the office firewall. I can see traffic coming back...it just doesn't connect. Unless i use Verizon's Data signal. So it's something in the NAT between the firewalls, i just can't figure out what.

This has been a problem for a while, i've just ignored until this covid stuff. Am i forgetting something? I have to be. the 16 hour days are getting to me, very tired.

[StP]

Sorry, I cannot help, I'm just seing a similar problem here.

In the office I'm running a conference server (audio, video, whiteboard, chat and so on) behind an OPNsense firewall.
I can connect to the system itself just fine (well at least I could until I ran into the problems mentioned here yesterday).
No matter what connection path login works and whiteboard can be used. Chat system works.
But audio (SIP/RTP) and video (WebRTC) do not work when I try to connect from my home office where I am behind a AVM DSL router (Fritzbox).
Neither PC, nor iPad or iPhone can use audio/video when connected to the Fritzbox WIFI.
That same iPhone works fine when I shutdown WIFI and connect via LTE.
And the iPad works fine as soon as I use the iPhone as mobile hotspot with the phone.
The PC can connect from my homeoffice WIFI if I connect to the company network via OpenVPN (OPNsense road warrior setup).

In short everything using TCP works. UDP is the problem.
The problem looks very similar to yours. Difference being my homeoffice is just behind a AVM Fritzbox instead of a second OPNsense.

Just my 2 cents.

Stay safe everyone
Stefan

[bartjsmit]

Do you have a STUN server configured?

Bart...

[StP]

Bart,
don't know if your question goes in my direction but anyways, here I go:
According to the documentation of my conference system (BigBlueButton) I do not need a STUN server if the firewall's WAN interface has a fixed IP. In that case I can hardcode that IP in one of the configuration files instead of STUN server address and port. That's what I have done. Maybe that is not enough if clients are behind a router.

Stefan

[shtech]

Bart,
don't know if your question goes in my direction but anyways, here I go:
According to the documentation of my conference system (BigBlueButton) I do not need a STUN server if the firewall's WAN interface has a fixed IP. In that case I can hardcode that IP in one of the configuration files instead of STUN server address and port. That's what I have done. Maybe that is not enough if clients are behind a router.

Stefan

The only time I have this problem, is when I'm home. It also works behind other firewalls. If I join my neighbors wireless, it works just fine as well. I've never had to use a STUN server.

[bartjsmit]

Hi Stefan,

Best way to determine that is to run a packet trace on the WAN interface limited to the public IP range of your conference system provider.

If you see a lot of RTP addressed to the internal address, you'll need STUN.

A trace will help regardless - Wireshark is your friend ;-)

Bart...

[StP]

Bart,
maybe I did not express myself as clear as I should...
We host the conference system ourselves. On company premise on our own hardware behind OPNsense.
Right now I can't do any further tests because of this:
https://forum.opnsense.org/index.php?topic=16764.0

Thanks for your help
  Stefan

[bartjsmit]

Sorry Stefan, I did misread your post.

Probably best to work with Deciso under your support arrangement with them, although I would still run packet traces to get a better handle myself.

Bart...

[shtech]

Sorry Stefan, I did misread your post.

Probably best to work with Deciso under your support arrangement with them, although I would still run packet traces to get a better handle myself.

Bart...

Unfortunately, that is where SIP ALG would probably help. We typically disable it on any firewalls we manage and use to pass voip traffic, but we've had rare occurences where it works. Unfortunate opnsense doesn't have it as an option to test with atleast. it overwrites the SIP header which I think is my problem.

[bartjsmit]

Did you try the os-siproxd plugin?

[shtech]

Bart,
don't know if your question goes in my direction but anyways, here I go:
According to the documentation of my conference system (BigBlueButton) I do not need a STUN server if the firewall's WAN interface has a fixed IP. In that case I can hardcode that IP in one of the configuration files instead of STUN server address and port. That's what I have done. Maybe that is not enough if clients are behind a router.

Stefan

Just getting back to this. I tried several stun servers (which we've used for clients in the past) and it didn't help.