After update OPNsense 24.1.2 and Suricata 7 VoIP is dead

[Bunch]

Can you try this?
https://forum.opnsense.org/index.php?topic=38989.0

Just tried adding

Code Select Expand

exception-policy: ignore
to
/usr/local/opnsense/service/templates/OPNsense/IDS/custom.yaml

no more drop for VoIP now. Thanks.
I will try again 12 hours later to confirm it won't drop anymore.

[amw-tue]

I have tried the suggestion made by mimugmail but have the same result as ChrisChros - it will not work.

[allan]

I got this to work only after copying the entire app-layer: section from suricata.yaml and inserting error-policy: ignore at the first indent - same level as protocols:.

The Suricata 7 documentation states that adding app-layer: in custom.yaml overwrites the one in suricata.yaml. I recommend anyone still having issues to try this if disabling IPS is not an option.

If the same section, say outputs is later redefined after the include statement it will overwrite the included file. Therefore any include statement at the end of the document will overwrite the already configured sections.

[MoonbeamFrame]

Just a FYI.

I have two VoIP systems behind almost identical firewall hardware (one has a couple of additional 10GB ports) running  24.1.2_1  and configured in the same way. PBX traffic is over a 1:1 NAT.

I've seen the same issue of IDS needing to be disabled on one of them but not the other.

The major difference between the two looks to be the SIP trunk provider.

[misterk]

any news on the problem?

[pdishman]

Not in the exact same vein:

With upgrade to 24.1.2 and activation of Suricata 7 we saw a drastic decline in Teams throughput for all calls and video with their service.  Only way we were able to circumvent was by turning off Suricata.  Once it was off we saw throughput return to normal and users able to place calls with 0 lag or interference. Not sure if it assists, but hoping someone with more knowledge or within OpnSense see this thread and has a fix for next release.

[muchacha_grande]

This problem was addressed here https://github.com/opnsense/core/pull/7271
A suppose it will be fixed in the next update.

[franco]

Yeah, 24.1.3 should address this further. It probably going to be released tomorrow.


Cheers,
Franco

[chemlud]

RE: VOIP/SIP issues

Do a package capture on WAN while calling your number and see if there are SIP invite packages coming in from your provider.

Reboot and repeat.