Possible UDP session timeout regression?

[Chaskel]

Hello, I have used OPNsense for a few years now successfully with a Vonage VoIP plan and am not sure if the following is a regression in upgrading to the 24.7 branch or not, and I do not have an easy way to test with downgrade. I am currently running OPNsense 24.7.4_1-amd64.

I have been trying to troubleshoot an issue relating to outbound Vonage VoIP calls getting dropped (inbound does not appear to have same problem). My Vonage service is not frequently utilized except that on most evenings my wife makes a call to her mother (some lasting more than 15 minutes). The current issue is that:

- Every evening that she goes to make the call to her mother that is longer than 15 minutes, each time the call drops exactly at 15 minutes, which I believe is the 900s value that the Firewall Optimization "Conservative" setting I have always had configured uses in OPNsense. While she makes the call I observe in the Firewall sessions that this also seems to be the case and once the call drops the 900s countdown starts and eventually expires and disappears.
- She calls her mother back soon after the call drops, and the following call is able to go longer than 15 minutes without getting dropped.
- Based on the sessions table I have seen it happen with various Vonage destination server IPs (which appear to be AWS-hosted).

In my troubleshooting I have tried on multiple occasions:

- Rebooting the cable modem [Same behavior as described above]
- Rebooting the Vonage adapter [Same behavior as described above]
- Rebooting OPNsense [Same behavior as described above]
- Modifying OPNsense to have an outbound static port for the Vonage adapter (even though it has worked without this previously) [Same behavior as described above]
- Moving the Vonage adapter to connect directly to my cable modem (bypass OPNsense) [Unless a coincidence, success - the problem disappears]

While I am already in the process of migrating off of Vonage, I would still like to understand if there could be a possible UDP session timeout issue (or perhaps something else) with the more recent versions of OPNsense? I find it odd that it only happens on the initial call but the subsequent post-dropped call seems to never have the problem.

Thank you.

[opnfwb]

While I don't know the answer I'm curious if changing the firweall optimization back to default has any impact on the success of the first call?

If we change the optimization back to default, I would expect the first call to drop even earlier if that was the component that was causing the issue? Can you try this and see if this has any impact? That might give more clues as to what is causing the issue.

[Chaskel]

Many thanks for your reply and suggestion. After reading what you wrote, I moved the Vonage adapter back behind OPNsense and power-cycled the Vonage adapter. As I first wanted to make sure the problem returned before trying what you mention, I left the OPNsense config as-is and had my wife make her nightly call about 20 minutes ago. Sure enough 15 minutes in, the call dropped.

Now that I have verified that the issue returned upon moving the Vonage adapter back behind OPNsense, I have just changed the config from "conservative" to "normal", and I will report back (hopefully tomorrow around same time).

Thanks again.

[Chaskel]

Hello opnfwb,

Here is tonight's result for the test you proposed.

Unless it is a coincidence, it would seem that changing the setting from "conservative" to "normal" allowed my wife's call to exceed 15 minutes and not drop for the remaining duration of her conversation. The call lasted close to 28 minutes, and I observed a 60s expiration time in the OPNsense firewall sessions screen (as opposed to the 900s the conservative setting had). Once my wife ended the call, the timer then counted down and the session disappeared from the list.

I hope this information is helpful. How would you like to proceed?

Thank you.

[opnfwb]

If the normal optimization isn't interfering with anything else on the network, I would suggest leaving that in place and see how things go? I'm still not sure why the conservative optimization was causing the issue.

[Chaskel]

Ok, I will plan to do that for now. At this point I will also now continue forward with migrating to my new VoIP provider.

I hope all of the above possibly helps the OPNsense team/community, and I greatly appreciate your assistance.

Thank you.