VoIP outbound calls not working

[RoleTue]

Hello all,

I've following setup at home:

Internet --> Opnsense --> Unify switch --> N670IP Pro

As handset I use Gigaset S700H Pro.
My ISP is Vodafone (Cable) in Baden-Wuerttemberg. Prior to this setup I used the Fritzbox 6660 Cable as phonebox which worked properly without any troubles. Since I wanted to get rid of the Fritzbox I acquired the VoIP Box N670. I've configured it with all required data and I get the Box registered via SIP at the Vodafone server. Incoming calls are possible. Outgoing not. As soon as I dial a number on the handset the connection is immediately aborted and the display shows "not reachable". I searched a lot for any solutions or reasons why this happens. Couldn't find any more information. Even the firewall logs don't show any blocks.
Does anyone have an idea what could cause this issue?
Thanks already in advance.

[olmo1501]

I would recommend using IPv6. That would simplify things a lot.

If you really need IPv4 make sure to create an Outbound NAT rule that sets static ports for your VoIP device.

[lmoore]

You will need to understand what it is that is causing the device to fail when dialing.

I would suggest creating Firewall & NAT rules for your VoIP connections for the SIP & RTP connections and enabled logging of these rules, including in NAT. Reviewing the logs will show you whats going on.

Have you received incoming calls from your ITSP to verify the SIP connection works every time a call is placed to your number or is this intermittent?

Gigaset manuals can be found here - https://teamwork.gigaset.com/gigawiki/display/GPPPO/Manuals+-+N670+IP+PRO

Looking at page 88 of the English manual, you can configure it to send information to a syslog server and what to log. This may be helpful.

Looking at this page - https://teamwork.gigaset.com/gigawiki/display/GPPPO/FAQ+-+Call+settings, there is information about access and area codes when dialing. If all of this is configured correctly, your ITSP may be sending a Forbidden response to your outgoing SIP invites.

I recently replaced my Asterisk box and with one of my providers, my outbound calls were failing. The response I was receiving to my SIP invites was simply Forbidden. The problem turned out to be a contact header in the outgoing SIP request not being what they wanted.

Failing that, if your connections are using SIP (not TLS), you may be able to sniff the SIP packets and see if the call is being placed and if your ITSP is rejecting the request.

In my environment I only have outgoing SIP connections. Incoming calls arrive through them.

Good luck!

[RoleTue]

Hello Olmo,

thanks for the reply. IPv6 is not supported by the device according to the web configurator. FW rules including outbound are already set. I used the same setup with the Fritzbox which worked. I simply exchanged the devices. That's why I don't understand what's going on. Anyway, I'll recheck the firewall rules.

Hello Imoore,

yes, I already have downloaded the manuals for the N670. I read about the remote syslog server. Maybe I should try this as you suggest it. As said above firewall rules are set up and logging is enabled. The firewall doesn't show any blocks. I checked it with the live view while dialing.
Your second link looks interesting. I'll go through it. Thanks a lot for that.
I'll report back.

Thanks again to both of you.

[olmo1501]

Did you create the Outbound Rule for specific ports? If so, check if they still match. RTP ports may be different between a Fritzbox and a Gigaset device.

[lmoore]

I've found this document for Vodafone Germany, which may help.

https://www.vodafone.de/media/downloads/pdf/Vodafone-Kabel-Deutschland-GmbH-Telephony-Interface-Specific.pdf

In my environment I have a separate VLAN for VoIP. The way I've written my rules is to only allow connections from this VLAN to the SIP_Providers alias. In my SIP_Providers alias I have included the ITSP's SIP & RTP server addresses.

With the traffic originating from my network, the rules match the DSCP field and then tags it. This is applied to SIP, RTP voice & RTP video.

The VoIP Outbound NAT rule simply matches these tagged packets.

The outgoing firewall rule simply matches the tagged packets. This removes the need to create rules using RTP ranges, as these will differ between providers.

The screen shots may help to illustrate this.

The QoS settings for the N670IP Pro are on page 55 of the English manual. You could look up the settings on your Fritzbox and replicate them on the N670IP Pro. I doubt this will be the reason your outbound calls are failing.

You may need to reference this site when working out what you need to set for the DSCP/TOS field - https://tucny.com/Home/dscp-tos

[lmoore]

The remaining images -1.

[lmoore]

Now for the final image.