Super strange Bridge issue with paket filtering and a Grandstream phone

[clst]

Bridge is on 4 ports and working generally fine.

I have set up filtering on the bridge instead of the ports as per the guide.

Now the issue is: The phone works fine, can be called, UDP and TCP packet travel along nicely. But every time I try to call an external number (other internal extensions work great): It looks like the packets for initiating the connection get silently dropped.

During troubleshooting I tried a Linux softphone on the same port and it works fine. Plugging the non-working phone into a switch connected to OPNSense also works fine. And now the weirdest part: as soon as I toggle System - Advanced - Disable Firewall to disable all packet filtering. The phone can make calls.
I checked the MTU and it's fine. I checked with and without the block port 0 rule. Devices from the Wifi on the OPNSense box also work (but sadly that phone has no Wifi).

I am totally baffled. I have all checkboxes enabled for logging in advanced. And there are zero dropped packets in the log. I have a rule to allow interface LAN (the bridge) to LAN anything right at the top:

Code Select Expand

pass log quick on bridge0 inet from {any} to {any} keep state label "f8e58ab2-ea70-4831-a28f-1392c52478d4" # LAN bridge ALLOW ALL
all rules in /tmp/rules.debug have log enabled. And there is nothing to see in the live view. Not even an rdr from a rogue NAT rule.
The log on the Asterisk box doesn't show anything out of the ordinary. The SIP messages to actually connect the call just never arrive.

Does anyone have a hint?

I tried doing a packet log from the phone, but the firmware crashed, lol.
Packet log on the OPNSense box?

OPNsense 26.1.11_6-amd64

[lmoore]

Why you are wanting to use a bridge in OPNsense for this, you would be better off with a switch.

You've not provided any details, such as how you make external calls.

Different firmware may fix the phone crashing when capturing packets.

I would hazard a guess your problem is related to STUN.

You could perform a packet capture on your OPNSense box, or have a look at this site - https://tanshiyiing.com/get-syslog-using-wireshark/

What may work is Method 1 and using Mirrored PC Port Mode - if I understand this method, you don't even need a syslog server.

Of course, if you've got a syslog server on your network, you could point it to that.

Better still, if all the incoming and outgoing packets are mirrored on the PC Port, you could capture all of the communications there.

[clst]

Thanks for the reply.
I also have a few switches but my OPNSense box has 5 2.5G ports and I wouldn't want those to go to waste.

Yeah, the phone is a bit weird. I am guessing the internal memory is too full to grab a lot of packets. That's not really a big concern.

STUN shouldn't matter because the PBX is reachable on the internal network in the same subnet as the phone.

I'll try a packet capture on the OPNSense. It might be something odd with the NAT rules for the upstream trunk. Those shouldn't do anything to the LAN/Bridge and there is nothing in the log, but maybe it does.
Phone might be doing SIP over UDP and the PC over TCP even if using the same settings.

I was just confused that the bridge with a rule to "allow all" acts differently than the bridge with packet filtering off. Only thing I can imagine acting differently is the NAT (I think that also is completely disabled with filtering off).

Sorry for the vague details but I didn't want to just dump my whole config and I really can't think of the relevant settings. So I was trying to fish for a "Oh yeah, that's what happened to me" type answer. Thanks for the input. If I find anything I'll be sure to post again.