<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA>We are encountering an error which we do not know how to fix. If somebody can help, it would be appreciated. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA>Our configuration is we have 2 offices. Both offices are joined together via a VPN. The users in the remote office use Freeswitch via the VPN and connect to Freeswitch SIP port 5060 via the VPN. Their phones register without issue. The issue comes when they try to make a call. They connect to Freeswitch via SIP without error however early in the connection Freeswitch no longer recognizes them as being local and tries to communicate with them via the WAN. Worst case we could open the firewall to permit such communication but the issue with that, for some reason Freeswitch no longer uses the UDP port range set in Freeswitch it uses a port outside of the range causing the call to fail.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA>Our acl.config has both Lan entered into it 192.168.20.0/24 (Main Office) and 192.168.25.0/24 (Remote Office) however the main office lan is set to deny, we presume it is because one of the default list already includes it.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA>Here is a pcap summary of what we see. How can we setup so that the remote office will work every time and still be seen as part of the overall local office? <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA>192.168.25.18 is a remote phone<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>192.168.20.153 is Freeswitch server in main office.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>142.162.8.143 is our WAN IP<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>Port 49790 is outside of the max port which is 32768<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA>83 12.279953 192.168.25.18 192.168.20.153 SIP/SDP 935 Request: INVITE sip:*97@192.168.20.153 <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>84 12.375683 192.168.20.153 192.168.25.18 SIP 375 Status: 100 Trying |<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>85 12.376097 192.168.20.153 192.168.25.18 SIP 880 Status: 407 Proxy Authentication Required <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>86 12.393746 192.168.25.18 192.168.20.153 SIP 318 Request: ACK sip:*97@192.168.20.153 <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>87 12.458854 192.168.25.18 192.168.20.153 SIP/SDP 1181 Request: INVITE sip:*97@192.168.20.153 <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>88 12.542911 192.168.20.153 192.168.25.18 SIP 375 Status: 100 Trying <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>89 12.718778 192.168.20.153 192.168.25.18 SIP/SDP 1153 Status: 200 OK <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>90 12.752832 192.168.25.18 142.162.8.143 SIP 680 Request: ACK sip:*97@142.162.8.143:49790;transport=udp <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA>Our acl.conf file<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA><configuration name="acl.conf" description="Network Lists"><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <network-lists><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <!-- <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> These ACL's are automatically created on startup.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> rfc1918.auto - RFC1918 Space<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> nat.auto - RFC1918 Excluding your local lan.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> localnet.auto - ACL for your local lan.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> loopback.auto - ACL for your local lan.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <list name="lan" default="allow"><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <node type="deny" cidr="192.168.20.0/24"/> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <node type="allow" cidr="192.168.25.0/24"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> </list><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <!--<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> This will traverse the directory adding all users <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> with the cidr= tag to this ACL, when this ACL matches<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> the users variables and params apply as if they <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> digest authenticated.<o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <list name="domains" default="deny"><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <!-- domain= is special it scans the domain from the directory to build the ACL --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <node type="allow" domain="$${domain}"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <!-- use cidr= if you wish to allow ip ranges to this domains acl. --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <!-- <node type="allow" cidr="192.168.20.0/24"/> --><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> <!-- <node type="allow" cidr="192.168.25.0/24"/> --> <o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> </list><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA> </network-lists><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span lang=EN-CA></configuration><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA>If you can tell us how we should configure Freeswitch to work for both offices it would be appreciated.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-CA>Thanks<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-CA>cjb<o:p></o:p></span></p></div></body></html>