Think you VoIP phone send real IP in contact string. Disable nat features in your VoIP phones. On Thu, Oct 1, 2015 at 4:43 PM, Charles Bujold <cjbujold@accra.ca> wrote:
We are encountering an error which we do not know how to fix. If somebody can help, it would be appreciated.
Our configuration is we have 2 offices. Both offices are joined together via a VPN. The users in the remote office use Freeswitch via the VPN and connect to Freeswitch SIP port 5060 via the VPN. Their phones register without issue. The issue comes when they try to make a call. They connect to Freeswitch via SIP without error however early in the connection Freeswitch no longer recognizes them as being local and tries to communicate with them via the WAN. Worst case we could open the firewall to permit such communication but the issue with that, for some reason Freeswitch no longer uses the UDP port range set in Freeswitch it uses a port outside of the range causing the call to fail.
Our acl.config has both Lan entered into it 192.168.20.0/24 (Main Office) and 192.168.25.0/24 (Remote Office) however the main office lan is set to deny, we presume it is because one of the default list already includes it.
Here is a pcap summary of what we see. How can we setup so that the remote office will work every time and still be seen as part of the overall local office?
192.168.25.18 is a remote phone
192.168.20.153 is Freeswitch server in main office.
142.162.8.143 is our WAN IP
Port 49790 is outside of the max port which is 32768
83 12.279953 192.168.25.18 192.168.20.153 SIP/SDP 935 Request: INVITE sip:*97@192.168.20.153
84 12.375683 192.168.20.153 192.168.25.18 SIP 375 Status: 100 Trying |
85 12.376097 192.168.20.153 192.168.25.18 SIP 880 Status: 407 Proxy Authentication Required
86 12.393746 192.168.25.18 192.168.20.153 SIP 318 Request: ACK sip:*97@192.168.20.153
87 12.458854 192.168.25.18 192.168.20.153 SIP/SDP 1181 Request: INVITE sip:*97@192.168.20.153
88 12.542911 192.168.20.153 192.168.25.18 SIP 375 Status: 100 Trying
89 12.718778 192.168.20.153 192.168.25.18 SIP/SDP 1153 Status: 200 OK
90 12.752832 192.168.25.18 142.162.8.143 SIP 680 Request: ACK sip:*97@142.162.8.143:49790;transport=udp
Our acl.conf file
<configuration name="acl.conf" description="Network Lists">
<network-lists>
<!--
These ACL's are automatically created on startup.
rfc1918.auto - RFC1918 Space
nat.auto - RFC1918 Excluding your local lan.
localnet.auto - ACL for your local lan.
loopback.auto - ACL for your local lan.
-->
<list name="lan" default="allow">
<node type="deny" cidr="192.168.20.0/24"/>
<node type="allow" cidr="192.168.25.0/24"/>
</list>
<!--
This will traverse the directory adding all users
with the cidr= tag to this ACL, when this ACL matches
the users variables and params apply as if they
digest authenticated.
-->
<list name="domains" default="deny">
<!-- domain= is special it scans the domain from the directory to build the ACL -->
<node type="allow" domain="$${domain}"/>
<!-- use cidr= if you wish to allow ip ranges to this domains acl. -->
<!-- <node type="allow" cidr="192.168.20.0/24"/> -->
<!-- <node type="allow" cidr="192.168.25.0/24"/> -->
</list>
</network-lists>
</configuration>
If you can tell us how we should configure Freeswitch to work for both offices it would be appreciated.
Thanks
cjb
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org