I have been using pfSense (1.2.3) and FS. FS nicely uses UPnP to poke holes in the firewall, but it seems that the holes close after a while. I cannot find any documentation in FS nor in pfSense as to what the timeout is. Is there a setting in FS to do some kind of keep-alive thing with UPnP to keep, e.g. 5060, open? Or is it already doing that and pfSense is the issue? Thanks!
hi, no problem in windows or debian GNU/Linux mayb is a pfsense problem if the problem percist start fs with: ./freeswitch -nonat and redirect your required ports;) thanks Le 09/02/2010 05:21, Troy Anderson a écrit :
I have been using pfSense (1.2.3) and FS. FS nicely uses UPnP to poke holes in the firewall, but it seems that the holes close after a while. I cannot find any documentation in FS nor in pfSense as to what the timeout is. Is there a setting in FS to do some kind of keep-alive thing with UPnP to keep, e.g. 5060, open? Or is it already doing that and pfSense is the issue?
Thanks! _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I believe FS opens the ports with an indefinite timeout (never close). I'd have to double check. In addition, FS refreshes the NAT mappings on every keep-alive packet sent by the upnp gateway. Have you done a nat_map status once the ports are missing in pfsense to see if fs still thinks the ports should be open? What if you do a nat_map republish? Do the maps get pushed to pfsense and then stay open for a whlie? Perhaps pfsense is sending a keep-alive packet that we don't process right or is invalid? If so, I'd need a packet trace to do analysis. On Mon, Feb 8, 2010 at 10:21 PM, Troy Anderson <troy@tlainvestments.com>wrote:
I have been using pfSense (1.2.3) and FS. FS nicely uses UPnP to poke holes in the firewall, but it seems that the holes close after a while. I cannot find any documentation in FS nor in pfSense as to what the timeout is. Is there a setting in FS to do some kind of keep-alive thing with UPnP to keep, e.g. 5060, open? Or is it already doing that and pfSense is the issue?
Thanks! _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -Rupa
I did do a nap_map status when the ports were missing from pfSense and FS thought they were still open. I didn't know about nat_map republish, but will try next time. I think the timeframe is days, so this is kind of hard to diagnose. I may add a periodic nat_map republish from fs_cli to our production systems. In any case, I'll keep an eye on it and try nat_map republish next time pfSense drops the ports to be sure that is working in this environment. In the meantime, which .c file(s) can I peruse to learn more? Thanks! Troy On Feb 9, 2010, at 3:07 AM, Rupa Schomaker wrote:
I believe FS opens the ports with an indefinite timeout (never close). I'd have to double check. In addition, FS refreshes the NAT mappings on every keep-alive packet sent by the upnp gateway. Have you done a nat_map status once the ports are missing in pfsense to see if fs still thinks the ports should be open? What if you do a nat_map republish? Do the maps get pushed to pfsense and then stay open for a whlie?
Perhaps pfsense is sending a keep-alive packet that we don't process right or is invalid? If so, I'd need a packet trace to do analysis.
On Mon, Feb 8, 2010 at 10:21 PM, Troy Anderson <troy@tlainvestments.com> wrote: I have been using pfSense (1.2.3) and FS. FS nicely uses UPnP to poke holes in the firewall, but it seems that the holes close after a while. I cannot find any documentation in FS nor in pfSense as to what the timeout is. Is there a setting in FS to do some kind of keep-alive thing with UPnP to keep, e.g. 5060, open? Or is it already doing that and pfSense is the issue?
Thanks! _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -Rupa _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
perhaps pfSense isn't sending the keep-alive packets like we expect? You can look in switch_nat.c for details. On Tue, Feb 9, 2010 at 9:44 AM, Troy Anderson <troy@tlainvestments.com>wrote:
I did do a nap_map status when the ports were missing from pfSense and FS thought they were still open. I didn't know about nat_map republish, but will try next time. I think the timeframe is days, so this is kind of hard to diagnose. I may add a periodic nat_map republish from fs_cli to our production systems.
In any case, I'll keep an eye on it and try nat_map republish next time pfSense drops the ports to be sure that is working in this environment.
In the meantime, which .c file(s) can I peruse to learn more?
Thanks! Troy
On Feb 9, 2010, at 3:07 AM, Rupa Schomaker wrote:
I believe FS opens the ports with an indefinite timeout (never close). I'd have to double check. In addition, FS refreshes the NAT mappings on every keep-alive packet sent by the upnp gateway. Have you done a nat_map status once the ports are missing in pfsense to see if fs still thinks the ports should be open? What if you do a nat_map republish? Do the maps get pushed to pfsense and then stay open for a whlie?
Perhaps pfsense is sending a keep-alive packet that we don't process right or is invalid? If so, I'd need a packet trace to do analysis.
On Mon, Feb 8, 2010 at 10:21 PM, Troy Anderson <troy@tlainvestments.com>wrote:
I have been using pfSense (1.2.3) and FS. FS nicely uses UPnP to poke holes in the firewall, but it seems that the holes close after a while. I cannot find any documentation in FS nor in pfSense as to what the timeout is. Is there a setting in FS to do some kind of keep-alive thing with UPnP to keep, e.g. 5060, open? Or is it already doing that and pfSense is the issue?
Thanks! _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -Rupa _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -Rupa
participants (3)
-
Meftah Tayeb
-
Rupa Schomaker
-
Troy Anderson