One Way audio Remote extension (pfsense Virtual ip)

[shetu]

I put pbx in flash behind pfsense and make one pfsense virtule ip for pbx in flash. Call drop after 30 second when I use pfsense virtual IP. I got message like X-Asterisk-HangupCauseCode: 44.
[email protected] (Nat Yes)
[email protected] (Nat Yes)
pfsense vip : 192.168.25.50
Pbx in Flash : 192.168.11.11
Here is few screenshot.

Spoiler: Sip Debug

<sip:INFO> 'udp:0.0.0.0:5060' sending 'INVITE sip:[email protected]' 03F57BF8 to 192.168.25.50:5060 [0156CBA8]
------
INVITE sip:[email protected] SIP/2.0
Max-Forwards: 20
Via: SIP/2.0/UDP 192.168.25.2:5060;rport;branch=z9hG4bK1132437893
From: <sip:[email protected]>;tag=1559707550
To: <sip:[email protected]>
Call-ID: [email protected]
CSeq: 301 INVITE
User-Agent: YATE/5.4.0
Contact: <sip:[email protected]:5060>
Allow: ACK, INVITE, BYE, CANCEL, OPTIONS, INFO
Content-Type: application/sdp
Content-Length: 504

v=0
o=yate 1595616717 1595616717 IN IP4 192.168.25.2
s=SIP Call
c=IN IP4 192.168.25.2
t=0 0
m=audio 20674 RTP/AVP 0 8 3 11 98 97 102 103 104 105 106 101
------
<sip:INFO> 'udp:0.0.0.0:5060' received 524 bytes SIP message from 192.168.25.50:5060 [0156CBA8]
------
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 192.168.25.2:5060;branch=z9hG4bK1132437893;received=192.168.25.2;rport=5060
From: <sip:[email protected]>;tag=1559707550
To: <sip:[email protected]>;tag=as4bb3d7b6
Call-ID: [email protected]
CSeq: 301 INVITE
Server: IncrediblePBX-15.0.16.42.1(16.8.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="0098a38e"
Content-Length: 0

------
<sip:INFO> 'udp:0.0.0.0:5060' sending 'ACK sip:[email protected]' 02E5BA88 to 192.168.25.50:5060 [0156CBA8]
------
ACK sip:[email protected] SIP/2.0
Via: SIP/2.0/UDP 192.168.25.2:5060;rport;branch=z9hG4bK1132437893
From: <sip:[email protected]>;tag=1559707550
To: <sip:[email protected]>;tag=as4bb3d7b6
Call-ID: [email protected]
CSeq: 301 ACK
Max-Forwards: 20
Contact: <sip:[email protected]:5060>
User-Agent: YATE/5.4.0
Content-Length: 0

------
<sip:INFO> 'udp:0.0.0.0:5060' sending 'INVITE sip:[email protected]' 03D39298 to 192.168.25.50:5060 [0156CBA8]
------
INVITE sip:[email protected] SIP/2.0
Max-Forwards: 20
Via: SIP/2.0/UDP 192.168.25.2:5060;rport;branch=z9hG4bK2093931466
From: <sip:[email protected]>;tag=1559707550
To: <sip:[email protected]>
Call-ID: [email protected]
User-Agent: YATE/5.4.0
Contact: <sip:[email protected]:5060>
Allow: ACK, INVITE, BYE, CANCEL, OPTIONS, INFO
CSeq: 302 INVITE
Authorization: Digest username="703", realm="asterisk", nonce="0098a38e", uri="sip:[email protected]", response="f5a365243062f9afe2410f6c3d5731d6", algorithm=MD5
Content-Type: application/sdp
Content-Length: 504

v=0
o=yate 1595616717 1595616717 IN IP4 192.168.25.2
s=SIP Call
c=IN IP4 192.168.25.2
t=0 0
m=audio 20674 RTP/AVP 0 8 3 11 98 97 102 103 104 105 106 101
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=ptime:30
------
<sip:INFO> 'udp:0.0.0.0:5060' received 466 bytes SIP message from 192.168.25.50:5060 [0156CBA8]
------
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 192.168.25.2:5060;branch=z9hG4bK2093931466;received=192.168.25.2;rport=5060
From: <sip:[email protected]>;tag=1559707550
To: <sip:[email protected]>
Call-ID: [email protected]
CSeq: 302 INVITE
Server: IncrediblePBX-15.0.16.42.1(16.8.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Contact: <sip:[email protected]:5060>
Content-Length: 0

------
Call active: client/170
Calling: 701
Calling target
<sip:INFO> 'udp:0.0.0.0:5060' received 534 bytes SIP message from 192.168.25.50:5060 [0156CBA8]
------
SIP/2.0 180 Ringing
Via: SIP/2.0/UDP 192.168.25.2:5060;branch=z9hG4bK2093931466;received=192.168.25.2;rport=5060
From: <sip:[email protected]>;tag=1559707550
To: <sip:[email protected]>;tag=as5954ea77
Call-ID: [email protected]
CSeq: 302 INVITE
Server: IncrediblePBX-15.0.16.42.1(16.8.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Contact: <sip:[email protected]:5060>
P-Asserted-Identity: "701" <sip:[email protected]>
Content-Length: 0

------
<sip:INFO> 'udp:0.0.0.0:5060' received 534 bytes SIP message from 192.168.25.50:5060 [0156CBA8]
------
SIP/2.0 180 Ringing
Via: SIP/2.0/UDP 192.168.25.2:5060;branch=z9hG4bK2093931466;received=192.168.25.2;rport=5060
From: <sip:[email protected]>;tag=1559707550
To: <sip:[email protected]>;tag=as5954ea77
Call-ID: [email protected]
CSeq: 302 INVITE
Server: IncrediblePBX-15.0.16.42.1(16.8.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Contact: <sip:[email protected]:5060>
P-Asserted-Identity: "701" <sip:[email protected]>
Content-Length: 0

------
Call ringing: client/170
<sip:INFO> 'udp:0.0.0.0:5060' received 570 bytes SIP message from 192.168.25.50:5060 [0156CBA8]
------
OPTIONS sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.11.11:5060;branch=z9hG4bK12802a89;rport
Max-Forwards: 70
From: "Unknown" <sip:[email protected]>;tag=as4f4dc204
To: <sip:[email protected]:5060>
Contact: <sip:[email protected]:5060>
Call-ID: [email protected]:5060
CSeq: 102 OPTIONS
User-Agent: IncrediblePBX-15.0.16.42.1(16.8.0)
Date: Fri, 24 Jul 2020 18:52:16 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0

------
<sip:INFO> 'udp:0.0.0.0:5060' sending code 100 02CDCDF0 to 192.168.25.50:5060 [0156CBA8]
------
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 192.168.11.11:5060;branch=z9hG4bK12802a89;rport=5060;received=192.168.25.50
From: "Unknown" <sip:[email protected]>;tag=as4f4dc204
To: <sip:[email protected]:5060>
Call-ID: [email protected]:5060
CSeq: 102 OPTIONS
Server: YATE/5.4.0
Content-Length: 0

------
<sip:INFO> 'udp:0.0.0.0:5060' sending code 200 03E822F0 to 192.168.25.50:5060 [0156CBA8]
------
SIP/2.0 200 OK
Via: SIP/2.0/UDP 192.168.11.11:5060;branch=z9hG4bK12802a89;rport=5060;received=192.168.25.50
From: "Unknown" <sip:[email protected]>;tag=as4f4dc204
To: <sip:[email protected]:5060>;tag=1337390839
Call-ID: [email protected]:5060
CSeq: 102 OPTIONS
Server: YATE/5.4.0
Allow: ACK, INVITE, BYE, CANCEL, OPTIONS, INFO
Content-Length: 0

------
<sip:INFO> 'udp:0.0.0.0:5060' received 801 bytes SIP message from 192.168.25.50:5060 [0156CBA8]
------
SIP/2.0 200 OK
Via: SIP/2.0/UDP 192.168.25.2:5060;branch=z9hG4bK2093931466;received=192.168.25.2;rport=5060
From: <sip:[email protected]>;tag=1559707550
To: <sip:[email protected]>;tag=as5954ea77
Call-ID: [email protected]
CSeq: 302 INVITE
Server: IncrediblePBX-15.0.16.42.1(16.8.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Contact: <sip:[email protected]:5060>
P-Asserted-Identity: "701" <sip:[email protected]>
Content-Type: application/sdp
Content-Length: 239

v=0
o=root 698119683 698119683 IN IP4 192.168.11.11
s=Asterisk PBX 16.8.0
c=IN IP4 192.168.11.11
t=0 0
m=audio 18218 RTP/AVP 0 101
a=rtpmap:0 PCMU/8000
a=sendrecv
------
<sip:INFO> 'udp:0.0.0.0:5060' sending 'ACK sip:[email protected]:5060' 03DBD5B0 to 192.168.25.50:5060 [0156CBA8]
------
ACK sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.25.2:5060;rport;branch=z9hG4bK1571467992
From: <sip:[email protected]>;tag=1559707550
To: <sip:[email protected]>;tag=as5954ea77
Call-ID: [email protected]
CSeq: 302 ACK
Max-Forwards: 20
Contact: <sip:[email protected]:5060>
Authorization: Digest username="703", realm="asterisk", nonce="0098a38e", uri="sip:[email protected]", response="f5a365243062f9afe2410f6c3d5731d6", algorithm=MD5
User-Agent: YATE/5.4.0
Content-Length: 0

------
Call answered: client/170
<yrtp:WARN> Initial timeout in channel sip/170 wrapper [03DF2EF0]
<sip:INFO> 'udp:0.0.0.0:5060' received 586 bytes SIP message from 192.168.25.50:5060 [0156CBA8]
------
BYE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.11.11:5060;branch=z9hG4bK53a03c5f;rport
Max-Forwards: 70
From: <sip:[email protected]>;tag=as5954ea77
To: <sip:[email protected]>;tag=1559707550
Call-ID: [email protected]
CSeq: 102 BYE
User-Agent: IncrediblePBX-15.0.16.42.1(16.8.0)
Proxy-Authorization: Digest username="703", realm="asterisk", algorithm=MD5, uri="sip:192.168.25.50", nonce="0098a38e", response="1fd36633783e93160d732048976150d5"
X-Asterisk-HangupCause: Requested channel not available
X-Asterisk-HangupCauseCode: 44
Content-Length: 0

------
<sip:INFO> 'udp:0.0.0.0:5060' sending code 100 02E5BA88 to 192.168.25.50:5060 [0156CBA8]
------
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 192.168.11.11:5060;branch=z9hG4bK53a03c5f;rport=5060;received=192.168.25.50
From: <sip:[email protected]>;tag=as5954ea77
To: <sip:[email protected]>;tag=1559707550
Call-ID: [email protected]
CSeq: 102 BYE
Server: YATE/5.4.0
Content-Length: 0

------
<sip:INFO> 'udp:0.0.0.0:5060' sending code 200 03F50D48 to 192.168.25.50:5060 [0156CBA8]
------
SIP/2.0 200 OK
Via: SIP/2.0/UDP 192.168.11.11:5060;branch=z9hG4bK53a03c5f;rport=5060;received=192.168.25.50
From: <sip:[email protected]>;tag=as5954ea77
To: <sip:[email protected]>;tag=1559707550
Call-ID: [email protected]
CSeq: 102 BYE
P-RTP-Stat: PS=1552,OS=248320,PR=0,OR=0,PL=0
Server: YATE/5.4.0
Allow: ACK, INVITE, BYE, CANCEL, OPTIONS, INFO
Content-Length: 0

------
Call inactive: client/170
Hung up: client/170

 

[Eliad]

Hmm. I am not sure what you want to accomplish here. Why do you need a virtual IP for the PBX? The WAN IP on pfsense is it a 192.xx.xx.xx? I see your PBX lists a different public external IP?
I think you are overly complicating the firewall.
If your phones and the PBX are behind the same pfsense. The easiest way is to create a port forwarding from WAN to the PBX for UDP ports 5060-5069 and 10000-20000.
Set the firewall to conservative
Set up the outbound for static port.
I personally I migrated from Pfsense to Opnsense, they are similar but Opnsense forum is much friendly and the online documentation is better. Plus it allows for free to upload the firewall configuration to Google drive among other things.

 

[phonebuff]

Looks like you have NAT Transversal going on where 67.xxx.xxx.102 is NATed by something to 192.168.25.50 and then NATed to the 92.168.11.11. A great recipe for disaster if this is correct.

I agree with @Eliad in that all of your connections and your pfSense are way to complicated based on the little bit of design details you have supplied.

 

[shetu]

Looks like you have NAT Transversal going on where 67.xxx.xxx.102 is NATed by something to 192.168.25.50 and then NATed to the 92.168.11.11. A great recipe for disaster if this is correct.

I agree with @Eliad in that all of your connections and your pfSense are way to complicated based on the little bit of design details you have supplied.

I install pbx in flash on Esxi 6. Esxi management IP and Esxi vm lan IP are not same. So I need Pfsense VIP for pbx in flash. I try to change firewall settings.

 

[Halea]

Why don't you go back to basics and simply create a bridged network interface for your PBX VM.
Setup your pfsense dhcp server with the bridged nic mac address so that at each boot your PBX gets the same local ip address, which you can use with your phone registrations.
The only other thing you might need to do on your pfsense is to set outbound NAT to manual mode if you experience dropped calls. With pfsense you should be able to get this going in no time.

 

[shetu]

Why don't you go back to basics and simply create a bridged network interface for your PBX VM.
Setup your pfsense dhcp server with the bridged nic mac address so that at each boot your PBX gets the same local ip address, which you can use with your phone registrations.
The only other thing you might need to do on your pfsense is to set outbound NAT to manual mode if you experience dropped calls. With pfsense you should be able to get this going in no time.

Thanks Halea. I do this.