QUESTION stun server

[ariban]

hi
i recently moved and i connect back to my office (different state) using openvpn on pfsense firewall (both ends use this firewall)

i can get into my pbx GUI with no issue, and i can see my entire network back at the office, and sometimes my phones work. but most of them don't and i get an error unreachable in the reports.
after reading online, i think i need to setup a stun server. but how is that done?
any better advice?

 

[tbrummell]

More info would be helpful. iPBX version? Have you modified IPtables to allow the remote subnet? Did you add the remote subnet to SIP settings (assuming iPBX, or anything FreePBX based). Using a Stun at this point will probably make your day worse, again, assuming the pbx is on the local office subnet and not a cloud based one.

 

[Eliad]

hi
i recently moved and i connect back to my office (different state) using openvpn on pfsense firewall (both ends use this firewall)

i can get into my pbx GUI with no issue, and i can see my entire network back at the office, and sometimes my phones work. but most of them don't and i get an error unreachable in the reports.
after reading online, i think i need to setup a stun server. but how is that done?
any better advice?

sounds to me your firewall is interfering. we need more information on the configuration, where are the phones, where is the pbx?

 

[ariban]

hi sorry for not giving info

my firewall is pfsense both at the server (dedicated fiber and dedicated server for the pbx) and at my hawaii home (running a business internet line).
i setup incrediblepbx 16 http://nerdvittles.com/?p=30642

i did ./add-ip ..... for my public IP for the pbx server at las vegas location
i did that again for my remote public IP in hawaii
in the gui sip settings, i added my remote lan IP 192.168.2.0/24 as a local subnet
i also added the tunnel subnet 10.0.1.0/30 as a local subnet
my main lan back at the server is 192.168.1.0/24

i moved to Hawaii and these issues started happening. before moving here, i was in las vegas and the main office is in las vegas, but i had remote phones at home and at my parents home and they were working fine. its only after i moved here to hawaii.

any advance on what this can be?

 

[Eliad]

I think this is related to the 2 pfsense firewalls. I have a similar setup with 2 opnsense firewalls(a derivative of pfsense).
I had to install sipproxd on the remote opsense firewall which had the phones behind.
This works for the Chan_SIP configuration.
Also, in the PBX you have to make sure each extension under advanced tab has the NAT enabled.

 

[tbrummell]

I don't like @Eliad response, so I'm going to dice this up a little more.

As for as the network goes:

(Local) .1.0/24<-->pfSense<-->INTERNET<-->pfSense<-->.2.0/24 (Remote)
OpenVPN Server & Client running on pfSense, correct?
PBX is in the .1.0/24 subnet

This looks all well and good, and really simple. But, how did your parents house fit in to this?

So far, does this look correct on paper?

 

[ostridge]

i think i need to setup a stun server

There are lots of public stun servers that your servers and clients (phones) can use to get their public IP address; There is a long list of on Git Hub stun servers list also you may like to note the address of the Google stun server see below; reliability of google it seems should be assured.

stun1.l.google.com:19302
## alternatives to this are (stun1 to stun4 ) thus  Note the 'l' is a 'lower case L'
stun2.l.google.com:19302
stun3.l.google.com:19302
stun4.l.google.com:19302

 

[ariban]

I don't like @Eliad response, so I'm going to dice this up a little more.

As for as the network goes:

(Local) .1.0/24<-->pfSense<-->INTERNET<-->pfSense<-->.2.0/24 (Remote)
OpenVPN Server & Client running on pfSense, correct?
PBX is in the .1.0/24 subnet

This looks all well and good, and really simple. But, how did your parents house fit in to this?

So far, does this look correct on paper?

yes you are correct. my parents house use to be connected, not anymore. you can ignore that part. the rest yes you are correct. what is the best solution for my case?

 

[ariban]

There are lots of public stun servers that your servers and clients (phones) can use to get their public IP address; There is a long list of on Git Hub stun servers list also you may like to note the address of the Google stun server see below; reliability of google it seems should be assured.

stun1.l.google.com:19302
## alternatives to this are (stun1 to stun4 ) thus  Note the 'l' is a 'lower case L'
stun2.l.google.com:19302
stun3.l.google.com:19302
stun4.l.google.com:19302

i simply put the stun1.l.google.com in stun server and using port 19302 in the pbx and on phones? that is all i do?

 

[jerrm]

stun shouldn't be needed over a VPN. Is the VPN routing or natting the home network? What IP are the phones attempting to connect to - public or private?

 

[tbrummell]

^^^^^what he said

 

[tbrummell]

From home to work, you can ping/access stuff in the .1.0/24 subnet, correct? From home to work, can you access the iPBX GUI? When a phone, at home, attempts to connect to the PBX, what does the Asterisk CLI report?

 

[ariban]

phones are trying to connect to the private IP of the pbx server. i don't know if the VPN is routing or natting, as i just followed a tutorial.
it does ping / access EVERYTHING on 1.0/24 subnet
yes i can access PBX GUI, under asterisk logfile i see this


14922[2021-01-19 14:03:57] NOTICE[2067] chan_sip.c: Peer '703' is now Reachable. (80ms / 2000ms)
14923[2021-01-19 14:03:57] NOTICE[2067] chan_sip.c: Peer '703' is now Reachable. (80ms / 2000ms)
14924[2021-01-19 14:05:45] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14925[2021-01-19 14:05:45] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14926[2021-01-19 14:05:45] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14927[2021-01-19 14:05:45] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14928[2021-01-19 14:05:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14929[2021-01-19 14:05:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14930[2021-01-19 14:05:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060
14931[2021-01-19 14:05:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060
14932[2021-01-19 14:08:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14933[2021-01-19 14:08:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14934[2021-01-19 14:08:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14935[2021-01-19 14:08:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14936[2021-01-19 14:08:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14937[2021-01-19 14:08:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14938[2021-01-19 14:08:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060
14939[2021-01-19 14:08:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060
14940[2021-01-19 14:08:46] NOTICE[2067] chan_sip.c: Peer '713' is now Reachable. (80ms / 2000ms)
14941[2021-01-19 14:08:46] NOTICE[2067] chan_sip.c: Peer '713' is now Reachable. (80ms / 2000ms)
14942[2021-01-19 14:08:46] NOTICE[2067] chan_sip.c: Peer '710' is now Reachable. (85ms / 2000ms)
14943[2021-01-19 14:08:46] NOTICE[2067] chan_sip.c: Peer '710' is now Reachable. (85ms / 2000ms)
14944[2021-01-19 14:11:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14945[2021-01-19 14:11:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14946[2021-01-19 14:11:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14947[2021-01-19 14:11:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14948[2021-01-19 14:11:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14949[2021-01-19 14:11:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14950[2021-01-19 14:11:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060
14951[2021-01-19 14:11:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060
14952[2021-01-19 14:12:01] NOTICE[2067] chan_sip.c: Peer '703' is now UNREACHABLE! Last qualify: 81
14953[2021-01-19 14:12:01] NOTICE[2067] chan_sip.c: Peer '703' is now UNREACHABLE! Last qualify: 81
14954[2021-01-19 14:12:05] NOTICE[2067] chan_sip.c: Peer '702' is now UNREACHABLE! Last qualify: 89
14955[2021-01-19 14:12:05] NOTICE[2067] chan_sip.c: Peer '702' is now UNREACHABLE! Last qualify: 89
14956[2021-01-19 14:12:15] NOTICE[2067] chan_sip.c: Peer '702' is now Reachable. (90ms / 2000ms)
14957[2021-01-19 14:12:15] NOTICE[2067] chan_sip.c: Peer '702' is now Reachable. (90ms / 2000ms)
14958[2021-01-19 14:13:14] NOTICE[2067] chan_sip.c: Peer '704' is now UNREACHABLE! Last qualify: 86
14959[2021-01-19 14:13:14] NOTICE[2067] chan_sip.c: Peer '704' is now UNREACHABLE! Last qualify: 86
14960[2021-01-19 14:13:19] NOTICE[2067] chan_sip.c: Peer '702' is now UNREACHABLE! Last qualify: 90
14961[2021-01-19 14:13:19] NOTICE[2067] chan_sip.c: Peer '702' is now UNREACHABLE! Last qualify: 90
14962[2021-01-19 14:13:24] NOTICE[2067] chan_sip.c: Peer '704' is now Reachable. (93ms / 2000ms)
14963[2021-01-19 14:13:24] NOTICE[2067] chan_sip.c: Peer '704' is now Reachable. (93ms / 2000ms)
14964[2021-01-19 14:14:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14965[2021-01-19 14:14:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14966[2021-01-19 14:14:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14967[2021-01-19 14:14:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14968[2021-01-19 14:14:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14969[2021-01-19 14:14:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14970[2021-01-19 14:14:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060
14971[2021-01-19 14:14:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060
14972[2021-01-19 14:16:55] NOTICE[2067] chan_sip.c: Peer '703' is now Reachable. (80ms / 2000ms)
14973[2021-01-19 14:16:55] NOTICE[2067] chan_sip.c: Peer '703' is now Reachable. (80ms / 2000ms)
14974[2021-01-19 14:17:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14975[2021-01-19 14:17:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '713'
14976[2021-01-19 14:17:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14977[2021-01-19 14:17:46] VERBOSE[2067] chan_sip.c: Unregistered SIP '710'
14978[2021-01-19 14:17:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14979[2021-01-19 14:17:46] VERBOSE[2067] chan_sip.c: Registered SIP '713' at 192.168.2.22:5060
14980[2021-01-19 14:17:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060
14981[2021-01-19 14:17:46] VERBOSE[2067] chan_sip.c: Registered SIP '710' at 192.168.2.22:5060

 

[ariban]

i did put in the stun google server, i will remove it, it helped to get some phones registered but then they unregistered even with stun.

 

[tbrummell]

That looks promising. If you ping a device on the .1 subnet with the -t option and let it run, do any of the pings time out?

 

[tbrummell]

Are 710 & 713 on the same device?

 

[ariban]

the pings dont time out, they are good and finalize well
710 and 713 is same device
but its also other devices that go down or don't even register.

 

[ariban]

when i said they are good and finalize well i mean they keep on running and never end

 

[tbrummell]

That's good, I wanted to make sure the tunnel was staying up, and it appears it is. The timeout looks like it is at exactly 3 minutes, so on the device I'd look for a keepalive or register timer, and drop it, to keep the phone registered.
Once you figure out the issue with 710/713, we can work on the other(s).

 

[ariban]

i will try the keep alive with all phones, let me see if that fixes them