FOOD FOR THOUGHT Thoughts on remote office design

[MrBostn]

All,

Just looking for some thoughts on a design for a remote office. Management asked for phones for our new Dallas office.
Facts
1. HQ in Boston has an IncrediblePBX from years ago. 80 users, a PRI with DIDs. No sip trunks. Running virtualized on HyperV
2. New Remote office in Dallas 6 users, most of the time only 2 or 3 in, as the others travel
3. Offices are connected via IPSEC Site 2 Site (Dallas has Opnsense-Boston Sonicwall) 45ms ping time
4. Dallas has a fresh install of IncrediblePBX connected to Boston via IAX2 trunk for 4 digit dialing BUT Dallas is behind an BGW210-700 And this might pose issues as it doesn't have a true bridge mode. Lotta chatter about this on the webs.


I can
1. Setup the phones to registered to the HQ PBX-get make calls out the Boston PBX.
2 . Install Incredible in Vultr or something like service but I don't have experience with the clould pbx - I'd want to be able to dial each sides extension with 4 digits.

Any input is appreciated.
Thank you

 

[Halea]

At your Dallas office place a small IncrediblePBX-2021 behind the BGW210-700 (which by the way is an excellent VDSL router contrary to all the noise on the forums), either on bare metal or on a virtualizer of your choice. The hardware doesn't need to be anything substantial. A J4105 would largely do. You won't use the phone jacks on your BGW. Use your Boston based PBX to place your outbound calls. If your interconnect is not solid and stable enough to carry at least a dozen calls between Dallas and Boston then you have bigger problems than with your PBX setup.
The IAX2 link is quite easy and very stable to run between asterisk based PBXs. Encrypted tunneling or not should depend on your skill set and patience, but in terms of call security it makes little difference. (Phone trunk uplinks to providers, via sip or otherwise, are rarely encrypted)
You should be able to setup a test bench very rapidly and try out my suggestion. If you get the performance that you need then you can finalize the implementation. Otherwise you look for an alternate approach.

 

[MrBostn]

At your Dallas office place a small IncrediblePBX-2021 behind the BGW210-700 (which by the way is an excellent VDSL router contrary to all the noise on the forums), either on bare metal or on a virtualizer of your choice. The hardware doesn't need to be anything substantial. A J4105 would largely do. You won't use the phone jacks on your BGW. Use your Boston based PBX to place your outbound calls. If your interconnect is not solid and stable enough to carry at least a dozen calls between Dallas and Boston then you have bigger problems than with your PBX setup.
The IAX2 link is quite easy and very stable to run between asterisk based PBXs. Encrypted tunneling or not should depend on your skill set and patience, but in terms of call security it makes little difference. (Phone trunk uplinks to providers, via sip or otherwise, are rarely encrypted)
You should be able to setup a test bench very rapidly and try out my suggestion. If you get the performance that you need then you can finalize the implementation. Otherwise you look for an alternate approach.

Thank you. The IPSec connection is stable. Users at Dallas have been using it for RDP/Files located in Boston for a couple months without issue.

I've connected a small IncrediblePBX2021 to Boston via IAX2 seems good. Dialing extensions direct appear to work fine. Neither side overlaps. 13XX in Boston 51XX in Dallas.

Odd thing is I wanted Dallas to have their own SIP service-but I couldn't get either Telnyx or Voip.MS to register. Forums I checked seemed to blame the BGW since it wouldn't got into full bridge mode.

Thank you for taking the time to reply.

 

[Halea]

You can get BGW210-700 to be in pass through or bridge mode. The only tricky part is the MAC address setup and that's not really the BGW210's issue but rather the way the upstream is set (CPE account settings with provider). The MAC address maybe a provider assigned one in which case when setting the device in pass though mode it will be lost and you would need to enter it manually. You can actually find it out while you have an operational connection upstream. Note it down before attempting to change your BGW settings.

Then try the following to configure the BGW210-700:
1. Login to the BGW210-700's web-based configuration interface in your web browser (The default IP is 192.168.1.254 if my memory serves me well)
2. Go to the "Home Network" tab -> "WiFi" tab
3. Set Home SSID Enable to "Off"
4. Set Guest SSID Enable to "Off"
5. Set 2.4 GHz WiFi operation to "Off"
6. Set 5 GHz WiFi operation to "Off"
7. Go to the "Firewall" -> "Packet Filter" tab. Click on the "Disable Packet Filters" button.
8. Go to the "Firewall" -> "IP Passthrough" tab. Select "Passthrough" in the "Allocation Mode" option
9. Do not enter anything for the "Default Server Internal Address". Leave this field blank
10. In the "Passthrough Mode" selection choose "DHCPS-Fixed".
11. Type in the MAC address for the WAN under "Manual Entry". It should be in hexadecimal format xx:xx:xx:xx:xx:xx where each x is a numeral from 0 to 9 or letter from a to f, separated by colons.
12. The Passthrough DHCP Lease value defaults to 10 minutes and it's hard coded.
13. Click "Save" at the bottom. Go back and check to make sure that everything is as you want.
14. Click on the "Device" tab and select "Restart Device".
You should be done. The above steps are from my notes when I last helped a remote worker install one of those VDSL routers in her home office.

Once everything is up and running you should be able to also turn on the WiFi access point function, but due to nagging delay issues introduced by it you are better off keeping it turned off first.

 

[MrBostn]

Thank you for the detail. In June I setup the Dallas office. I recall your steps until 9. Maybe 10. For 10 I recall using the MAC of the OPNSense NIC.

The MAC-Am I correct that it should be of the OPNSense router/firewall?

Since I'm not in Dallas I really would need to be careful with these settings as remote access could be impacted by my actions.

 

[Halea]

If your ISP doesn't mandate a specific MAC address then you're correct, you will be using your router's WAN interface MAC address.
But, double check your "service parameters" sheet from your ISP. You might have your account tied into a specific MAC address without which you might not be able to get IP from the ISP's DHCP server.
If you don't see a specific MAC requirement, then your OPNSense router's WAN NIC MAC address is the right number to enter.

On a more general note you should not be doing this remotely. Your ISP gateway/router/firewal should be handled locally in all aspects unless you have qualified "eyes and hands" there working with you, AND you have a secondary Internet connection (like a wireless hotspot as a minimum) at that site.

 

[wardmundy]

@MrBostn: I'll preface this by saying we don't have real remote offices any more, but we do have remote locations with a handful of SIP phones. The Raspberry Pi 4 is perfect for these sites, and it's easy to build a plug-and-play backup microSD card for emergency use at these sites. The RasPi can handle the load you've proposed with ease. And it can do it all over WiFi even in double-NAT environments. Simply interconnect the RasPi platform to your main site with SIP or IAX, and you're good to go. We dial 0+number to reach main site ext or to use main site trunks. Give it a try. You won't be disappointed. GXV3370 below.

 

[krzykat]

Good advice as always from Mr. Mundy.

Two questions to Nerd Uno on the screenshot sent.. Account2 say's Groundwire (I can just assume that's a PJSIP that is also tied to your Groundwire account on mobile?). Also - why does your screen have "SMS" notification? I guess I'd assume your SMS integration with VoIP.MS you were working on?

 

[wardmundy]

1. Was testing Groundwire/PJSIP integration thru Android + cell instead of direct connection to Cloud server. Flawless.
2. SMS Android app actually handles SMS/MMS integration during VoIP.ms testing. Messaging works great in and out.

 

[MrBostn]

@MrBostn: I'll preface this by saying we don't have real remote offices any more, but we do have remote locations with a handful of SIP phones. The Raspberry Pi 4 is perfect for these sites, and it's easy to build a plug-and-play backup microSD card for emergency use at these sites. The RasPi can handle the load you've proposed with ease. And it can do it all over WiFi even in double-NAT environments. Simply interconnect the RasPi platform to your main site with SIP or IAX, and you're good to go. We dial 0+number to reach main site ext or to use main site trunks. Give it a try. You won't be disappointed. GXV3370 below.

Thank you Ward. I'll fire up a test install. This is such a noob question but do I/should I open or try to open firewall ports for the RasPi install? As you likely saw the two offices are connected via site to site vpn now. Its the local SIP registrations I'm thinking about.

Thanks

 

[wardmundy]

Local SIP registrations don't require a firewall hole. Similar to hitting web sites from your browser. Once there's a registration, IPtables will automatically open a return path. For registering your servers with each other, simply whitelist the IP addresses or VPN addresses on both ends.

 

[MrBostn]

Just to circle back. hoping to stay with my HyperV setup of IncrediblePBX2021 I removed all my silly port forwards, NAT rules then removed and added trunks and now my voip.ms trunk registered.

I now have my desired direct dialing between offices, and a local outbound trunk for the users in Dallas.

Thank you everyone for the replies.

 

[Brianmac]

Been following this discussion....and I'm a 7 year Newbie, so I could be wrong(and usually am!) and I defer to Ward and his elite members on this board...

Depending on your time-frame and ability to do...

You already have an old iPBX setup for headquarters, so your phones and all are already sip capable. Why not look into moving the HQ office to a test hosted current stable iPBX. The phones more than likely have multiple accounts, so you could forward to test DiD's. If you get that working and port away from PRI, now adding Dallas is easy and no need to worry about VPN, IAX2, etc...
This also opens up if you plan to open more offices down the road. Will make it a lot easier and eliminated hardware responsibilities onsite...

Something to think about, with an old iPBX, that you will have to deal with at some point anyway...

Just my two cents... Good Luck!
Brian

 

[MrBostn]

HI all,
I went with a run of the mill setup. Virtualized (HyperV) Incrediblepbx in Dallas. Connected over IPsec VPN via IAX2. direct dialing between offices using a prefix.

the IPsec VPN was needed with or without the pbx-the file server is sitting at HQ.

Dallas phones are Poly's (can't get used to that name) VVX 250s. They sound is great.

I will not rid our company of the PRI. IMO there is not enough upside to moving from the consistent quality. The execs would be upset if calls sound like cell phones or there was a hiccup during an earnings call.

Dallas is using VOIP.ms. No DIDs basically a single DID coming into an IVR with prompts to connect to an extension.

Majority of the calls are outgoing and they're not in the office every day. Heck many times its empty.

BTW I just swapped out our execs at HQ from old Snom 710s to the Poly VVX250 That bought me a lot of "goodwill" They love them. Feel good, sound good. Easy to setup

 

[krzykat]

I know you've got the PRI's and for your setup, sounds like the right play. Have the users commented though in inter-office calls (Depending on Codecs selected) - as they should have much better sound quality now.

 

[MrBostn]

I know you've got the PRI's and for your setup, sounds like the right play. Have the users commented though in inter-office calls (Depending on Codecs selected) - as they should have much better sound quality now.

Nobody has mentioned interoffice calls-But Boston execs said calls (they mean outside) are far superior to the Snom. (They hated that name snom, as they do yealink)

 

[MrBostn]

Heres my source for VVX250s (hes sold out now though)

Polycom Plantronics VVX 250 VOIP Business Media Phone 2200-48820-025 | eBay

Find many great new & used options and get the best deals for Polycom Plantronics VVX 250 VOIP Business Media Phone 2200-48820-025 at the best online prices at eBay! Free shipping for many products!

www.ebay.com