MiddleEast SIP Block - Remote Worker Solution Needed

[sheraz14]

Hi,
so I have a friend in the Middle East and in his country SIP is blocked and prohibited. Also, ISPs are not allowed to give Public IP neither they do port forwarding in their Internet Router
He has incrediablepbx integrated with GoIP (SIM Gateways) and a couple of Astra Phones in his office. Now he wants his workers to work from home and want them to use this Astra phone from their home or different location.
Since there is no public IP assigned to his router neither Port forwarding is allowed then in such a scenario what would be the best solution?

Is anyone where who managed to find a workaround for the same?

 

[krzykat]

I have experience in the middle east. Which country?

 

[sheraz14]

Qatar
so what is best to make it work?

 

[krzykat]

Yes, spent some time in Qatar. I don't know the current law there now, but some of the ME countries allow for "IN-COUNTRY" VoIP. You must do paperwork, etc., but if you're only using internal, no international, you may get away with it. Other options - for example, I have an employee in Cairo that is similar, is to have a VPN that gets around the DPI, then use the VPN to interconnect. Another potential option is to change ports (DPI can usually sniff this out), not sure who they're using for the DPI portion now. Another could be to try to use IAX2. Which methods have you attempted?

 

[atsak]

Not that I would suggest breaking telecom regulations is advisable, but one could build a hosted server somewhere outside the country, connect the phone via Open VPN using a router that supports it (AAstra's don't have it built in, Yealink and I think Snom do) to that outside server, then another OpenVPN connection from the in country PBX to the outside one, and then trunk from the one outside to inside via the OpenVPN connection there for outbound / inbound calls?

 

[sheraz14]

Hello @astsak and @krzykat
so this is what I thinking to go with
have an OpenVPN server on the cloud and buy one internet router that supports OpenVPN client connection
Configure Firewall Rules to allow OpenVPN Sebnet to communicate with internal LAN

I've Found Asus Routers that support OpenVPN client but they are kind an expensive
does anyone know a router at a reasonable price?

 

[jerrm]

These make good VPN "shims" for lower bandwidth needs. They're not going to handle 4K streaming, but are fine for voice.

Also, as mention in the FreePBX forums, a cloud instance of FreePBX for clients to connect to, with a trunk to the local PBX could avoid need for vpns on the clients. Depends on how much DPI big brother is doing.

 

[Eliad]

For the router you could use an old computer to which you need to add a LAN card if you cant find one with 2 LAN ports build in. Then you could load PFSENSE or OPNSENSE or OPEN WRT. All those OS have OpenVPN
Another option is to find a router which allows you to load DD-WRT which also have have OpenVPN. Search DD-WRT database to find which ones are compatible with it.

 

[phonebuff]

These make good VPN "shims" for lower bandwidth needs. They're not going to handle 4K streaming, but are fine for voice.

Also, as mention in the FreePBX forums, a cloud instance of FreePBX for clients to connect to, with a trunk to the local PBX could avoid need for vpns on the clients. Depends on how much DPI big brother is doing.

Have you actually used them through your phones hotspot ?

 

[jerrm]

Have you actually used them through your phones hotspot ?

Mobile phone hotspot? No.

 

[atsak]

Hello @astsak and @krzykat
so this is what I thinking to go with
have an OpenVPN server on the cloud and buy one internet router that supports OpenVPN client connection
Configure Firewall Rules to allow OpenVPN Sebnet to communicate with internal LAN

I've Found Asus Routers that support OpenVPN client but they are kind an expensive
does anyone know a router at a reasonable price?

Don't cheap out on the router. VPN encryption requires a little CPU to push (though not much given the low traffic volumes for VOIP). However, any router which supports DDWRT, just flash it to use the -vpn firmware.

 

[krzykat]

Hello @astsak and @krzykat
so this is what I thinking to go with
have an OpenVPN server on the cloud and buy one internet router that supports OpenVPN client connection
Configure Firewall Rules to allow OpenVPN Sebnet to communicate with internal LAN

I've Found Asus Routers that support OpenVPN client but they are kind an expensive
does anyone know a router at a reasonable price?

Verify you can use OpenVPN ... I know its blocked in Egypt and KSA, while it works in Kuwait.
My goto router for things like that would be an ERx though. Lots of power, and a nice price/performance ratio.

 

[ostridge]

Is anyone where who managed to find a workaround for the same?

I knowing nothing about ME interweb nor the Censorship methods. But I am aware that there is an initiave with regards to avoidance of 'censorhhip by China', and called GFW or the great firewall of china. There are lots of links under GFW including this one -
How To Easily Install Trojan GFW on Ubuntu - A Step by Step Tutorial
therein is some reference to
" v2ray supports TCP and UDP (Skype, WhatsApp etc calls), whereas trojan GFW supports only TCP "

And there is a link to install of:
How To Setup v2ray Websocket(WS)+TLS+CDN on a VPS

I have not read those documents in full but I noticed that the Trojan one gives some pertinent privacy tip on Choosing a VPS, and which types of service to prefer.

If you get stuck you may want to explore these.
Good Luck

 

[krzykat]

You'd be surprised at how well adapted they are at using DPI to locate things they want blocked and block them. Yes - China is a very difficult one.

 

[Halea]

@sheraz14 : I think you'll be doing a huge disservice to your "friend" in Qatar by suggesting him or setting him up to use an International VPN to bypass the country's ban on voip.

Countries which setup such restrictions also have the technical savvy and technological sophistication to enforce their regulations and often use them for fishing expeditions to catch the "unruly" citizens of their countries.

If you think that Qatar is a small country therefore they don't know how to sniff VPN connections then remember that they have deep pockets and many private companies in the rest of the "technologically advanced" world are ready to sell their services for the right price, after all they already setup their networks in the first place.

It takes about 1.5 seconds to detect a VPN access to a commercial provider for a carrier, it would take at best 2 seconds to detect if the VPN is on your "private" VPS. Also note that countries with any kind of ban on internet connectivity also outlaw data encryption. I didn't check but I'll bet you Qatar also bans encrypted communications of any sort.

Your safest alternative is to try to setup a branch office in a Qatari international trade zone, where such restrictions do not exist. There you can host your VPN without breaking the laws of the country, have your international connectivity unobstructed, use international phone carriers to your heart's content and have your employees legitimately access those services from their homes.

You might think that this is like using a sledgehammer approach where a simple household tool is needed, but then remember that in such countries people spend years in prison for those "offenses" that we consider a God given right in the western world.

 

[sheraz14]

Thank you guys for all your suggestions
I will re-visit the plan and will share if any of the ideas worked.