SOLVED PBX ignoring SYN request

[cantVOIP]

I've setup IncrediblePBX using PJSIP 5061, used my own Let's Encrypt certificate to allow TLS SIP and SRTP.
I've tested inbound and outbound encrypted calls using an ATA. It works great.

I am trying to use a cloud SIP from Twilio. I configured my Twilio account and PBX to communicate and establish SIP connection to my Twilio number. I am able to place encrypted Outbound calls. However, inbound calls are failing. I narrowed it down to the PBX not responding to the Twilio account when a call comes in. Both my twilio debug logs and my pfSense point that the issue is PBX not responding. Check the attached image.

Again, inbounds work great with my ATA which exists under the same lan as my PBX. Any ideas as to why the PBX is rejecting the connection? Something else to add is that the incoming call does not register anything on the Asterisk Log section of the PBX at all.

 

[wardmundy]

Sounds like a firewall issue. Are Twilio IP addresses whitelisted with add-ip or add-fqdn?

 

[cantVOIP]

I agree, it has to do with a NAT configuration. I'm currently trying to find how to fix my settings. Twilio's IPs are allowed to my firewall using ports 5061, and 10,000-20,000

I've followed official netgate instructions for NAT, however, there's still an issue.

pfSense® software Configuration Recipes — Configuring NAT for a VoIP PBX | pfSense Documentation

docs.netgate.com

 

[wardmundy]

Are IP's whitelisted in BOTH your pfSense AND Incredible PBX firewalls??

 

[cantVOIP]

Only on pfSense. Under which tab can I find the PBX firewall? I am running the latest 2021 version

 

[kenn10]

You log in as root and at the Linux prompt run ./add-ip for each IP address.

 

[cantVOIP]

You log in as root and at the Linux prompt run ./add-ip for each IP address.

That is exactly what the problem was. I needed to allow Twilio's SIP ips to Incredible PBX's firewall. Thank you so much for the help!

 

[cantVOIP]

You log in as root and at the Linux prompt run ./add-ip for each IP address.

One other thing. Do I need to run ./add-ip VLAN2 192.168.2.0/24 if I want to allow phones from another VLAN to register on my PBX?

I've added my local networks under the GUI SIP Settings, but phones on the secondary VLAN are not able to reach the PBX.

Note: It's not a network issue. Same scenario is already on production with an older IncrediblePBX I inherited. Using the same VLANs and the same phone.

 

[kenn10]

Do I need to run ./add-ip VLAN2 192.168.2.0/24

I'd say so. Only your original LAN address would have been whitelisted in the PBX firewall. However, you'll probably have to edit the /usr/local/sbin/iptables-custom to get the whole subnet whitelisted. After manually editing the file, you'll need to run iptables-restart to load in the new values. Actually, the add-ip command does handle the /24.

 

[cantVOIP]

Interesting. I ran the command for the local network, restarted ip tables, changed some aliases in the firewall rules and it worked. Not sure what did the trick. I'm going to have to replicate further if you are saying that /24 is not handled by the add-ip

 

[kenn10]

Interesting. I ran the command for the local network, restarted ip tables, changed some aliases in the firewall rules and it worked. Not sure what did the trick. I'm going to have to replicate further if you are saying that /24 is not handled by the add-ip

I tested it and it did add the /24 when I tried that with add-ip.

 

[ext-104]

Unless something changed?

>>By default, Incredible PBX whitelists all of the non-routable LAN subnets including 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16

192.168.0.0/16 = FIRST USABLE IP 192.168.0.1 - LAST USABLE IP 192.168.255.254

 

[Samot]

One other thing. Do I need to run ./add-ip VLAN2 192.168.2.0/24 if I want to allow phones from another VLAN to register on my PBX?

I've added my local networks under the GUI SIP Settings, but phones on the secondary VLAN are not able to reach the PBX.

Note: It's not a network issue. Same scenario is already on production with an older IncrediblePBX I inherited. Using the same VLANs and the same phone.

Have you confirmed there is inter-vlan routing between the vlans? VLANs shouldn't communicate with each other without some sort of routing between them.