TIPS Remote Extension Incredible PBX 2027 D

[spr41178]

A very good morning to all of you,

I have set up a rasberry pi 4b with an Incredible PBX instance.
Seems operational apart for a few glitches that i will post in another thread.

Can someone point to me how to approach the method to enable a remote extension preferably TLS back to the PBX?

I have a Mikrotik Cloud active DDNS and not a static IP.

The application i use is a paid version of Acrobits Groundwire.

On my other FreePBX Distro machine i have added a TLS transport via a different port and port forwarded that TCP port and RTP ports and it works in conjuction with the Responsive Firewall.

Since there is no Responsive firewall here how can i do it? Is the Public Facing guide going to do the trick for me and if so is the 2022 version compatible?
Any tips i should follow as well as the guide?

Thanks for your time

 

[spr41178]

Anybody?

 

[spr41178]

Adding /root/add-ip user and my mobile phone provider ip gives me access but the ip wiill change.

How to overcome the dynamic change of the mobile phone provider?

 

[Halea]

The easiest way would be to activate the openvpn server on your incrediblepbx server and channel all your mobile phone traffic through it, which will also include your acrobits groundwire communication.

All traffic in and out would be encrypted and will go through the network where your PBX is based, which I assume is already protected by a gateway/router/firewall to the internet.
(I'm assuming that your Raspberry Pi is not directly connected to the Internet with a public IP, static or dynamic!)

The fact that you have no static public IP on your network is not an impediment for openvpn and/or most other VPN solutions out there nowadays. That said my personal preference is to run the VPN server on the Internet router rather than on the PBX box, which can easily be done if you have a software based router such as pfSense or opnSense for instance.

 

[spr41178]

The easiest way would be to activate the openvpn server on your incrediblepbx server and channel all your mobile phone traffic through it, which will also include your acrobits groundwire communication.

All traffic in and out would be encrypted and will go through the network where your PBX is based, which I assume is already protected by a gateway/router/firewall to the internet.
(I'm assuming that your Raspberry Pi is not directly connected to the Internet with a public IP, static or dynamic!)

The fact that you have no static public IP on your network is not an impediment for openvpn and/or most other VPN solutions out there nowadays. That said my personal preference is to run the VPN server on the Internet router rather than on the PBX box, which can easily be done if you have a software based router such as pfSense or opnSense for instance.

would be ok for one phone which i have done in the past via mikrotik openvpn, had issues where on IOS the openvpn would disconnect and i would miss calls, if i have to do this for more than one phones and keep track of certificates and if the phone keeps connected all the time is too time consuming. Was expecting something easier like FreePBX Distro has on the Responsive Firewall side via FQDN and diferent ports

 

[kenn10]

Or find a DNS updater app for your phone and set up a DNS name just for your phone. Use /root/add-fqdn to add your newly created DNS for your phone. There should be cron job on the PBX that updates the whitelist every five minutes or so.

 

[wardmundy]

Adding /root/add-ip user and my mobile phone provider ip gives me access but the ip wiill change.

How to overcome the dynamic change of the mobile phone provider?

That's what the add-fqdn option is for. In conjunction with the ipchecker app already activated in /etc/crontab, it keeps your whitelist up to date as long as you use a dynamic DNS service to automatically update the IP address associated with the FQDN for each of your extensions and your server..

 

[dicko]

Be aware that phones not on wifi very rarely have a routeable IPv4 address (CGNAT et al)

 

[spr41178]

Or find a DNS updater app for your phone and set up a DNS name just for your phone. Use /root/add-fqdn to add your newly created DNS for your phone. There should be cron job on the PBX that updates the whitelist every five minutes or so.

Great idea, got close with the Dynu app on IOS. I whitelisted my fqdn and it worked but it doesn't auto refresh wifi to carrier and carrier to wifi i have to manually do it, posted a message to them but doubt they will reply.

 

[spr41178]

That's what the add-fqdn option is for. In conjunction with the ipchecker app already activated in /etc/crontab, it keeps your whitelist up to date as long as you use a dynamic DNS service to automatically update the IP address associated with the FQDN for each of your extensions and your server..

This scenario works if i am stationed in an office and i have fqdn updater on a pc running the job for me whilst translating that public ip for me (office router).
My problem is what happens when i go out of the Office via MOBILE TELEPHONE VODAFONE.

 

[wardmundy]

This scenario works if i am stationed in an office and i have fqdn updater on a pc running the job for me whilst translating that public ip for me (office router).
My problem is what happens when i go out of the Office via MOBILE TELEPHONE VODAFONE.

Groundwire for Android & iOS: The Best $10 You’ll Ever Spend – Nerd Vittles

nerdvittles.com

 

[spr41178]

Groundwire for Android & iOS: The Best $10 You’ll Ever Spend – Nerd Vittles

nerdvittles.com

Thank you for your time wardmundy, will this work for the 2027 Debian version which i have installed?

 

[wardmundy]

Absolutely.

 

[spr41178]

Absolutely.

Wll give it a try in the weekend and report back to you, thank you

 

[spr41178]

Absolutely.

Began the process but getting errors,

./blockem.sh: line 10: /usr/sbin/ipset: No such file or directory
./blockem.sh: line 10: /usr/sbin/ipset: No such file or directory
./blockem.sh: line 10: /usr/sbin/ipset: No such file or directory
./blockem.sh: line 10: /usr/sbin/ipset: No such file or directory
./blockem.sh: line 10: /usr/sbin/ipset: No such file or directory
./blockem.sh: line 10: /usr/sbin/ipset: No such file or directory
./blockem.sh: line 10: /usr/sbin/ipset: No such file or directory
./blockem.sh: line 46: /usr/sbin/ipset: No such file or directory
./blockem.sh: line 47: /usr/sbin/ipset: No such file or directory
ln: failed to create symbolic link '/usr/sbin/iptables': File exists

 

[spr41178]

Tried following through, used an extension that the procedure asked me, i can register locally but not remotelly remotelly meaning via acrobits and via vodafone carrie, it keeps trying. Locally via WiFi it works

 

[spr41178]

Still nothing achieved, any help would be appreciated regarding ward mundys Public 2020 tutorial to work on the 2027-D setup, i am getting the above errors plus when i complete the tutorial i never seem to accomplish a remote connection via mobile phone carrier. Works on my local network.

 

[Samot]

Still nothing achieved, any help would be appreciated regarding ward mundys Public 2020 tutorial to work on the 2027-D setup, i am getting the above errors plus when i complete the tutorial i never seem to accomplish a remote connection via mobile phone carrier. Works on my local network.

You don't have ipset installed on the system. As for the failure of the symlink creation...not sure why there is a symlink being created but it can't because it already exists where the link is trying to be made.

 

[wardmundy]

The PUBLIC design really wasn't engineered for a Raspberry Pi. Server exposure on the public internet with a static IP address is the target audience for this deployment. The design was intended for use on KVM (non-OpenVZ) cloud platforms, i.e. those that support ipset and do not employ a shared kernel. See the Wiki for recommended KVM cloud platforms. In your situation, the best option is a phone that supports OpenVPN.