[NAT Troubles] - Two Asterisk PBXs behind the same public IP

Asterisk Asterisk General
1

Hi everybody,
I need your help to undersand how can I solve what, in my opinion, is a NAT problem.
This is my configuration:

VoIP Provider <–> Asterisk 11.5.x + A2Billing server <–> PBX A + PBX B (each one Asterisk 1.8.x)

I can act without problems everywhere except on VoIP provider systems (I’ve to ask what I need and they say me if it’s possible or not…)
PBX A and PBX B are on the same network behind the same firewall and the same router + public IP (I’ve only one public IP so I had to NAT my PBXs).

THE PROBLEM: I’ve a SIP trunk open from the PBX A to the A2Billing server for a geographical number A and another trunk open (obviusly with different credentials) from the PBX B to the A2Billing server for a geographical number B. When I call number A from a cell phone, the call arrive to PBX A. When I call number B from a cell phone, the call still arrive to PBX A! And obviusly, here I don’t have an inbound route for that number… so the call fail and I ear ss-noservice audio file.

If I launch netstat-nat -n on my firewall I see:

udp 192.168.1.7:5060 theIPofA2BillingServer:5060 ASSURED udp 192.168.1.9:5060 theIPofA2BillingServer:5060 ASSURED

Some configurations… Some of my A2Billing VoIP settings are:

qualify=yes
type=friend
host=dynamic
nat=comedia
canreinvite=yes

Some of my PBX config :

type=peer
trustrpid=yes
sendrpid=yes
qualify=yes
port=5060
nat=yes
maxexpirey=3600
insecure=invite,port
canreinvite=yes

In my firewall iptables I have:

-A PREROUTING -i eth0 -p udp -m multiport --dports 5060:5070 -j DNAT --to-destination 192.168.1.9
-A PREROUTING -i eth0 -p udp -m multiport --dports 10000:20000 -j DNAT --to-destination 192.168.1.9
-A FORWARD -d 192.168.1.9/32 -i eth0 -o eth1 -j fwd_wanlan_pbx
-A fwd_wanlan_pbx -p udp -m multiport --dports 5060:5070 -j ACCEPT
-A fwd_wanlan_pbx -p udp -m multiport --dports 10000:20000 -j ACCEPT

where 192.168.1.9 is PBX A. Do you think I need some modify for PBX B (192.168.1.7)?
How do you think I can solve this problem? Thank you so much!

2

You need to distinct the signalling (SIP) as well as the RTP ports used ny the Asterisk-servers behind the same IP-Adress.
Your firewall actully delivers all SIP/RTP-traffic to server A.
to avoid this, change server B e.g to bindport 5062 and set up the rtp-range in Server A to start 10000
and stop 15000 as well as on server B from 15001 to 20000.
Afterwards Your firewall config may look like

-A PREROUTING -i eth0 -p udp -m multiport --dports 5060:5061 -j DNAT --to-destination 192.168.1.9
-A PREROUTING -i eth0 -p udp -m multiport --dports 10000:15000 -j DNAT --to-destination 192.168.1.9
-A FORWARD -d 192.168.1.9/32 -i eth0 -o eth1 -j fwd_wanlan_pbx
-A PREROUTING -i eth0 -p udp -m multiport --dports 5062:5063 -j DNAT --to-destination 192.168.1.7
-A PREROUTING -i eth0 -p udp -m multiport --dports 15001:20000 -j DNAT --to-destination 192.168.1.7
-A FORWARD -d 192.168.1.7/32 -i eth0 -o eth1 -j fwd_wanlan_pbx
-A fwd_wanlan_pbx -p udp -m multiport --dports 5060:5063 -j ACCEPT
-A fwd_wanlan_pbx -p udp -m multiport --dports 10000:20000 -j ACCEPT