Yet another Asterisk-Behind-NAT issue

Asterisk: 1.8.15 on CentOS 5.8
FreePBX: 2.10.1.9

I think I’ve figured out what I need to do but I’m asking if I can get my plans reviewed here for obvious problems that I didn’t think of. Most Asterisk-behind-NAT posts I’ve seen deal with the server behind NAT; my problem is the clients behind NAT connecting to a static-public-IP server.

The PBX server is located at Location A (actually about 18 inches of to my right). It has been running successfully for weeks now, with several Grandstream GXP1400 extension phones installed here in the building on the LAN (i.e. no routers or firewalls in the way). The PBX is on the main router’s DMZ so it is visible to the Internet on the main router’s static IP. The PBX has its own firewall (Linux iptables) with the following ports opened:

2727 / tcp (this one is MGCP… do I need it?)
5004-5082 / tcp & udp (do I really need this many opened & both tcp and udp?)
10000-20000 / tcp & udp (thought I needed utp only but one of the Digium forums says open both)

This installation is SIP only, no IAX or anything else.

The Asterisk sip_general_additional.conf file includes:
nat=yes
externip=PBX.EXTERN.IP.ADDRESS
localnet=192.168.100.0/255.255.255.0

One can certainly understand the case where phones work on the PBX’s LAN but not outside. However there are several people with X-Lite softphones installed in their homes behind NAT routers that also connect just fine… they downloaded X-Lite and configured it like I told them to and it Just Worked.

Location B (a non profit public service organization for which I’m doing all this pro bono) is a facility several towns away from here that is only accessible during business hours. I installed a half dozen Grandstream GXP1400 phones there and connected them back to the PBX here and discovered an interesting problem… I can call out from those phones, and carry on a conversation with people in their homes running X-Lite, and it all works fine. However, no one can call in, and one extension in the building can not call another extension in the building.

I have read much about how to make Asterisk and its clients play nice behind NAT firewalls. I have a pretty good idea what to do to fix this, but as I said Facility B is accessible to me only with difficulty, and so if you guys don’t mind I’d like to run my plan by you and ask you to highlight things that are wrong or missing, so that I have a chance of getting all this working the first time, next time I visit Facility B.

All of my extensions configurations in FreePBX (including for the outside X-Lite installations on other people’s homes that Just Work) are configured like this:

dtmfmode=RFC2833
canreinvite=no
context=from-internal
host=dynamic
trustrpid=yes
sendrpid=no
type=friend
nat=no (<<= makes me wonder why the outside X-Lites work)
port=5060 (same for everybody which is apparently wrong)
qualify=yes
transport=UDP only
encryption=no
deny=0.0.0.0/0.0.0.0
permit=0.0.0.0/0.0.0.0

Here’s what I believe I’m going to have to do the next time I visit Facility B (please tell me if I’m wrong or missing anything):

  1. Each extension in FreePBX will need its own Local SIP port, offset by 2, i.e. 5060, then 5062, 5064, etc.

  2. Each physical extension phone in Facility B will have to have its Accounts->Account[1…2]->SIP Settings->Basic Settings->Local SIP port set to match the “port=” setting in its associated FreePBX Extensions entry (BUT… question on that below).

  3. The DHCP server in the router that connects all these phones will have to be set to serve each phone the same private IP address every time, e.g. phone #1 always gets 10.2.3.4, phone #2 always gets 10.2.3.5, etc.

  4. The router that connects all these phones will have to be set to forward the correct ports to each phone, recalling that these are two-line phones and so need a port pair for each line or two port pairs per phone (e.g. ports 5060-5063 get forwarded to 10.2.3.4, ports 5064-5067 get forwarded to 10.2.3.5, etc.).

Does all that sound about right? Will I need to do anything else?

A couple more questions…

  1. Each GXP1400 phone has its Settings->General Settings->Local RTP Port (RTP port not SIP port) set to 5004. Does that port need to be different for different phones or can they all stay set to 5004?

  2. Per item (2) above… Each phone is two lines, and each line has its own Local SIP Port (5060 for line 1, 5062 for line 2). Each phone has only one IP address to service both lines. In FreePBX, each line’s extension is set to port=5060. Yet, within the LAN here in Facility A, both lines work correctly even though the second line’s Local SIP Port does not match its FreePBX Extensions->port. I also have a 4-line GXP2100 phone with the four lines set to local SIP ports of 5060, 5062, 5064, and 5066 even though their FreePBX Extensions->port settings are all 5060, yet all four lines work fine. How is that possible?

Thanks for your review of all of this and suggestions… hopefully this will do it.

Actually if I start the Local SIP Port assignment at 5060, 5082 isn’t going to be enough… I’ll need to go at least up to around 5120.

Is there a lower or upper number range beyond which we’re not recommended to go?

I have read your article and found it really nice and interesting. Just make sure that the equipment or tools are used for such purpose must be fix at save side. Anyway I would like to say thanks to you that you share this post here with us.

Hello,

First a quote “my problem is the clients behind NAT connecting to a static-public-IP server”

Then you write:

The Asterisk sip_general_additional.conf file includes:
nat=yes
externip=PBX.EXTERN.IP.ADDRESS
localnet=192.168.100.0/255.255.255.0

So… what is it, is the nated or not?

Then you tell that all the extensions in FreePBX are configured like:

nat=no (<<= makes me wonder why the outside X-Lites work)
port=5060 (same for everybody which is apparently wrong)
qualify=yes

But you can assume that all phones, hard of soft, are nated as they are in peoples homes.

So, assuming your server has an public ip addres, allow port 5060 and the rtp range standard asterisk is 10000-20000, access to the server.

Set the phones to nat is yes. You do not have to change the port of every phone, you can even leave that field empty.

Reading your piece, you make it yourself verry difficult…

No need to forward ports to different phones, NAT does that for you.

Just configure each phone to connect to the correct sip server, enter uid and password, thats it.

Just make sure that the extensions on Freepbx use nat.

And then if things still dont work, for those specific phones, log files are loved by us…

Good luck.