As well, a pptp connection on pfsense seems to work well enough too, providing the remote user is on a softphone only.
I have a dozen endian firewalls I manage. I've never gotten them to allow trunking/remote users if it sits in front of sipx. Always an audio issue. I have also posted a query on the endian forum (no answers yet). --stay tuned ============================ Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ ----- Original Message ----- From: [email protected] <[email protected]> To: sipx-users <[email protected]> Sent: Fri Oct 30 12:55:39 2009 Subject: Re: [sipx-users] sipxecs behind endian firewall Tony's explanation of symmetrical nat and how it can be implemented in pfsence is very help full. As for our configuration with Endian, we really haven’t run into any issues, probably because as Tony suggest, our Sipx config is quite simple however SipXBridge and sipx gateway is configured to connect directly to Acanc, not through an ATA as suggested. A bit of background: Acanac provides both an IP address and a FQDN to connect to their services. I use the IP address for simplicity sake as it is only used for testing in a development environment. Production environment we use Mediant 2000 for PSTN services. 1. We run Endian as the firewall with a static assigned public IP address (No STUN involved). 2. An Endian outbound firewall rule is created to allow all outbound traffic to Acanac's provided IP address. There is NO port forwarding rules to forward traffic on public port 5060, 5080 or the RTP range back to the sipx box. Endian takes care of this with the default allow_established rules. With this config, the only way a device on the public internet can make a connection back to sipx is by first sipx establishing a session with them, which is what sipxbridge/gateway does when it registers with acanac. 3. SipX is configured under Server -> NAT "Specify Address" with the static public IP at the endian interface and public port 5060 4. Sipx is configured under Devices -> SBC -> SipxBridge (all default values) 5. Sipx is configured under Gateways -> Acanac -> (all default values) except Address = IP Address provided by Acanac, ITSP account name and password. ITSP Server domain name = same IP address that Acanac provided. What this doesn't provide is a way for mobile workers on the internet to connect to SIPX directly. I would really like to see sip+tls and srtp implemented before letting users free on public or un-owned networks to freely transmit their credentials and conversations, but that’s me. Instead I prefer using OpenVPN to tunnel in. This simplifies sipx and firewall configuration and encrypts communications between remote worker and sipx, however it requires configuring an OpenVPN client on the remote worker side. There is definitely tradeoff and I'm sure this is not a one solution fits all type of thing, but it works for us. I've tried many different OpenVPN server scenarios, including installing OpenVPN directly on the sipx box and using Endian's OpenVPN implementation. Right now I've opted to use Vyatta which sits behind Endian for the OpenVPN server components. Hope this helps.. Again, it's what works for us and is probably not a one solution fits all. Dave B. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Picher, Michael Sent: October 30, 2009 4:54 AM To: Francis Tinio; Tony Graziano Cc: sipx-users Subject: Re: [sipx-users] sipxecs behind endian firewall The VMWare version is available from their downloads section at www.pfsense.com Mike -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Francis Tinio Sent: Thursday, October 29, 2009 9:31 PM To: Tony Graziano Cc: sipx-users Subject: Re: [sipx-users] sipxecs behind endian firewall thanks for the detailed explanation. I would very much like to test out pfsense, where can I get the vmware version. my endian is actually also installed in vmware. My only concern with going this route is, I would have to reconfigure my cluster again if I were to switch my central firewall, that means some downtime with our servers. Also, I'm not really a freebsd guy, I'm just ok with linux (no where near you guys in skillset lol), so jumping to freebsd is a bit daunting. anyway, with your explanation of symmetric nat. what if instead of doing 1:1 nat, I only open 1 port incoming and the same port outgoing. that way the firewall will not change the ports right? so if I open, in one rule, port 5060 and nat it to 5060 of the internal IP, won't that be symmetrical at least since it's only 1 port we're dealing with? As for Dave, the openvpn you mentioned, is that an endian built in capability? how do you handle remote users then? If they work remotely (say a softphone in a laptop), do they need to connect to the vpn first before they can connect the softphone? I also agree with having a wiki with a list of firewalls and how it affects sipx in terms of useability and setup. Thanks. ----- Original Message ----- From: "Tony Graziano" <[email protected]> To: "Dave Black" <[email protected]> Cc: "sipx-users" <[email protected]> Sent: Thursday, October 29, 2009 10:20:31 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall If it matters, your gateway is handling nat traversal via the ITSP very differently than a siptrunk. It's a gateway and not a siptrunk using sipxbridge. Endian only handles SNAT, source/softwires, but not symmetric NAT which is a requirement for sipxbridge. Your gateway (which is probably an FXS ATA) from acanac could also employ a stun server or other methods to traverse to their network so audio will work. There is probably nothing from you getting its local IP address and setting it up as a gateway in sipx and sending all calls to the AA or an extension. If so, that's nifty. For example, I have a voipo account for home use, it uses a linksys spa, I only needed to forward a couple of ports from my endian firewall at home in order for it to get out, register, and be usable. I can also connect a softphone to a test sipx server at my office but it would NEVER connect no matter what I did (and have 2 way audio for either direction on received or placed calls), until I put up a pfsense firewall and configured it properly. Your gateway (which is probably an FXS ATA) from acanac could also employ a stun server or other methods to traverse to their network so audio will work. If you are trying to connect to an ITSP with a siptrunk via sipxbridge, and your server is behind nat (or some of your remote users), you should employ a firewall capable of symmetric nat where sipx is located. I have a lot of customers using endian, but not with sipxbridge, because endian DOES_NOT_DO_THAT <period>. So if the question is "I want to employ sipxbridge at home with my ITSP to connect to a siptrunk provider and I use an Endian firewall, how do I do that?", the answer is "use a firewall capable of doing symmetric NAT, I don;t think endian is capable of doing so." If you dispute the capabilities of Endian, I suggest you post a question to a guru on their list of how to configure symmetric NAT. There might be a way to manually change this via VI but not from the user web interface. It is not on the list of features for the Open Source of the paid commercial version. If you get a way to make symmetric nat working on endian somehow, posting this would be a good idea. The sipxproxy (sipxroxd) is only used to connect many users inside your lan to a single external sip server, not for a b2bua like sipxbridge or for remote users connecting from the outside to sipxecs inside behind an endian firewall. Maybe a wiki page explaining firewalls used, with tips and tricks is needed here in regard to this type of question (what is generally known to work). Tony On Thu, Oct 29, 2009 at 8:05 AM, Black, Dave < [email protected] > wrote: Yup.. I use Endian EFW (Community), in my case, also installed under VMware. Have been using 2.2 since May and just upgraded to 2.3 yesterday. Works great. I use OpenVPN to connect remote phones so the firewall doesn’t really play a role for that. I don’t do too much with SipxBridge, but do have a gateway configured to connect to Acanac, a small ITSP out of Mississauga. I use them primarily for testing configurations. By default, Endian will have the outbound firewall enabled. Don’t enable the SIP proxy in Endian. All I need to do with Endian to connect to Acanac was to open up the outbound firewall (all ports, TCP/UDP) to the IP addresses Acanac provided me. When Sipx registers with Acanac, Endian automatically uses the allow established rules and creates the necessary NAT translations as ports are requested… That was it for me.. Dave B. From: [email protected] [mailto: [email protected] ] On Behalf Of Tony Graziano Sent: October 29, 2009 6:09 AM To: Picher, Michael Cc: sipx-users Subject: Re: [sipx-users] sipxecs behind endian firewall Just to save you some trouble, Endian does not do symmetric nat at all. Symmetric NAT § Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port. § If the same internal host sends a packet even with the same source address and port but to a different destination, a different mapping is used. § Only an external host that receives a packet from an internal host can send a packet back. It can do SNAT, nut this is not souce based NAT, it is softwires nat, which is used for encapsulation. Replacing it would be your best option. It it matter, pfsense has a vmware loadable image you can use, and is very easy on system resources. On Thu, Oct 29, 2009 at 4:08 AM, Picher, Michael < [email protected] > wrote: I have not tested that firewall personally. As a general rule however, you would want to make sure and disable the sip proxy in endian. Mike -----Original Message----- From: [email protected] [mailto: [email protected] ] On Behalf Of Francis Tinio Sent: Thursday, October 29, 2009 3:00 AM To: sipx-users Subject: [sipx-users] sipxecs behind endian firewall Hi. >From a previous topic I wa having, it seems that endian might be a cuplrit with sipx working behind an endian firewall. unfortunately for me, I'm in no position to replce the firewall right now as it will be more work to change. has anyone been able to get sipx to work behind endian firewall? any pointers? did you enable sip proxy in endian fw? thanks in advance. francis _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ - _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/
