SOLVED Best Way to Setup a Cloud Instance Where NAT is Concerned?

[kyle95wm]

Okay so I know how to follow tutorials from Incredible/NV, but my question is, how does one setup NAT on the PBX side so that things will work perfectly?

For info, I have the latest CentOS 6.8 on DigitalOcean with IncrediblePBX - Asterisk 13 (latest) with FreePBX 12 (latest version available to us open source users)

As for NAT settings I'm really confused.

Here is what my main Asterisk SIP Settings menu looks like: http://prntscr.com/cykqx1

BTW the 192.168.101.0 network is my private network I have here at my house. This network does not exist on DO. The two networks below it do exist however.

Here is what my Chan SIP settings look like: http://prntscr.com/cykrbf

I haven't touched anything here, it just came as the default when building the server (had to go through a server re-buld due to location causing latency - maybe the DDOS attacks were connected?)

And here is an example of what my extensions configuration looks like: http://prntscr.com/cyks0w

NOTE: As far as the port number is concerned, this extension is used primarily with a soft phone - it picks a completely random port to connect on instead of 5060. As per some of the people from here's suggestions, I changed the port on a few extensions. This way things will function better as far as registrations are concerned after internet loss. The problem is, there are a few phones that can't register on alternate ports (may repeat myself below - adding this in after the fact). Therefore when I loose internet connection, I have to power cycle the phones that all run on 5060 - at least 4 (3 Mitel and one Yealink), so they can all re-register and get fresh port numbers, otherwise the registrations just go to the wrong phones. I made a thread about that problem here: http://pbxinaflash.com/community/threads/confused-sip-registratons.20326/

I've went back and forth with people about the whole thing. Currently I'm in a position where some phones just won't register on different ports (yes, I'm pointing at you Mitel).

The whole point of this thread is to have a way to document things for those who wish to run their PBX in the cloud. Are my settings correct (they are default setting after all). Keep in mind, these extensions are INTERNAL to my LAN but EXTERNAL to my server if you catch my drift. Someone in real life also pointed out to me that its not "realistic" to assign one phone to occupy a specific port. I mean, what if you have like 100 phones all connecting to a cloud server? I would assume a VPN would be used in this situation, therefore giving the phones their own unique IP address, while using the 5060 standard port, but for those who don't have as many phones, surely theres a better workaround (obvious one being running the PBX on-site where each phone has its own internal IP - that's obviously not an option. Trust me I've tried even running it in a VM. It's much more trouble than what it's worth. Besides, if internet goes out, how will calls get through? At least people can still leave messages in the voicemail part.)

Suggestions? Comments?

Post them below!

 

[billsimon]

If your PBX is on a public IP on Digital Ocean, you should not fill in any of the local network fields in the NAT settings. The local networks fields are used to specify networks that the PBX can reach without NAT. In your case, since you don't have any phones on the private Digital Ocean network, you shouldn't list that one either.

On the extensions, you should set NAT to yes since the extensions themselves are behind a NAT.

 

[kyle95wm]

I see, thanks for the tips. Is there any particular reason why I should set NAT to yes in my extensions? Presently everything is working perfectly fine (multiple people can all be on the phone at the same time both internally and externally). Th only thing I can think of is something RTP related, or perhaps registration related?

 

[billsimon]

It's likely your router has SIP ALG enabled which is handling the NAT fix-up for you. Otherwise you would probably have no audio. The reason to enable NAT in the extensions settings is so that Asterisk will know to examine the SIP body and replace private IP addresses with public (the external side of your NAT) in the SDP. Otherwise, Asterisk might try to send media to your internal IP (like 192.168.0.10) which it can't get to from the public Internet.

 

[kyle95wm]

Okay so I just implemented your suggestions and everything is fine. I also went ahead and looked up what SIP ALG is.

On my particular router its called "SIP Passthrough": http://prntscr.com/cyx18f

Should I leave it at "Enabled+NAT Helper"? Or should I just Enable or Disable it? I heard SIP ALG is more bad than good. Again, no issues with inbound or outbound calls.

 

[billsimon]

It's hard to answer your question without documentation on what each of the options does. But I can say that Asterisk with NAT settings enabled takes care of the "NAT Helper" part so you should be able to do without that on your router.