NO JOY Asterisk/PIAF does not work behind IPFire?

[bofh42]

Asterisk 13.6.0 + Incredible GUI 12.0.30 (Incredible PBX 13-12.3 for Raspberry Pi 2)

IPFire 2.19 (x86_64) - Core Update 110

In the following setup, VoIP does not work

Connection to outside world:
german Telekom VDSL100/40
connection done by Fritz!Box 7580 with firewall IPFire as "exposed host"
IPFire manages 192.168.80.0 (LAN) and 192.168.81.0 (WLAN) (+ several VPNs)
Asterisk is in LAN (192.168.80.12)
LAN and WLAN can "see" each other)
between FritzBox (DSL termination) and IPFire there is a transfer net (192.168.178.1 = FritzBox, 192.168.178.2 = ipfire)

Old setup (see list) did work!!

Starting Point was a working setup with the identical topology, but following changes:

• replaced old DSL16+ by new VDSL100
• therefore had to replace old Fritz!Box 3370 by new 7580
• replaced old IPCop (hardware died) by new IPFire
• replaced old ISDN POTS with new VoIP Trunk Telekom
• several VoIP trink dod NOT change, but stopped working (SIPGate, PersonalVoIP)

The Asterisk server did not change.
Asterisk Server is an "Incredible PBX 12.0.70" (Asterisk 13.x on Debian 7, combined with modified FreePBX WebGUI)
DSL16+ to VDSL imples change from ISDN to VoIP

The old setup already had VoIP running (not with Telekom) with SIPGate, PersonalVoIP and IAXTEL.

After the changes the following happened:

• • VoIP (SIP) stopped working for SIPGate, IAXTEL and PersonalVoIIP using Asterisk - which worked before, no changes in config at all in Asterisk
  • VoIP (SIP) does not work with Telecom
  • VoIP/SIP DOES work from any Smartphone in BLUE and Softphone in GREEN, but only when connecting DIRECTLY through IPFire and FritzBox to the outside VoIP provider
  • VoIP does not work when connecting using Asterisk, not even those trunks that DID work before the changes

"VoiP dos not work" means more specifically:

The SIP REGISTER works - alle DIDs/CIDs (number) are shown as "registered" both in Asterisk and in the Provider Webpages.

Calling in: the SIP INVITE packages do arrive at the Asterisk server (can be seen in "sngrep" on the Astraisk server). Asterisk answers, but this answer never reaches the VoIP provider.

(i.e.: phone rings, you pick up, Asterisks send OK, but the phone on the other side (the one calling in) still plays the ringing tone until timeout is reached.)

Calling out: Asterisk sends INVITE (to the correct address), never gets an answer, called phone does not ring, calling phone does not play ringing tone.

Well, I thought, it may be routing - so I tried to connect the smartphone from the internal network not to Asterisk, but directly to Telekom (through IPFire) and - works perfectly in both dirfections.

Oh well ... :'(

IPFire: blue and green are allowed to see each other (default: forward). IPFire Firewall options: "SIP application helper" enables.

Even setting NAT routes/rules directly pointing to Asterisk does not help.

Unfortunately, I do not have sngrep on IPFire - and as well not on FritzBox. :-(

The fact that the smartphones work directly (but using STUN, did not try without yet) point to an error in Astreisk.

The fact the the formerly working Non-Telekom SIP trunks stopped working after the changes but without any change in Asterisk point to an error in the IPFire/FritzBox combination, as nothing else changed.

Now I ran out of options.

Any ideas?

Kind regards

----------

some log files can be supplied, they are too long for this board

 

[bofh42]

It looks like Asterisk does not register correctly :-(

at least the FreePBX generated pjsip*.conf file do look different from this:
https://wiki.asterisk.org/wiki/display/AST/Migrating+from+chan_sip+to+res_pjsip

But: HOW do I enter the correct values into the FreePBX WebGUI? Changing asterisk conf files does not work of course, as the next "save" from the GUI will overwirte everything


[Telekom-xxxx]
type=registration
transport=0.0.0.0-udp
outbound_auth=Telekom-9249744
retry_interval=60
expiration=3600
auth_rejection_permanent=no
contact_user=0517*92****
server_uri=sip:tel.t-online.de:5060
client_uri=sip:0517*9******@tel.t-online.de:5060


pjsip.aor.conf

[Telekom-xxxx]
type=aor
qualify_frequency=60
contact=sip:0517*9******@tel.t-online.de:5060

pjsip.auth.conf

[Telekom-xxxx]
type=auth
auth_type=userpass
password=
username=0517*9******


(Password = empty is recommended by Telekom, authentification is via DSL line)

pjsip.endpoint.conf

[Telekom-xxxx]
type=endpoint
transport=0.0.0.0-udp
context=ext-did-0002
disallow=all
allow=ulaw,alaw,gsm,g722,g729,g723,g726,speex,speex16,speex32
outbound_auth=Telekom-xxxx
aors=Telekom-xxxx


pjsip.identify.conf

[Telekom-xxxx]
type=identify
endpoint=Telekom-xxxx
match=tel.t-online.de

 

[bofh42]

G'day!

FreePBX 12.0.70 / "Incredible PBX 12.0.30" + Asterisk 13.6.0 on Rasbian 7

Problem:

a) SIP connecting in principle works from home net:
Test: Zoiper on PC with direct registration at VoIP trunk Germen Telekom, works in both directions

b) networking in principle works
incoming calls from Telekom (over VoIP trunk) are terminated on the Asterisk PBX, the correct endpoints ring, call can be accepted, voice works both ways, call termination ok

c) outgoing calls do NOT work.
Asterisk sends REGISTER to Telekom (or any other configured trunk, it's the same with all of them), get a REJECT and does NOT send a new REGISTER with auth information.

No joy at all ...


-- Executing [******@from-internal:1] Macro("PJSIP/6009-00000028", "user-callerid,LIMIT,EXTERNAL,") in new stack
-- Executing [s@macro-user-callerid:1] Set("PJSIP/6009-00000028", "TOUCH_MONITOR=1495794155.241") in new stack
-- Executing [s@macro-user-callerid:2] Set("PJSIP/6009-00000028", "AMPUSER=6009") in new stack
-- Executing [s@macro-user-callerid:3] GotoIf("PJSIP/6009-00000028", "0?report") in new stack
...
-- Executing [s@macro-dialout-trunk:15] ExecIf("PJSIP/6009-00000028", "1?Set(DIAL_TRUNK_OPTIONS=M(setmusic^1FM-60s-today))") in new stack
-- Executing [s@macro-dialout-trunk:16] ExecIf("PJSIP/6009-00000028", "0?Set(DIAL_TRUNK_OPTIONS=M(setmusic^1FM-60s-today)M(confirm))") in new stack
-- Executing [s@macro-dialout-trunk:17] Macro("PJSIP/6009-00000028", "dialout-trunk-predial-hook,") in new stack
-- Executing [s@macro-dialout-trunk-predial-hook:1] MacroExit("PJSIP/6009-00000028", "") in new stack
-- Executing [s@macro-dialout-trunk:18] GotoIf("PJSIP/6009-00000028", "0?bypass,1") in new stack
-- Executing [s@macro-dialout-trunk:19] ExecIf("PJSIP/6009-00000028", "1?Set(CONNECTEDLINE(num,i)=01725647906)") in new stack
-- Executing [s@macro-dialout-trunk:20] ExecIf("PJSIP/6009-00000028", "1?Set(CONNECTEDLINE(name,i)=CID:01738964133)") in new stack
-- Executing [s@macro-dialout-trunk:21] GotoIf("PJSIP/6009-00000028", "0?customtrunk") in new stack
-- Executing [s@macro-dialout-trunk:22] Dial("PJSIP/6009-00000028", "PJSIP/01725647906@Telekom-xxxx,300,M(setmusic^1FM-60s-today)") in new stack
-- Called PJSIP/****@Telekom-9249744
== Everyone is busy/congested at this time (1:0/0/1)
-- Executing [s@macro-dialout-trunk:23] NoOp("PJSIP/6009-00000028", "Dial failed for some reason with DIALSTATUS = CHANUNAVAIL and HANGUPCAUSE = 21") in new stack



Call flow for db99ec3a-31cf-4d8c-8f5a-49a58c364a73 (Color by Request/Response)
│SIP/2.0 200 OK
192.168.80.12:5060 217.0.23.36:5060 │Via: SIP/2.0/UDP 84.178.92.xxx:5060;received=84.178.92.xxx;rport=5060;branch=z9hG4bKPj23966b68-40b2-
──────────┬───────── ──────────┬─────────│b1-8cac-8681eccad821
│ REGISTER │ │To: <sip:+49****@tel.t-online.de>;tag=h7g4Esbg_92fb3a4d0e5db6f8e0c950f8c6a3522d
13:09:05.481550 │ ──────────────────────────> │ │From: <sip:+49****@tel.t-online.de>;tag=7ab1ef92-2309-48ab-bd17-398bc690b5d4
+0.014514 │ 200 OK │ │Call-ID: db99ec3a-31cf-4d8c-8f5a-49a58c364a73
13:09:05.496064 │ <────────────────────────── │ │CSeq: 19985 REGISTER
+650.010981 │ REGISTER │ │Contact: <sip:****@84.178.92.172:5060>;expires=660
13:19:55.507045 │ ──────────────────────────> │ │P-Associated-Uri: <sip:+****@tel.t-online.de>
+0.014459 │ 200 OK │ │P-Associated-Uri: <tel:+****>
13:19:55.521504 │ <────────────────────────── │ │Service-Route: <sip:217.0.23.36:5060;transport=udp;lr>
+650.016296 │ REGISTER │ │Content-Length: 0
13:30:45.537800 │ ──────────────────────────> │ │Authentication-Info: qop=auth,rspauth="a89e2fa5e75d1a74fdf4cae83023966e",cnonce="bab4ea33-27b0-40b9-
+0.014319 │ 200 OK │ │aa-83898e4be771",nc=00000001
13:30:45.552119 │ <────────────────────────── │ │
+650.013206 │ REGISTER │ │
13:41:35.565325 │ ──────────────────────────> │ │
+0.112846 │ 401 Unauthorized 010330345 │ │
13:41:35.678171 │ <────────────────────────── │ │
+0.018954 │ REGISTER │ │
13:41:35.697125 │ ──────────────────────────> │ │
+0.077489 │ 200 OK │ │
13:41:35.774614 │ <────────────────────────── │ │
+650.017069 │ REGISTER │ │
13:52:25.791683 │ ──────────────────────────> │ │
+0.014575 │ 200 OK │ │
13:52:25.806258 │ <────────────────────────── │ │
+650.035921 │ REGISTER │ │
14:03:15.842179 │ ──────────────────────────> │ │
+0.014282 │ 200 OK │ │
14:03:15.856461 │ <────────────────────────── │ │
+650.005191 │ REGISTER │ │
14:14:05.861652 │ ──────────────────────────> │ │
+0.014066 │ 200 OK │ │
14:14:05.875718 │ <────────────────────────── │ │


There mus be a principle error in the Asterisk config - but .... where?

Any help appriciated

KInd regards

 

[bofh42]

Is there any update path to upgrade to a "Incredible PBX" using a more recent version of FreePBX that 12.0.70 and/or a more recent Asterisk?

Is there any possibly "official" way to update those components on your own?

 

[briankelly63]

Some thoughts...... Turn any SIP helpers off, Make sure your external IP address is set in Asterisk (externip), in Pfsense you have to reset the static IP table when you make firewall changes. See if you can do the same in IPfire. Look to set a 'static' ip PORT in the NAT port forwards (search pfsense voip static in google for explanation). Unless you see the proper things in the Asterisk CLI then the issue is the firewall

 

[bofh42]

It's definitely not the firewall. I do see the expected messages in the CLI and in "sngrep" on the machine, but it does always say "rejected" when calling out. But yes, the SIP replies from Telekom do reach the asterisk server.

So the network part is OK.

Besides: a Zoiper softphone in the same local subnet behind the same firewall can connect directly to the Telekom voip server and outgoing calls do work.

 

[bofh42]

But, sniffing helped a bit further:

Asterisk is always transmitting "asterisk@<static ip>" as contact user, which is wrong, it has to be "official_phone_number@static ip>".

Zoiper uses the latter, and that works.

But: I did have a close look at the pjsip*.conf files written by FreePBX/IncrediblePBX, expectig an empty contact user oder "asterisk" as contact user - but no, there is the correct phone number as contact user in the files, so aparently FreePBX does the right thing.

Nevertheless, Asterisk still ignores this info and insist on sending "asterisk" as contact user.

Is there any global switch for that? (that would be rather stupid, but ...)

So: it comes down to: how to I force asterisk to actually use the contact user info stored in the config files???

This is what Asterisk/IncrediblePBX sends - and which is wrong

Contact: <sip:[email protected]:5060>
    Contact URI: sip:[email protected]:5060
        Contact URI User Part: asterisk
        Contact URI Host Part: 84.178.92.xxx
        Contact URI Host Port: 5060

and this is waht Zopier sends (which is correct):

Contact: <sip:[email protected]:32219;transport=TCP>
    Contact URI: sip:[email protected]:32219;transport=TCP
        Contact URI User Part: 051739xxxxxx
        Contact URI Host Part: 84.178.92.xxx
        Contact URI Host Port: 32219
        Contact URI parameter: transport=TCP

pjsip.aor.conf
[Telekom-9xxxxxx]
type=aor
qualify_frequency=60
contact=sip:[email protected]:5060

pjsip.auth.conf
[Telekom-9xxxxxx]
type=auth
auth_type=userpass
password=
username=051739xxxxxx

pjsip.registration.conf
[Telekom-9xxxxxx]
type=registration
transport=0.0.0.0-udp
outbound_auth=Telekom-9xxxxxx
retry_interval=60
expiration=3600
auth_rejection_permanent=no
contact_user=051739xxxxxx
server_uri=sip:tel.t-online.de:5060
client_uri=sip:[email protected]:5060

Kind regards