Intermittent call failure for inbound calling

I can not reply to this thread anymore, but I am having the same issue described in this thread.

I have whitelisted all new POP IP ranges in the Firewall (put them into the trusted zone) as well as whitelisting them in Fail2Ban. IPs from this website (’s_SIP_Signaling_and_RTP_Media#RTP_media_(call_audio))

Incoming calls will intermittently fail. I turned on SIP debugging, and every call is coming into the PBX, but the calls that fail, are sending a 401 rejected back to Flowroute. The signaling traffic is coming from one of the IPs in the whitelisted ranges.

Do I need to setup a trunk for each and every Flowroute IP? I would not think (hope) I would need to do that since there are about 64 IPs that the signaling traffic could come from.

Has anyone set this up properly?

It depends. From what I understand, I PJ-SIP will allow you to set a range of IPs for your signaling source. I’ve never used it for that, so that’s second-hand. If you can use PJ-SIP for that, you might be able to get that working.

With Chan-SIP, however, you have to specify an inbound trunk for every IP address you are expecting traffic from.

The “workaround:” is to allow anonymous calling, which (unless you have a very tightly managed firewall) is almost always an invitation for people to steal toll services from you and is generally considered to be outside the scope of “best practice”.

So, like I said, it depends.


I have it working. The trunk config is very simple:

pjsip settings tab:

pjsip advanced tab

The only thing I had to change in the advanced tab was the DTMF and the “From Domain” to the preferred pop server.

Whitelist all of the POP IP’s:

I use the FreePBX 14 firewall:

If you do, make sure to trust all of the POP networks in the firewall for UDP/TCP/whatever traffic.

Make sure in your Settings/Asterisk Sip settings you have your external address and applicable local network if need be:

In the chan PJSIP tab, I have the following on my wildcard transport for UDP:

Insure that you have configured an inbound route on flowroute correctly. This is key depending on what type of authentication you are using and method of routing strategy NAPTR/A record, etc.

Make sure you have routed the DID/s to the inbound route you created.

Under the Reports Tab for PJSIP you should see something like this:

As you can see, all of the Flow Route POP’s are matched.

I hope this helps.

That is amazing. Thank you for detailing this out! Looks like they are using 2 IPs for each POP region.

Thanks again. This was really helpful.

My pleasure.

Assuming that your networking setup permits (public IP address is static and you have proper control over any hardware firewall), I recommend routing calls directly to your PBX. This is more robust, as it eliminates the possibility of failure from “lost registration” or DNS issues. See . In this configuration, manually list the four POP netblocks in the Match field for your trunk.

You might also consider IP authentication for outbound calls. See . This is a little more secure – you can disable credentials. It also reduces call setup time by eliminating the need to respond to authentication challenges.

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.