I just recently set up my FreePBX 13/Asterisk 13 system, and it has been working faultlessly for about a week. I have rebooted several times for various reasons, and my most recent uptime was about 72 hours. Somewhere in that 72 hour time frame, my system stopped receiving inbound calls. Anyone calling in would receive the standard “call cannot be completed as dialed” message.
I could still call extension to extension and even make outbound calls, but any inbound calls would fail. Calling my own DID from an extension resulted in the same message. I checked with my SIP trunk provider and they hadn’t had any outages.
I stopped Astrerisk with “fwconsole stop” and rebooted with “shutdown -r now” and when the system came back up, everything was back to normal. That eliminates my SIP trunk provider as the source of the issue, and it has to be the server.
I suppose I could add a cron job to restart the server once every 48 hours or so, but I would really like to know what caused the error. I’m new to Asterisk and a good portion of the log files content is still Greek to me, so I wondered if someone could take a look at the Asterisk log snippets I assembled from my call attempts before reboot and after reboot, and perhaps offer some advice on what caused the issue.
I tried to include the logs in the body of this post in CODE blocks, but they exceeded the max message size. Here’s a link to the before and after snippets.
Your firewall blocked your ITSP. You need to add their inbound address(es) to the whitelist in the Admin Module and in the Integrated Firewall. If you don’t have Wide Area Network extensions, you don’t need the Adaptive Firewall, which can also cause this from time to time.
Your log lines indicate that outbound calling is broken as well.
[2017-08-22 11:48:19] VERBOSE[10609][C-000007b7] app_dial.c: Called SIP/Flowroute/1614XXXXXXX
[2017-08-22 11:48:21] VERBOSE[10609][C-000007b7] app_dial.c: Everyone is busy/congested at this time (1:0/0/1)
Do you mean the Responsive Firewall? If so, are you saying I can safely turn off the Responsive Firewall, without any risk of not properly firewalling any incoming VoIP connection attempts originating from outside my LAN?
By inbound addresses, do you mean the addresses used by my ITSP that come in on port 5060?
I apologize up front for what are probably stupid questions; I am new to this VoIP thing and am still struggling to learn all the nomenclature.
There are two components to the FreePBX Firewall. The integrated firewall (which implements the standard Linux style ipchains firewall) and the Responsive Firewall (which undoes some of the IPChains stuff and implements Fail2Ban). They work together to help make your system safer in the event your machine is exposed to the Internet. You want to have the Integrated Firewall up and running for sure. The Responsive Firewall is optional and only useful if you are connecting extensions from outside the local network (or at least, from unknown locations).
Using the responsive firewall gives maladroits the opportunity to try to connect to your system from anywhere, until they get their addresses blacklisted. Properly setting up the Firewall (under the Connectivity tab) to limit your system to specific connections makes the problems you are seeing less prevalent.
Yes, the addresses your ITSP using for incoming connections. Some providers use more than one address for inbound calling (VOIP Innovations is my reference point on that one) so setting up a trunk for each IP address your ITSP will be sending from and opening the firewall to JUST THOSE addresses helps prevent the loss of inbound calling.
In general, your ITSP is not likely to be logging into or registering a connection with your server. Their traffic will be coming in from a specific address or addresses and will be process by your trunk configuration. These connections need to be allowed through your firewall. The “Sysadmin” module has some setting for trusted networks which you may or may not need to modify. The Firewall module, however, will need to be set up with the ITSP’s specific address in a “trusted” zone.
First off, I want to thank you for taking the time to help me identify my issue(s) and patiently answer my questions. I appreciate that more than you can possibly know. Again, thank you.
Following your advice, I have added my ITSP’s IPs to the firewall’s “trusted zone” list, as well as whitelisting those same IP addresses in the SysAdmin Intrusion Detection section.
And since all of my SIP extensions are on my local LAN on a single subnet and I won’t have any SIP peers outside the network, I have turned the Responsive firewall off. The Integrated firewall of course remains active.
I have rebooted the server, and am looking forward to having this issue resolved.
I continue to be plagued with this same issue. I have added my ITSP’s IPs to the firewall’s “trusted zone” list, as well as whitelisting those same IP addresses in the SysAdmin Intrusion Detection section, but this hasn’t resolved the problem.
Over the last week or so, the system ran perfectly for almost 72 hours, after which inbound callers began receiving the same “call cannot be completed as dialed” recording. After performing a “fwconsole restart”, inbound calls began working as normal.
12 hours later I come home from work and inbound calls are again not coming through. This time, fwconsole restart did NOT resolve the issue; I had to completely restart the server in order to rectify the problem.
Where else other than the “full” log file should I be looking for clues as to what is causing this? I need FreePBX to “just work”, all the time.
Any other suggestions as to where my problems may lie? I know it isn’t my ITSP because restarting the server temporarily resolves the issue for anywhere from 12 to 72 hours, then it happens again.
This sounds line a networking issue to me. Please tell us your network configuration so that we might be able to ascertain the issue.
Are you behind a NAT? What is your primary router/firewall? SIP-ALG and other “SIP Helpers” don’t help (they are meant for phones) so they need to be turned off. Note that some routers do not have the capability to turn off SIP-ALG, so this could be an issue for you. Are you using a static address on your local network or on the Internet?
Posting all of your /var/log/asterisk/full log here is not going to help - you need to be respectful of other people’s time. When the system stops answering calls, what indications do you get when you use “SIP SHOW” and all of the sub-options.
There’s a relatively simple answer to this problem, but we haven’t got enough information to even guess where.
Network configuration:
Ubee DVW32CB Cable modem/4 port router connected to my ISP via 30Mbps/6Mbps broadband cable connection.
All the PCs in the house (including the FreePBX server) are connected to a 8 port switch which is connected to the router.
I have one Linksys SPA2102 ATA to which an analog cordless DECT phone is attached. All other extensions are X-Lite softphones.
The router provides DHCP and NAT services, with all network devices on a single subnet.
My WAN address is dynamic, although it hasn’t changed in several years.
All the servers (including the FreePBX server) on my LAN use static IP addresses mapped in the router by MAC address.
SIP-ALG was turned on in the router. I have turned it off and rebooted the router.
When I arrived home from work today, VoIP services were still working properly, so I can’t provide the output from the SIP SHOW options. I have to wait for the system to fail again.
Hopefully the SIP-ALG “helper” in the router was the source of my headaches, and I won’t have any more issues now that it has been disabled.
And I apologize if I have monopolized your or anyone else’s time. It’s not been my intention to demand assistance in resolving my issues; I only linked to snippets of my /var/log/asterisk/full log in my original post because I felt that it perhaps held clues to identifying the issue that I was overlooking and perhaps someone more experienced might see.
Not to worry - there’s a tendency among people having problems to inundate us with everything under the sun. I can’t tell you the number of times one or more of us has spent an hour looking through 2000 lines of …/full logs only to find a line that basically says “here’s the problem - you misspelled your password” or the like. My comment was simply a plea for moderation.
I’m calling this solved - six days of issue free VoIP services after disabling the SIP ALG "helper client in my router. Thanks for your help, everyone!
