Port Forwarding - Necessary?

Hello, I am having troubles with FreePBX and have a question, so I will try and explain as best as I can the problems I am having.

I am currently running FreePBX 2.3.1.7 and a homebrew Asterisk box on the same network. My firewall I am currently using does not use port-forwarding.

Connecting my phones to the homebrew, I am able to have clear conversations internally, to and from an external phone, and phone out and back in with no problems.

With my FreePBX box, I have clear conversations from internal calls and that’s it. When I call to and from an external line, when it does connect, I can talk clearly from my internal phones to the external one, but when there’s audio coming from the external phone, I can hear 7 seconds of clear real-time audio followed by silence for 30 seconds, after which I can start hearing real-time audio for another 7 seconds. When I call out from an internal phone back in, I can’t hear any audio at all from the phones.

I do not have control over the firewall and I can’t makes changes before I have definitive proof that it won’t affect the other asterisk boxes on the network and that it’s necessary. If the other Asterisk boxes don’t require port forwarding, why is it necessary for this one?

My question is whether or not port-forwarding is absolutely necessary to have FreePBX working and why would other flavors of Asterisk not require port forwarding. If port forwarding is something that is necessary for FreePBX, would there be any changes to the other Asterisk set up if the ports it uses are being forwarded to the FreePBX box?

I will post what I can from these servers.

FreePBX settings:

Outgoing Settings
Trunk Name: Trunk-Out

PEER Details:
allow=ulaw
canreinvite=no
context=from-pstn
disallow=all
dtmfmode=rfc2833
fromdomain=unlimitel.ca
host=sip02.unlimitel.ca
insecure=very
nat=yes
port=5060
qualify=no
secret=vvvvvvv
type=peer
username=YYYYYYYYY

Incoming Settings
USER Context: Trunk-In
USER Details:
allow=ulaw
canreinvite=no
context=from-pstn
dtmfmode=rfc2833
host=sip02.unlimitel.ca
insecure=invite
progressinband=no
relaxdtmf=yes
rfc2833compensate=yes
secret=vvvvvvv
type=user
username=YYYYYYYYY

Register String:
YYYYYYYYY:[email protected]/YYYYYYYYY


sip_nat.conf
externip=192.168.xxx.xxx

localnet=192.168.1.0/255.255.255.0

externrefresh=10

externhost=foo.bar.com


sip.conf
; Note: If your SIP devices are behind a NAT and your Asterisk

; server isn’t, try adding “nat=1” to each peer definition to

; solve translation problems.

[general]

#include sip_general_additional.conf

bindaddr=0.0.0.0

srvlookup=no

disallow=all

allow=ulaw

context = from-pstn; Send unknown SIP callers to this context

tos=0x68

; Reported as required for Asterisk 1.4

notifyringing=yes

notifyhold=yes

limitonpeers=yes

; #, in this configuration file, is NOT A COMMENT. This is exactly

; how it should be.

#include sip_general_custom.conf

#include sip_nat.conf

#include sip_registrations_custom.conf

#include sip_registrations.conf

#include sip_custom.conf

#include sip_additional.conf

#include sip_custom_post.conf


rtp.conf
;

; RTP Configuration

;

[general]

;

; RTP start and RTP end configure start and end addresses

;

rtpstart=10001

rtpend=20000


Homebrew:
sip.conf
; File created by the Warp web interface version 1.05

[general]

context=sipdefault

realm=asterisk

allowoverlap=no

bindport=5060

bindaddr=0.0.0.0

srvlookup=no

maxexpiry=120

minexpiry=60

defaultexpiry=120

disallow=all

allow=ulaw

relaxdtmf=yes

mohsuggest=default

mohinterpret=default

useragent=Warp v1.05

dtmfmode = rfc2833

videosupport=no

callevents=yes

rtptimeout=60

rtpholdtimeout=300

#include <sip_registrations.conf>

canreinvite=no

jbenable = yes

jbforce = no

jbmaxsize = 200

jbresyncthreshold = 1000

jbimpl = fixed

[authentication]

#include <sip_daphone.conf>


sip_registrations.conf
register => XXXXXXXXX:[email protected]/XXXXXXXXX


sip_daphone.conf
; File created by Unlimitel WEB Interface

; Version 1.05

;

[200]

type=friend

username=200

secret=200

port=5060

nat=yes

host=dynamic

dtmfmode=rfc2833

disallow=all

allow=ulaw

context=frominternal200

canreinvite=no

insecure=very

musicclass=default

musiconhold=default

callerid=“Aastra-200” <200>

[201]

type=friend

username=201

secret=201

port=5060

nat=yes

host=dynamic

dtmfmode=rfc2833

disallow=all

allow=ulaw

context=frominternal201

canreinvite=no

insecure=very

musicclass=default

musiconhold=default

callerid=“Linksys-201” <201>

[Unlimitel1]

type=peer

username=XXXXXXXXX

fromdomain=unlimitel.ca

secret=secret

host=sip02.unlimitel.ca

port=5060

nat=yes

canreinvite=no

qualify=no

disallow=all

allow=ulaw

dtmfmode=rfc2833

insecure=very

context=from-pstn


rtp.conf
;

; RTP Configuration

;

[general]

;

; RTP start and RTP end configure start and end addresses

;

; Defaults are rtpstart=5000 and rtpend=31000

;

rtpstart=10000

rtpend=20000

;

; Whether to enable or disable UDP checksums on RTP traffic

;

;rtpchecksums=no

;

; The amount of time a DTMF digit with no ‘end’ marker should be

; allowed to continue (in ‘samples’, 1/8000 of a second)

;

;dtmftimeout=3000

; rtcpinterval = 5000 ; Milliseconds between rtcp reports

                    ;(min 500, max 60000, default 5000)

sip_nat.conf is not present on homebrew

For one thing you have your externip in sip_nat set to your internal IP.

The homebrew boxes, are they using the same provider?

How many public IP’s do you have?

I was under the impression that externip was my Asterisk box’s IP address - If it’s not that what am I to change it to? In any case I have made the change (changed it to my trunk’s IP - [209.217.98.194]) and now interestingly enough I am not getting any audio when a call manages to connect. Guess I will need to find out my external IP.

The homebrew Asterisk boxes are using the same provider, Unlimitel. Both are using the same trunk (sip02).

I am unsure what the last question is asking. My FreePBX box has 2 IP addresses, though looking at the logs it seems that they are all coming through to one address and not the other.

http://checkip.dyndns.com/
“My FreePBX box has 2 IP addresses” this will casue issues if do not set them up right, why two ip’s and it is two nics as well or they both bound to a single nic?

I have tried changing my externhost and externip to something other than my FreePBX’s internal ip address, anything else I get no audio. Going to look up multiple IPs on a FreePBX.

Look up multiple IP’s on Asterisk.

Externip tells the media where to go, it must be set to the NAT source IP of your router.

I asked if you have multiple public IP’s on the outside (untrusted) interface of the router.

By default Asterisk listens on all interfaces.

The function of externhost and externip are fully documented in the Asterisk docs. You need one or the other but not both for RTP to traverse NAT.