It’s for Push Services. Here’s why it is important, almost every mobile client is plagued with backgrounding issues. So when the app is in the background or your phone is locked the app no longer responds to the keepalives or new incoming requests from the PBX system. So that means you are not getting calls. Kind of pointless, eh?
Now with the Push Services, the client registers to the push server which in turn registers to the PBX for the client. Now the PBX is sending keepalives and new requests to the push server which allows the PBX to responses to keepalives (from the push server) and when a new call is sent to the push server it sends a wake up to the app bringing it out of the background to receive the call.
Bria has this for its users and even Zoiper’s commercial offering has this for the users. I bet there are more commercial ones that do this as well. Because they all realize what this problem is and it needed a solution.
So is it an additional point of failure, sure but technically it could run from the PBX but then that means everyone has to maintain it and well with most PBXes being behind NAT it makes push services harder to do. It’s basically the right way to do mobile softphones for SIP if you’re actually serious about your softphone getting requests and calls.
The script automatically installs some rules, which are listed on the networks-tab of the firewall module. I assume that’s the reason of your error…
EDIT: but maybe it wasnt the script, because I did add the freePBX cloud servers to the whitelist of fail2ban
Confirmed, installing without firewall module fails. Thanks for the report, I have a ticket open on that now. The only work around until a fix is published is to temporarily install firewall.
I am at the stage where the app says “You will receive an email with the deeplink. Please open the email on your mobile device and click on the link”.
The email arrives and contains the same invitation as the first one I got after I clicked “Invite” from user manager. Clicking on the “Login Link” returns “API server… not connected for session. Please make sure Clo”.
So whatever bind port I have for PJSIP, that is also the destination port where the client will send PJSIP tcp registrations to.
It might be useful to be able to keep the pjsip bind port internally at default 5060 but pick a different external port to where inbound invites/registrations will be sent to.
E.g. we have our PBX behind a NAT router and Asterisk signalling bind port at 5060. We are not using the freepbx firewall and probably won’t be.
Considering the security implications of having to have a port forwarded without whitelisting IP addresses it would be good to have the possibilty to change the destination port that packets will be sent to on the external firewall but leave the pjsip bind port unchanged, cause changing it on a production system would be too inconvenient.
Edit:
Please forget what I said. It’s TCP but everything else is on UDP so it’s no problem using a different bind port.
Since the SIP signaling port is included in the SIP packets, the only way this would work is if the router fixes the SIP packets on the fly as they pass thru the router. That’s what a SIP ALG does, and they are notoriously poor at it.
The PBX Firewall with responsive enabled works fine. With Intrusion detection configured in System Admin, that’s a solid second line of defense. You could add a dynamic blacklist as another layer of security.
I forwarded the TCP listening port to my router and the Sangoma-Connect-app can now connect to my freePBX server. I can also make and answer calls…yet, there is no audio! Any hints?
Audio uses the same RTP port range as all other SIP clients, 10k-20k by default. Those ports must be forwarded as well if they are not already. Also confirm you have the correct NAT config in Asterisk SIP Settings.
We are having a problem where we do not get any inbound calls. The mobile app will register and connect just fine. We can make internal and external phone calls with all audio working. The only issue we are having is that the app does not ring when we get inbound calls. No inbound calls are working at all but everything else is working. Any thoughts on why this would be?
I’ll open a ticket… I don’t know why it would be SIP ALG. The server runs in the cloud with a dedicated public IP and the phone was on LTE so nothing was behind any router. It does the same when behind firewalls but SIP ALG is the first thing I disable on Unifi USG Pros when we install them.
I’m having issues with the app on my Android. It works great unless I minimize the screen to check email etc. then it seems to close and does not ring on inbound calls. If I leave it open and my phone screen locks the app closes and does not receive inbound calls.
Open a support ticket pls. When the app goes into standby, the push servers take over the registration and then relay the ring to client, my guess is there is something going on with the push registration(s).
