Soft phone registration issue

[puneet1984]

hello

i have freepbx 16 installed
dynamic public IP with DDNS configured

i am able to register extension (pjsip) to freepbx on softphone(zopier/GSwave) using ip address when in LAN environment
i am able to register extension (pjsip) to freepbx on softphone(zopier/GS wave) using DDNS domain when in WAN environment (on mobile Data)

so i know -

1. NAT is configured correctly
2. internal network is configured correctly
3. hostname resolution is working
4. dynamic updation IP address is work correctly

my problem-

not able to register when using DDNS domain in LAN environment gives - 408 timeout error
sngrep shows nothing
asterisk log shows nothing
nslookup resolves the domain to correct ip address

tried disabling freepbx firewall
no IP blocked in fail2ban

any ideas??

[dicko]

You either need a ‘hairpin’ rule on your firewall for the DDNS domain or a local name service that points the DDNS domain to the FreePBX server.

[puneet1984]

hi

i am using pfsense as firewall…
but i still dont understand the reason behind it…
DDNS is working over cellular service but not when on internal network…

can you help me out on hairpin rule?? what you mean by that…

i have forwarded all incoming WAN connections on UDP to
-freepbx server and sip port
-wireguard server and its port

[dicko]

Inside your LAN you best need my.ddns.host to resolve to 192.168.1.34 (or whatever) otherwise there are any number of reasons why you are not getting connected all of which although probably resolvable will be external to your FreePBX your pfSense can be set to redirect LAN traffic to my.ddns.host back to te LAN at 192.168.1.34 in the symmetrical way WAN traffic to my.ddns.host is so redirected, that is a ‘hairpin’ rule. If your pfsense is the authoritative DNS server on the LAN then a static entry for my.ddns.host should also work.

[puneet1984]

hi

currently nslookup of the DDNS points to my public IP.
So you are advicing to setup a static local DNS entry in the pfsense firewall pointing DDNS to 192.168.1.34(freepbx ip).
what if the DNS entry points to the firewall itself??

update!!!
neither of these have any effect… no activity on sngrep…

[dicko]

sngrep monitors traffic on the interface of the FreePBX box , if that is in your LAN and SIP INVITES and REGISTERS are sent from the endpoint to that interface it will show. If they don’t show then recheck your pfsense setup because that is the device responsible for directing connections

[puneet1984]

ok will try again and update
have put a static local dns entry for the DDNS domain in the firewall…

[puneet1984]

hi

so it works… now the local dns override makes softphone able to register on the freepbx…
but this causes another issue…now wireguard service is not working… as that was also using the same dynamic domain to connect to the wireguard server running on pfsense.

[dicko]

Wireguard suggests tailscale

[ErikVandergeld]

You need to create a Hairpin NAT rule on your router, I don’t know how it works in PFSense, but in mikrotik (winbox) I did it like this:

chain: masquerade
src address: 192.168.1.0/24 (my local network)
dst address: 192.168.1.140 (my pbx)

action: masquerade

I have a rule like this for each service within my network that has a connection to a domain, so that it is accessible via the internal network

without this rule, when you try to access the domain via your LAN, the packets are “lost”.
This video explains it better, it’s very practical and quick, I believe it is similar in pfsense:

MikroTik Hairpin NAT

With this rule, domain services work perfectly on the LAN
EDIT: Looks like in PfSense this function is called NAT Reflection

[dobrosavljevic (Igor Dobrosavljevic)]

It’s called NAT Reflection in pfSense: Network Address Translation — NAT Reflection | pfSense Documentation

[dicko]

For mikrotik to allow local clients like wireguard you might need the corollary rule

chain=dstnat 
action=dst-nat 
to-addresses=192.168.1.140
protocol=tcp
dst-address=12.34.56.78
dst-port=51820-51999

[puneet1984]

Hello

yes the issue is resolved…
it was because in the pfsense firewall, NAT reflection was off… changed it to true NAT and everything came in place…
now without pointing the domain to one IP address… the firewall is automatically deciding which service to look for and sending wg connections to firewall and sip connections to pbx server.