I was moving the sip trunk to pjsip (with flowroute) but wanting to keep the endpoints on sip. I can register the trunk and make outbound calls but incoming callers get non-working number.
I have sip on 5060, tls on 5061 and pjsip on 5160. Verified.
Firewall rules have been in place and working (pfsense). I did change the NAT rule to reflect the 5160 port being used now as opposed to the previous 5060 and added in the new Flowroute POP’s (however I did temp set this to ANY with no change).
Once I set the port assignments I can register the trunk to 5160 and register a SIP endpoint on 5060 (both showing in freepbx asterisk info pages for registrations).
Outbound calls work, inbound does not.
So … I created a pjsip endpoint and route calls to it, and that works in and out. I change the inbound route back to the SIP (5060) endpoint … no inbound. I disable the pjsip trunk and enable to sip trunk and then update the firewall rules … and everything works again.
So, what is the issue with having a pjsip trunk and sip endpoints? Do I have to change all my endpoints to match the trunk? I can verify that the ports are not conflicting and yes, I have been restarting the server after any port changes. I would think that the pbx trunk could talk pjsip with the sip provider and then the pbx could talk to the endpoints with SIP … am I missing something?
Did you tell Flowroute that you changed the ingress port? Some ITSPs will not allow you to do that (they insist on you using 5060), but most give you the opportunity to specify the ingress port in their config either by specifying a special port or by using x.x.x.x:5160.
I didn’t. It says on their site they allow 5160 as an alternative. But to rule out that issue, I set pjsip to 5060 and sip to 5062 and tls to 5061. Made sure I set the endpoint sip port to match, restarted everything… same issue. Trunk registration is successful on pjsip, outbound calls work on the sip endpoint, but incoming gives the same message to callers.
Without knowing what you actually (versus what you think you did), it’s going to be hard for anyone to troubleshoot this.
When setting ports, the receiver (each direction) sets the port. If you set your ingress port (for incoming calls) to 5160, you need to tell the sender that you’ve set the port. Their ingress port is set by them (unless they let you set it, but that would be pretty unusual) so you need to make sure you send your outbound calls to them at their port.
Important conceptual note: inbound calling and outbound calling are almost entirely unrelated. Your inbound calling (from your ITSP) has almost nothing to do with your outbound calling to your ITSP. So, having said that, it’s important to look at each of these activities separately. Also, connections to your phones are inbound to your server, but aren’t usually handled through a “trunk” assignment - they are handled yet a different way.
So, this means there are four (conceptually) different kinds of connections, each can work independently of the other three.
Inbound calls from your ITSP: You set the incoming port number in the connection from the ITSP and the channel controller (Chan-SIP or PJ-SIP) receives and processes the call. You can set these to 5060 and 5160, or pretty much anything else you care to. For example, on one of my customer machines, I set the ports to 6050 and 6150 just to mess with the script kiddies. I tell the ITSP that all calls to that customer will come in to 6050 (their PJ-SIP port) and I set up a trunk appropriately.
Outbound calls to your ITSP (POTS calls): You use whatever your ITSP tells you to use. You usually do this in your Trunk configuration. How you set up the trunk (PJ-SIP or Chan-SIP) has little to no effect on your remote end connection. They see “SIP” and away they go.
Calls incoming from extensions: You set up extensions that are ‘type’ specific to allow them to connect. Set them up in the extension config and go to town. Note that they will hit either your “PJ-SIP” port or the “Chan-SIP” port and be processed accordingly. This bit of trivia is why we sometimes see messages about “No extension in this context” or other messages that tell us that the wrong port is being used.
Calls outgoing to your extensions: Once again, the phone decides how you are going to connect. The port (in your extension definition) at your end has to match whatever the phone is expecting.
Because of that of that silliness, it’s hard to troubleshoot this without more information.
My first suggestion is to try using ‘tcpdump -i eth0 port 5060’ and see if your incoming traffic is working. This will tell you that your ITSP is sending the traffic to the right port.
If that’s working, check the /var/log/asterisk/full log and see if the remote traffic is making it through the Intergrated Firewall. If it is, you should see the traffic triggering “stuff” - that stuff will give you a first clue as to what your problem is.
I really appreciate all the info. I didn’t realize that the port selection was that critical on the trunk - but it makes sense now that I think about it that they would not just be open to everything …
so I revisited the whole process and set my pjsip trunk port to 5060, sip ports to 5062 and tls to 5061 … again. Changed the firewall to reflect the change and then restarted everything … set my endpoint to match the new sip port and this time it is working.
Not sure why it didn’t work the first time I tried this setup - but it is now. Thanks again. However, now I’m not really sure why I want to do it this way. I was trying to avoid changing anything on the endpoints and just make the change on the trunk. But since I have to change the endpoints ports I might as well convert everything to pjsip and disable sip all together.
Anyway. Thanks again for the enlightenment. Appreciated.
Rethink your position. Remember that you control the port at which the phones try to register, so you can set up any port configuration you want, as long as you also remember that PJ-SIP and Chan-SIP can’t use the same port.
If you want the phones to connect on 5060 and be handled in the Chan-SIP channel driver, assign 5060 to Chan-SIP (in the Advanced SIP Settings) and configure away. If you want the ITSP to connect on 5160 (or 5062, or pi ) you can that up and point your ITSP’s incoming traffic to that port.
The bit with the extensions that’s hard is, if they are Chan-SIP extensions now, you’ll need to figure out how to set that Chan-SIP port to the one that the phones are expecting to hit. The same can be said of PJ-SIP - the port number that you send the phones to will determine which channel driver handles the call, and as such will drive your “technology” choice.
Always remember - inbound and outbound are different. It really does pay dividends to keep that in mind. As you get more familiar with the system, the little exceptions will pop up, but it’s a good mindset to maintain as you’re trying to configure and set up your connections.
Thank you for once again getting me to think this through …
I did get this working using the 5160 port for the pjsip trunk and then was able to keep the local sip endpoints using the existing port of 5060 … after reading your last post I took a look at the firewall and found that even though I was setting up the trunk to port 5160 and it was registering at port 5160, all of the traffic coming back from Flowroute was on port 5060. You made me re-think and I realized that I do control where data goes that was coming in through the firewall. So I adjusted the NAT rule by forwarding the incoming 5060 traffic from Flowroute to my PBX port 5160. Everything is working now the way I wanted it to and all I have to do on the production system is create the new PJSIP trunk and adjust the Asterisk ports and then adjust the firewall - no need to touch the endpoints.
I wish there was a way that I could have the data to and from Flowroute be on the same port of 5160 … I thought I had it figured out at one point - on the user portal they have a section for creating routes … I tried various ways to configure it to send traffic to my PBX on 5160 but never could get it to work … I am going to email their support and see if I can actually get that to work instead of using the port forwarding rule.
Log into your Flowroute account and tell it your system is at “your_ip:5160”. Most ITSPs allow this kind of redirection so they send the incoming traffic to 5160. You could try sending them an email and ask them the best way to connect to your system on 5160. It could be as simple as setting a field on your account.
yeah that is what I tried to do but it still sent the traffic to 5060 … I will email them and ask. Possibly I had the syntax incorrect - I never could find any tech docs on it.
) you can that up and point your ITSP’s incoming traffic to that port.