Skip to main content
A
Anonymous_User
New Contributor III
October 13, 2008
Question

" Full cone NAT" + VOIP ?

  • October 13, 2008
  • 10 replies
  • 22658 views
We are evaluation the 3CX VOIP Software Based PBX which on the whole is working well apart from incoming calls where we seem to have a firewall issue. The firewall is a Fortigate 60B and the VOIP system resides on an internal IP of 172.16.1.21. Our provider has stated that : 
The following ports need to be open:      5060 TCP & UDP   10000 – 20000 UDP
However in the 3CX system you can restrict the number of ports being used, for testing I set this to 9000 to 9001 UDP. The firewall test fails with : 1 9000 Error (4) The STUN server returned an ip which is not accessible from outside. addrFromSTUN = 84.45.179.66:55492 2 9000 Error (6) An incompatible NAT configuration has been detected. Please check FAQ for further information. addrFromAgent = 84.45.179.66:55494addrFromSTUN = 84.45.179.66:55492 3 9000 Warning (8) Local port is not blocked from outside. STUN server has returned global port different from the local one, but the local port is also accessible from outside. 4 9000 Error (10) Port is open, but port number has been changed during NAT translation. THIS ERROR means you have Symmetric NAT and you do not have STATIC PORT MAPPINGS in place. 3CX Phone System will not communicated correctly with your VOIP provider or external extensions. See this FAQ: http://www.3cx.com/support/firewal-checker.html externalAddress = 84.45.179.66:55492 The solution from 3CX was to upgrade to a better firewall such as a Draytek(!) The solution appears to be to use " Full Cone NAT" or basically a Virtual IP to forward all the ports from a given external IP address to the LAN address 172.16.1.21. The problem I have is the external address 84.45.179.66 is being used for a SMTP VIP as well. Is there anyway to make traffic from a given internal IP (172.16.1.21) to go out via a different external IP address ? All my interfaces are currently in use and the WAN1 is the only interface on the 84.45.179.X network. Or do I have to move my DNS entries for e-mail ? Hope this makes some sense.

    10 replies

    MasterBratac
    MasterBratac
    New Member
    October 13, 2008
    Is there anyway to make traffic from a given internal IP (172.16.1.21) to go out via a different external IP address ? All my interfaces are currently in use and the WAN1 is the only interface on the 84.45.179.X network. Or do I have to move my DNS entries for e-mail ?
    If you have multiple adresses in the 84.45.179.X network, add them as secondary ip adresses to your wan interface. Then you could create an ip pool with a single secondary adress, and assign it to an outgoing rule of your voip server. By this way every traffic that comes out of your voip server will have this secondary address as source address. Then create a vip with tjis secondary adress and point it to your voip machine. If you have only one external address, you should be able to create to vips as portforwarding ... Crate a vip for tcp/25 and point it to your smtp server and create a vip eg. 26-65535 and point it to your voip server.
    A
    Anonymous_UserAuthor
    New Contributor III
    October 13, 2008
    If you have multiple adresses in the 84.45.179.X network, add them as secondary ip adresses to your wan interface. Then you could create an ip pool with a single secondary adress, and assign it to an outgoing rule of your voip server. By this way every traffic that comes out of your voip server will have this secondary address as source address. Then create a vip with tjis secondary adress and point it to your voip machine.
    Yeah I tried this. My WAN1 IP is 84.45.179.66/255.255.255.248. I tried to add a secondary IP of 84.45.179.67/255.255.255.248 but get the following error : IP address is in same subnet as the others.
    A
    Anonymous_UserAuthor
    New Contributor III
    October 13, 2008
    Ok let me try break this down. I know the firewall is causing an issue with incoming calls as I' ve run a client externally to the firewall and it rings in fine. So firstly I will try and get the VOIP server appearing to come from an external address. As suggested by Maik I went to Firewall->VIP and added one call VOIP_IP with an address of 84.45.179.67 (A free IP). I then created an address book entry for the VOIP server called VOIP_SERVER 172.16.1.21. Then created an INTERNAL->WAN1 rule Source VOIP_SERVER destination WAN1 all. NAT was checked and so was Dynamic IP Pool (Selected VOIP_SERVER). This rule was placed ABOVE all my existing outgoing rules so it should fire first. From my regular clients I did an IP Check and they reported correctly as 84.45.179.66. I did the same from the VOIP server and was expecting to see 84.45.179.67 but it still says .66. Any ideas?
    p768
    p768
    New Member
    October 15, 2008
    how are you testing your ip address from the server? do you use a proxy server for internet browsing?
    A
    Anonymous_UserAuthor
    New Contributor III
    October 15, 2008
    I have an IP Checker on our website (http://www.nevis.co.uk/ipcheck.php) And no don' t use a proxy. Also tested it by telnetting to an external mail server : 
    220-ESMTP Exim 4.69 #1 Wed, 15 Oct 2008 11:31:48 +0100  220-We do not authorize the use of this system to transport unsolicited,  220 and/or bulk e-mail.  ehlo  250- Hello smtp.nevis.co.uk [84.45.179.66]
    A
    Anonymous_UserAuthor
    New Contributor III
    October 15, 2008
    Where is the count column ? I can' t seem to find it.
    A
    Anonymous_UserAuthor
    New Contributor III
    October 15, 2008
    Thanks learn something new everyday. Looks like that rule isn' t firing.
    p768
    p768
    New Member
    October 15, 2008
    You should also see the connections from the server in the Session Table. This will tell you which rule the outbout connections are using.
    A
    Anonymous_UserAuthor
    New Contributor III
    October 15, 2008
    Ok getting somewhere, the reason the rule wasn' t firing is the VMWare machine had 2 NIC' s in which had both got local IP' s so it was going out on the wrong one. That' s now fixed and I can see connection attempts out via that rule. If I remove the check in Dynamic IP Pool VOIP_SERVER the VOIP server can connect out correctly. If I check it the server can no longer connect to the internet.
    A
    Anonymous_UserAuthor
    New Contributor III
    October 15, 2008
    Well I' ve actually got it working. I' ve moved all my VIP' s away from the WAN1 IP address and put a Static NAT entry on there to the Phone System. Doesn' t explain why the phone system wouldn' t go out using the IP POOL but it' s working now so I' ll stick with it. Thanks everyone for all your help was appreciated.
    A
    Anonymous_UserAuthor
    New Contributor III
    October 15, 2008
    Yeah it works a treat can wholly recommend it. You can have a full 10 extension VOIP PBX system for less then £3000 including handsets. The flexibility is amazing, remote workers who can have an internal extension half way round the world anyone ? I think the Phone System connects into to the VOIP provider on a regular basis keeping the connection alive. Right I' m off to work out how to implement a PBX to SkyPE connector now!
    laf
    laf
    New Member
    October 16, 2008
    Now that everything works fine, could you posts the firewall configuration again, only the rules you re using. And if possible, not graphical, just the CLI configuration ;)
    Terms & ConditionsAccessibility statement