" Full cone NAT" + VOIP ?

[#1]

We are evaluation the 3CX VOIP Software Based PBX which on the whole is working well apart from incoming calls where we seem to have a firewall issue. The firewall is a Fortigate 60B and the VOIP system resides on an internal IP of 172.16.1.21. Our provider has stated that :

The following ports need to be open: 
  
 5060 TCP & UDP 
 10000 – 20000 UDP

However in the 3CX system you can restrict the number of ports being used, for testing I set this to 9000 to 9001 UDP. The firewall test fails with : 1 9000 Error (4) The STUN server returned an ip which is not accessible from outside. addrFromSTUN = 84.45.179.66:55492 2 9000 Error (6) An incompatible NAT configuration has been detected. Please check FAQ for further information. addrFromAgent = 84.45.179.66:55494addrFromSTUN = 84.45.179.66:55492 3 9000 Warning (8) Local port is not blocked from outside. STUN server has returned global port different from the local one, but the local port is also accessible from outside. 4 9000 Error (10) Port is open, but port number has been changed during NAT translation. THIS ERROR means you have Symmetric NAT and you do not have STATIC PORT MAPPINGS in place. 3CX Phone System will not communicated correctly with your VOIP provider or external extensions. See this FAQ: http://www.3cx.com/support/firewal-checker.html externalAddress = 84.45.179.66:55492 The solution from 3CX was to upgrade to a better firewall such as a Draytek(!) The solution appears to be to use " Full Cone NAT" or basically a Virtual IP to forward all the ports from a given external IP address to the LAN address 172.16.1.21. The problem I have is the external address 84.45.179.66 is being used for a SMTP VIP as well. Is there anyway to make traffic from a given internal IP (172.16.1.21) to go out via a different external IP address ? All my interfaces are currently in use and the WAN1 is the only interface on the 84.45.179.X network. Or do I have to move my DNS entries for e-mail ? Hope this makes some sense.

[MasterBratac]

Is there anyway to make traffic from a given internal IP (172.16.1.21) to go out via a different external IP address ? All my interfaces are currently in use and the WAN1 is the only interface on the 84.45.179.X network. Or do I have to move my DNS entries for e-mail ?

If you have multiple adresses in the 84.45.179.X network, add them as secondary ip adresses to your wan interface. Then you could create an ip pool with a single secondary adress, and assign it to an outgoing rule of your voip server. By this way every traffic that comes out of your voip server will have this secondary address as source address. Then create a vip with tjis secondary adress and point it to your voip machine. If you have only one external address, you should be able to create to vips as portforwarding ... Crate a vip for tcp/25 and point it to your smtp server and create a vip eg. 26-65535 and point it to your voip server.

[#3]

If you have multiple adresses in the 84.45.179.X network, add them as secondary ip adresses to your wan interface. Then you could create an ip pool with a single secondary adress, and assign it to an outgoing rule of your voip server. By this way every traffic that comes out of your voip server will have this secondary address as source address. Then create a vip with tjis secondary adress and point it to your voip machine.

Yeah I tried this. My WAN1 IP is 84.45.179.66/255.255.255.248. I tried to add a secondary IP of 84.45.179.67/255.255.255.248 but get the following error : IP address is in same subnet as the others.

[#4]

Ok let me try break this down. I know the firewall is causing an issue with incoming calls as I' ve run a client externally to the firewall and it rings in fine. So firstly I will try and get the VOIP server appearing to come from an external address. As suggested by Maik I went to Firewall->VIP and added one call VOIP_IP with an address of 84.45.179.67 (A free IP). I then created an address book entry for the VOIP server called VOIP_SERVER 172.16.1.21. Then created an INTERNAL->WAN1 rule Source VOIP_SERVER destination WAN1 all. NAT was checked and so was Dynamic IP Pool (Selected VOIP_SERVER). This rule was placed ABOVE all my existing outgoing rules so it should fire first. From my regular clients I did an IP Check and they reported correctly as 84.45.179.66. I did the same from the VOIP server and was expecting to see 84.45.179.67 but it still says .66. Any ideas?

[p768]

how are you testing your ip address from the server? do you use a proxy server for internet browsing?

[#6]

I have an IP Checker on our website (http://www.nevis.co.uk/ipcheck.php) And no don' t use a proxy. Also tested it by telnetting to an external mail server :

220-ESMTP Exim 4.69 #1 Wed, 15 Oct 2008 11:31:48 +0100
 220-We do not authorize the use of this system to transport unsolicited,
 220 and/or bulk e-mail.
 ehlo
 250- Hello smtp.nevis.co.uk [84.45.179.66]
 

[#7]

Where is the count column ? I can' t seem to find it.

[#8]

Thanks learn something new everyday. Looks like that rule isn' t firing.

[p768]

You should also see the connections from the server in the Session Table. This will tell you which rule the outbout connections are using.

[#10]

Ok getting somewhere, the reason the rule wasn' t firing is the VMWare machine had 2 NIC' s in which had both got local IP' s so it was going out on the wrong one. That' s now fixed and I can see connection attempts out via that rule. If I remove the check in Dynamic IP Pool VOIP_SERVER the VOIP server can connect out correctly. If I check it the server can no longer connect to the internet.