Pfsense and Local FreePBX - No Incoming Audio - Outbound Working

Networking & Firewalls
1

Hello All,

I have spent the weekend replacing my school’s EdgeRouter Infinity with a pfsense box (I’m a school network admin). When I was on the EdgeRouter, the FreePBX install worked perfectly. I finished moving all of the settings over to pfsense, and tested by picking up my desk phone and dialing out. The call worked fine, had two-way audio… I thought life was good. That was about 9 hours ago. Since then, I have googled everything I can think of to get this working. Here is what I’ve tried:

  • 1:1 NAT (This was my first choice as I have a /26 of public addresses provided by my ISP, and one has been dedicated to the FreePBX box since I built it in 2017)
  • Follow the pfSense manual’s instructions for using port forwarding and an outbound NAT with the static port setting
  • Doing both at the same time (which is dumb, but I started getting desperate)
  • Hard coded the values
  • Used Aliases (to make sure I didn’t typo one of the other 10 times I did it)
  • Followed along with this video: Firewall Best Practices for VoIP on pfSense - YouTube with both options for a local PBX.
  • Disabled NAT for outbound
  • Cleared the states a lot of times
  • Fully taken down the network and rebooted
  • Lots more Googling

My network is ISP > pfsense > Switch > Vlan 100 (10.62.100.0/24) > FreePBX (10.62.100.10) & Phones.

My SIP trunk authenticates via the IP.

In the packet capture, I was seeing that the RTP stream source port for the INCOMING connection was being changed at the destination, but now I don’t see the RTP stream in the packet capture at all.

The calls look normal in FreePBX until they disconnect because of the silence after about 30 seconds.

If anyone has advice out there that isn’t just " set up an outbound NAT with static ports," I would greatly appreciate it.

This is a link to a google drive folder with screenshots of both the 1:1 config and the Port Forwarding/Outbound NAT config: pfSense PBX Configs - Google Drive

Thanks in advance!

2

I don’t use FreePBX anymore but I never had that many problems with one exception: one of the carriers we used needed a timeout setting change so it would do a keep alive longer and not drop calls. there might be a way you can set the keep alive to be longer inside a PF sense but I don’t know where that setting is.

You may want to cross post this in the netgate forums as well.

3

You may have to change the udmp timeouts of pfsense

the default UDP timeouts in pf are too low for some VoIP services. If phones mostly work, but randomly disconnect, set Firewall Optimization Options to Conservative under System > Advanced, Firewall/NAT tab.

A keep-alive or re-registration on the phone set for 20-30 seconds or so can also help, and is often a better solution.

4

This has been resolved with the help of you wonderful people and a fellow school tech. The newest version of FreePBX (16.0.40.4) has a bug that doesn’t populate the sip.conf file when adding NAT Settings to System > Asterisk SIP Settings.

Adding these options manually to /etc/asterisk/sip_general_custom.conf resolved the issue:

nat=yes
externip=My.Pub.IP.Add
localnet= 10.0.0.0/8

Thanks so much for all of the help!

1 Like