mikrotik and Allstar registration problem

I have an Acid (40526) server with an rtcm for radio connection. The mikrotik router has 3 wan connections with the acid server connected to its lan ports as well as the rtcm. My problem is that the registration requests appear to go out an arbitrary wan port rather than the one I want it to use.
I try to force it to use a particular wan by assigning a routing mark based on its ip and then have the desired wan with the same routing mark. This approach works for splitting workstations and servers among the wan’s but the asterisk registration process ignores it.

iax2 registration shows it as perceived as one of the other wans and is not consistent.

traceroute from asterisk server shows it using the desired wan.

This is all mostly over my payscale.

Ross

Hi Ross,

From what you describe, this isn't an Asterisk/AllStar problem at

all--your router is load balancing across multiple Internet (WAN)
connections.

You need to add a source route for the IP address of your Asterisk server
that guarantees that your router always uses the proper WAN connection for
this host.

I recommend finding a -local- MikroTik network guru. The problem with
working on this kind of stuff remotely is that, with one accidental
misstep, you're down and they can't get back in. Oops!

73, David KB4FXC

···

On Thu, 3 Sep 2015, R Dahl wrote:

I have an Acid (40526) server with an rtcm for radio connection. The
mikrotik router has 3 wan connections with the acid server connected to its
lan ports as well as the rtcm. My problem is that the registration
requests appear to go out an arbitrary wan port rather than the one I want
it to use.
I try to force it to use a particular wan by assigning a routing mark based
on its ip and then have the desired wan with the same routing mark. This
approach works for splitting workstations and servers among the wan's but
the asterisk registration process ignores it.

iax2 registration shows it as perceived as one of the other wans and is not
consistent.
traceroute from asterisk server shows it using the desired wan.

This is all mostly over my payscale.

Ross

Well, I have to admit, I wasn’t sure whether this was the right forum either. My network has 3 flaky wifi wan’s and the routing mark/distance settings have allowed for a simple failover system. routing marks are applied by the firewall based on ip’s and works great for everything but the connection from the allstar server to the rtcm or registration server. Other connections from the allstar server work corrrectly and honor the marks, (ssh, telnet, http, etc…)
All this leads me to believe there is something different about the allstar arrangement that I haven’t clued into. I also tried applying the routing marks based on mac but no luck there either. Perhaps port and protocol as well? As you suggest, I will try a mikrotik group

Thanks,

Ross.

···

On Thu, Sep 3, 2015 at 1:47 PM, David McGough kb4fxc@inttek.net wrote:

Hi Ross,

From what you describe, this isn’t an Asterisk/AllStar problem at

all–your router is load balancing across multiple Internet (WAN)

connections.

You need to add a source route for the IP address of your Asterisk server

that guarantees that your router always uses the proper WAN connection for

this host.

I recommend finding a -local- MikroTik network guru. The problem with

working on this kind of stuff remotely is that, with one accidental

misstep, you’re down and they can’t get back in. Oops!

73, David KB4FXC

On Thu, 3 Sep 2015, R Dahl wrote:

I have an Acid (40526) server with an rtcm for radio connection. The

mikrotik router has 3 wan connections with the acid server connected to its

lan ports as well as the rtcm. My problem is that the registration

requests appear to go out an arbitrary wan port rather than the one I want

it to use.

I try to force it to use a particular wan by assigning a routing mark based

on its ip and then have the desired wan with the same routing mark. This

approach works for splitting workstations and servers among the wan’s but

the asterisk registration process ignores it.

iax2 registration shows it as perceived as one of the other wans and is not

consistent.

traceroute from asterisk server shows it using the desired wan.

This is all mostly over my payscale.

Ross

Maybe it’s not marking UDP packets? All the other protocols you listed are TCP. If you want to test another UDP protocol maybe try TFTP. The server side will tell you what IP has hit it.

Jesse

···

On Thu, Sep 3, 2015 at 1:47 PM, David McGough kb4fxc@inttek.net wrote:

Hi Ross,

From what you describe, this isn’t an Asterisk/AllStar problem at

all–your router is load balancing across multiple Internet (WAN)

connections.

You need to add a source route for the IP address of your Asterisk server

that guarantees that your router always uses the proper WAN connection for

this host.

I recommend finding a -local- MikroTik network guru. The problem with

working on this kind of stuff remotely is that, with one accidental

misstep, you’re down and they can’t get back in. Oops!

73, David KB4FXC

On Thu, 3 Sep 2015, R Dahl wrote:

I have an Acid (40526) server with an rtcm for radio connection. The

mikrotik router has 3 wan connections with the acid server connected to its

lan ports as well as the rtcm. My problem is that the registration

requests appear to go out an arbitrary wan port rather than the one I want

it to use.

I try to force it to use a particular wan by assigning a routing mark based

on its ip and then have the desired wan with the same routing mark. This

approach works for splitting workstations and servers among the wan’s but

the asterisk registration process ignores it.

iax2 registration shows it as perceived as one of the other wans and is not

consistent.

traceroute from asterisk server shows it using the desired wan.

This is all mostly over my payscale.

Ross

Posting this again because the list didn’t take my attachment. If you want to see the screenshot contact me off list.

In the mean time here’s the command line way to do it:

ip firewall nat

add action=masquerade chain=srcnat comment=“HairPin NAT” out-interface=ether1-WAN src-address=192.168.1.0/24

add action=dst-nat chain=dstnat comment=“Asterisk AIX” dst-port=4569 in-interface=ether1-WAN protocol=udp to-addresses=\

192.168.1.6 to-ports=4569

···

On Thu, Sep 3, 2015 at 7:29 PM, Tim Sawyer tisawyer@gmail.com wrote:

There is a little thing to know about MikroTik routers and AllStar registration. It took me a long time to sort this out and I almost gave up on MikroTik. But don’t despair they are really good routers.

You have to have both the out-interface and the in-interface set properly on the masquerade rule. If you forget the out interface the AllStar registration packets go to all interfaces. That really confuses Asterisk if you have AllStar on more then one interface.

Let me know if the attached screen shot doesn’t come through.

On Thu, Sep 3, 2015 at 3:32 PM, Jesse Lloyd ve7lyd@gmail.com wrote:

Maybe it’s not marking UDP packets? All the other protocols you listed are TCP. If you want to test another UDP protocol maybe try TFTP. The server side will tell you what IP has hit it.

Jesse

On Sep 3, 2015, at 2:43 PM, R Dahl ve6ars@gmail.com wrote:

Well, I have to admit, I wasn’t sure whether this was the right forum either. My network has 3 flaky wifi wan’s and the routing mark/distance settings have allowed for a simple failover system. routing marks are applied by the firewall based on ip’s and works great for everything but the connection from the allstar server to the rtcm or registration server. Other connections from the allstar server work corrrectly and honor the marks, (ssh, telnet, http, etc…)
All this leads me to believe there is something different about the allstar arrangement that I haven’t clued into. I also tried applying the routing marks based on mac but no luck there either. Perhaps port and protocol as well? As you suggest, I will try a mikrotik group

Thanks,

Ross.


App_rpt-users mailing list
App_rpt-users@ohnosec.org
http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the “Unsubscribe or edit options button”
You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.


App_rpt-users mailing list

App_rpt-users@ohnosec.org

http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the “Unsubscribe or edit options button”

You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

Tim

On Thu, Sep 3, 2015 at 1:47 PM, David McGough kb4fxc@inttek.net wrote:

Hi Ross,

From what you describe, this isn’t an Asterisk/AllStar problem at

all–your router is load balancing across multiple Internet (WAN)

connections.

You need to add a source route for the IP address of your Asterisk server

that guarantees that your router always uses the proper WAN connection for

this host.

I recommend finding a -local- MikroTik network guru. The problem with

working on this kind of stuff remotely is that, with one accidental

misstep, you’re down and they can’t get back in. Oops!

73, David KB4FXC

On Thu, 3 Sep 2015, R Dahl wrote:

I have an Acid (40526) server with an rtcm for radio connection. The

mikrotik router has 3 wan connections with the acid server connected to its

lan ports as well as the rtcm. My problem is that the registration

requests appear to go out an arbitrary wan port rather than the one I want

it to use.

I try to force it to use a particular wan by assigning a routing mark based

on its ip and then have the desired wan with the same routing mark. This

approach works for splitting workstations and servers among the wan’s but

the asterisk registration process ignores it.

iax2 registration shows it as perceived as one of the other wans and is not

consistent.

traceroute from asterisk server shows it using the desired wan.

This is all mostly over my payscale.

Ross

Tim

Great! thanks Tim, and everyone else who offered suggestions.
That got it working consistently.

Ross

···

On Thu, Sep 3, 2015 at 8:55 PM, Tim Sawyer tisawyer@gmail.com wrote:

Posting this again because the list didn’t take my attachment. If you want to see the screenshot contact me off list.

In the mean time here’s the command line way to do it:

ip firewall nat

add action=masquerade chain=srcnat comment=“HairPin NAT” out-interface=ether1-WAN src-address=192.168.1.0/24

add action=dst-nat chain=dstnat comment=“Asterisk AIX” dst-port=4569 in-interface=ether1-WAN protocol=udp to-addresses=\

192.168.1.6 to-ports=4569


There is a little thing to know about MikroTik routers and AllStar registration. It took me a long time to sort this out and I almost gave up on MikroTik. But don’t despair they are really good routers.

You have to have both the out-interface and the in-interface set properly on the masquerade rule. If you forget the out interface the AllStar registration packets go to all interfaces. That really confuses Asterisk if you have AllStar on more then one interface.

On Thu, Sep 3, 2015 at 7:29 PM, Tim Sawyer tisawyer@gmail.com wrote:

There is a little thing to know about MikroTik routers and AllStar registration. It took me a long time to sort this out and I almost gave up on MikroTik. But don’t despair they are really good routers.

You have to have both the out-interface and the in-interface set properly on the masquerade rule. If you forget the out interface the AllStar registration packets go to all interfaces. That really confuses Asterisk if you have AllStar on more then one interface.

Let me know if the attached screen shot doesn’t come through.

Tim

On Thu, Sep 3, 2015 at 3:32 PM, Jesse Lloyd ve7lyd@gmail.com wrote:

Maybe it’s not marking UDP packets? All the other protocols you listed are TCP. If you want to test another UDP protocol maybe try TFTP. The server side will tell you what IP has hit it.

Jesse

On Sep 3, 2015, at 2:43 PM, R Dahl ve6ars@gmail.com wrote:

Well, I have to admit, I wasn’t sure whether this was the right forum either. My network has 3 flaky wifi wan’s and the routing mark/distance settings have allowed for a simple failover system. routing marks are applied by the firewall based on ip’s and works great for everything but the connection from the allstar server to the rtcm or registration server. Other connections from the allstar server work corrrectly and honor the marks, (ssh, telnet, http, etc…)
All this leads me to believe there is something different about the allstar arrangement that I haven’t clued into. I also tried applying the routing marks based on mac but no luck there either. Perhaps port and protocol as well? As you suggest, I will try a mikrotik group

Thanks,

Ross.


App_rpt-users mailing list
App_rpt-users@ohnosec.org
http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the “Unsubscribe or edit options button”
You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.


App_rpt-users mailing list

App_rpt-users@ohnosec.org

http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the “Unsubscribe or edit options button”

You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

Tim

On Thu, Sep 3, 2015 at 1:47 PM, David McGough kb4fxc@inttek.net wrote:

Hi Ross,

From what you describe, this isn’t an Asterisk/AllStar problem at

all–your router is load balancing across multiple Internet (WAN)

connections.

You need to add a source route for the IP address of your Asterisk server

that guarantees that your router always uses the proper WAN connection for

this host.

I recommend finding a -local- MikroTik network guru. The problem with

working on this kind of stuff remotely is that, with one accidental

misstep, you’re down and they can’t get back in. Oops!

73, David KB4FXC

On Thu, 3 Sep 2015, R Dahl wrote:

I have an Acid (40526) server with an rtcm for radio connection. The

mikrotik router has 3 wan connections with the acid server connected to its

lan ports as well as the rtcm. My problem is that the registration

requests appear to go out an arbitrary wan port rather than the one I want

it to use.

I try to force it to use a particular wan by assigning a routing mark based

on its ip and then have the desired wan with the same routing mark. This

approach works for splitting workstations and servers among the wan’s but

the asterisk registration process ignores it.

iax2 registration shows it as perceived as one of the other wans and is not

consistent.

traceroute from asterisk server shows it using the desired wan.

This is all mostly over my payscale.

Ross