SIP phone through ASL node works from LAN, not from WAN

AllStarLink
1

Hello SIP phone wizards.

My node (Debian 12 / ASL 3) and phone (Polycom VVX 401) work great together when I am inside my LAN. I can dial my node and execute DTMF commands to reach other nodes outside my network.

I have a second Polycom phone in my work office about 135 miles away and have been unsuccessful at connecting it to my node to do the same thing: dial up other nodes and participate in nets over the SIP phone.

Ports are open, firewall is set up to pass the port traffic, and port forwards are configured. The Asterisk CLI sees the traffic when I initiate a call from inside my LAN but detects nothing when I try to call from outside the LAN.

I feel like I’m missing something obvious and am hoping for some hints from folks who have done this already.

Thanks,

Tom KJ7T

2

Assuming this is getting past the firewall,
Show the sip extension definition in sip.conf where you qualify the ip phone.
Mask passwords.

oh…
You do have the sip port forwarded to the computer ?

3

It should be getting past the firewall, port 5060 UDP. ISP is passing packets on that port, router has port forwarding set up to point to the ASL node, and the node’s firewall (UFW) has 5060 allowed.

portchecktool.com says: “Success! I can see your service on x.x.x.x on port (5060)”

This is ASL 3, so pjsip.conf, not sip.conf.

In pjsip.conf, in “ENDPOINT CONFIGURED FOR USE WITH A SIP PHONE”, I have transport defined as (and this works with my LAN phone):

[100]
type=endpoint
transport=transport-udp
context=sip-phones
disallow=all
allow=ulaw
auth=100
aors=100
dtmf_mode=rfc4733
callerid=“KJ7T”

A little farther down:

[100]
type=auth
auth_type=userpass
password=xxxxxxxxx
username=100

and then:

[100]
type=aor
max_contacts=4

4

Did you set-up your phone to use '‘authid’ ?

Verify the port use in the phone while you are in there looking.

If you watch asterisk in the foreground, do you see any activity related to it’s attempt to connect ?

5

Thanks Mike. Yes on auth. Port verified. Asterisk shows nothing, so nothing is reaching Asterisk.

The error reported on the phone is “Line: Unregistered”, indicating either the credentials are wrong or they aren’t making it to the ASL node. But I’ve double/triple/quadruple checked those.

I am beginning to think it is the addressing from the phone to the remote node, but using different combinations of local and public/WAN addresses isn’t working (yet), either.

6

So, 2 more things to look at.
Since the inbound is outside your nat.
Asterisk kinda needs to know the network it is playing in.
At the top gen section of sip.conf

externip = 155.135.xxx.xxx
localnet = 192.168.1.0/255.255.255.0

And perhaps a review of the qualifying extension…
Make sure if you have used deny/permit=
if you have an entry for the ext ip so it is allowed to connect.

[5009] ; Mancave Den
deny=0.0.0.0/0.0.0.0
permit=172.59.15.0/24
permit=73.120.107.78
permit=192.168.1.0/24

It’s kinda a secondary firewall.

And this in the phone qualify

nat=force_rport,comedia

You may already have this covered, but it’s just a checklist.
It seems the phone is not allowed to qualify.
You would probably have to watch asterisk when it is trying to register to see anything.
And perhaps not even then.
It’s often easier to use a softphone with live debug to see what is happening if you are still stumped.

7

I probably should have noted, in the case it was just overlooked,
this extension should be unique, not the same as your home, for it is likely already registered.

Yea, you probably know that, but I have to say it.

8

I think I’ve done that. The home extension is 100, the remote extension is 200. I have different contexts set up in /etc/asterisk/extensions.conf for those two instances, and in pjsip.conf, 200 has a different configuration. No joy yet. I’m going to pull the plug for tonight and let my brain rest a bit.

Thanks for diving down this hole with me for a while!

9

OK folks, I’m looking for a guide. The situation is:

  1. Two SIP phones, one AllStarLink node running Debian 12 and ASL 3.
  2. One phone is inside the LAN, the other is outside on the WAN.
  3. Both phones register, but the WAN phone has no audio.
  4. UDP ports 4569, 5060, and 5038 are open on the node.
  5. Still confirming if they are open on the firewall.

I’ve been trying to recreate this setup to help a friend and I am running in to the same thing: the SIP phone on my LAN works fine but the SIP phone on the WAN either won’t register or has no audio.

Does anyone have a clear explanation of how to configure rpt.conf and pjsip.conf to accommodate this scenario?

Thanks much,

Tom KJ7T