Is anyone using a pfsense router in your Asterisk network? While app_rpt seems to work fine it shows a weird port, not 4569, with “iax2 show registry”. I assume pfsense is doing something weird with NAT that I don’t understand. Can anyone shed some light on this subject? -- Tim WD6AWP
Tim, I run PFSense with many of my Allstar nodes. I have to set STATIC outbound NAT for the specific IP addresses that are Asterisk. This will cause them to not pick random ports outbound. I am not sure what iax2 show registry does, but I could not get it to work until I put in a static NAT outbound. Here is a copy of my outbound NAT statement for one of my nodes: WAN 172.16.12.22/32udp/4569*udp/4569WAN address*YES I believe the key is the last YES, which is the STATIC PORT heading. Hope that helps, Mike kb8zgl From: Tim Sawyer <tim.sawyer@mac.com> Date: Friday, August 22, 2014 at 10:52 AM To: "app_rpt-users@ohnosec.org" <app_rpt-users@ohnosec.org> Subject: [App_rpt-users] pfsense router? Is anyone using a pfsense router in your Asterisk network? While app_rpt seems to work fine it shows a weird port, not 4569, with ³iax2 show registry². I assume pfsense is doing something weird with NAT that I don¹t understand. Can anyone shed some light on this subject? -- Tim WD6AWP _______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
I run pfsense as well at every site and also use open VPN at each site. I have never had a problem with them displaying a different port. I also just checked the 4 different boxes at the sites and they all look fine! Sent from my iPhone
On Aug 22, 2014, at 10:56 AM, Michael Wolthuis <wolthuis@gmail.com> wrote:
Tim, I run PFSense with many of my Allstar nodes. I have to set STATIC outbound NAT for the specific IP addresses that are Asterisk. This will cause them to not pick random ports outbound.
I am not sure what iax2 show registry does, but I could not get it to work until I put in a static NAT outbound.
Here is a copy of my outbound NAT statement for one of my nodes:
WAN 172.16.12.22/32 udp/4569 * udp/4569 WAN address * YES
I believe the key is the last YES, which is the STATIC PORT heading.
Hope that helps, Mike kb8zgl
From: Tim Sawyer <tim.sawyer@mac.com> Date: Friday, August 22, 2014 at 10:52 AM To: "app_rpt-users@ohnosec.org" <app_rpt-users@ohnosec.org> Subject: [App_rpt-users] pfsense router?
Is anyone using a pfsense router in your Asterisk network? While app_rpt seems to work fine it shows a weird port, not 4569, with “iax2 show registry”. I assume pfsense is doing something weird with NAT that I don’t understand. Can anyone shed some light on this subject?
-- Tim WD6AWP
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. _______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
Mike, Thanks I’ll try that as soon as the pfsense router gets reinstalled. Just for grins could you do “iax2 show registry”? Is the perceived port correct? *CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 67.215.233.178:4569 N 2504 108.13.3.89:4569 60 Registered -- Tim WD6AWP
On Aug 22, 2014, at 7:56 AM, Michael Wolthuis <wolthuis@gmail.com> wrote:
Tim, I run PFSense with many of my Allstar nodes. I have to set STATIC outbound NAT for the specific IP addresses that are Asterisk. This will cause them to not pick random ports outbound.
I am not sure what iax2 show registry does, but I could not get it to work until I put in a static NAT outbound.
Here is a copy of my outbound NAT statement for one of my nodes:
WAN 172.16.12.22/32 udp/4569 * udp/4569 WAN address * YES
I believe the key is the last YES, which is the STATIC PORT heading.
Hope that helps, Mike kb8zgl
From: Tim Sawyer <tim.sawyer@mac.com <mailto:tim.sawyer@mac.com>> Date: Friday, August 22, 2014 at 10:52 AM To: "app_rpt-users@ohnosec.org <mailto:app_rpt-users@ohnosec.org>" <app_rpt-users@ohnosec.org <mailto:app_rpt-users@ohnosec.org>> Subject: [App_rpt-users] pfsense router?
Is anyone using a pfsense router in your Asterisk network? While app_rpt seems to work fine it shows a weird port, not 4569, with “iax2 show registry”. I assume pfsense is doing something weird with NAT that I don’t understand. Can anyone shed some light on this subject?
-- Tim WD6AWP
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org <mailto:App_rpt-users@ohnosec.org> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users <http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users> To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users <http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users> and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. _______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
KB8ZGL*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 67.215.233.178:4569 N 28881 24.247.58.57:4569 60 Registered 67.215.233.178:4569 N 28241 24.247.58.57:4569 60 Registered Mine matches for both of my nodes on that machine, which is behind my PFSense firewall. I am actually accessing it via OpenVPN right now, as the other person stated. Mike From: Tim Sawyer <tim.sawyer@mac.com> Date: Friday, August 22, 2014 at 11:01 AM To: Michael Wolthuis <wolthuis@gmail.com> Cc: "app_rpt-users@ohnosec.org" <app_rpt-users@ohnosec.org> Subject: Re: [App_rpt-users] pfsense router? Mike, Thanks I¹ll try that as soon as the pfsense router gets reinstalled. Just for grins could you do ³iax2 show registry²? Is the perceived port correct? *CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 67.215.233.178:4569 N 2504 108.13.3.89:4569 60 Registered -- Tim WD6AWP
On Aug 22, 2014, at 7:56 AM, Michael Wolthuis <wolthuis@gmail.com> wrote:
Tim, I run PFSense with many of my Allstar nodes. I have to set STATIC outbound NAT for the specific IP addresses that are Asterisk. This will cause them to not pick random ports outbound.
I am not sure what iax2 show registry does, but I could not get it to work until I put in a static NAT outbound.
Here is a copy of my outbound NAT statement for one of my nodes:
WAN 172.16.12.22/32udp/4569*udp/4569WAN address*YES
I believe the key is the last YES, which is the STATIC PORT heading.
Hope that helps, Mike kb8zgl
From: Tim Sawyer <tim.sawyer@mac.com> Date: Friday, August 22, 2014 at 10:52 AM To: "app_rpt-users@ohnosec.org" <app_rpt-users@ohnosec.org> Subject: [App_rpt-users] pfsense router?
Is anyone using a pfsense router in your Asterisk network? While app_rpt seems to work fine it shows a weird port, not 4569, with ³iax2 show registry². I assume pfsense is doing something weird with NAT that I don¹t understand. Can anyone shed some light on this subject?
-- Tim WD6AWP
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.orghttp://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-u sers To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. _______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
By default pfsense will rewrite the port. https://doc.pfsense.org/index.php/VoIP_Configuration On Friday, August 22, 2014, Michael Wolthuis <wolthuis@gmail.com> wrote:
KB8ZGL*CLI> iax2 show registry
Host dnsmgr Username Perceived Refresh State
67.215.233.178:4569 N 28881 24.247.58.57:4569 60 Registered
67.215.233.178:4569 N 28241 24.247.58.57:4569 60 Registered
Mine matches for both of my nodes on that machine, which is behind my PFSense firewall. I am actually accessing it via OpenVPN right now, as the other person stated.
Mike
From: Tim Sawyer <tim.sawyer@mac.com <javascript:_e(%7B%7D,'cvml','tim.sawyer@mac.com');>> Date: Friday, August 22, 2014 at 11:01 AM To: Michael Wolthuis <wolthuis@gmail.com <javascript:_e(%7B%7D,'cvml','wolthuis@gmail.com');>> Cc: "app_rpt-users@ohnosec.org <javascript:_e(%7B%7D,'cvml','app_rpt-users@ohnosec.org');>" < app_rpt-users@ohnosec.org <javascript:_e(%7B%7D,'cvml','app_rpt-users@ohnosec.org');>> Subject: Re: [App_rpt-users] pfsense router?
Mike,
Thanks I’ll try that as soon as the pfsense router gets reinstalled. Just for grins could you do “iax2 show registry”? Is the perceived port correct?
*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 67.215.233.178:4569 N 2504 108.13.3.89:4569 60 Registered -- Tim WD6AWP
On Aug 22, 2014, at 7:56 AM, Michael Wolthuis <wolthuis@gmail.com <javascript:_e(%7B%7D,'cvml','wolthuis@gmail.com');>> wrote:
Tim, I run PFSense with many of my Allstar nodes. I have to set STATIC outbound NAT for the specific IP addresses that are Asterisk. This will cause them to not pick random ports outbound.
I am not sure what iax2 show registry does, but I could not get it to work until I put in a static NAT outbound.
Here is a copy of my outbound NAT statement for one of my nodes:
WAN 172.16.12.22/32udp/4569*udp/4569WAN address*YES
I believe the key is the last YES, which is the STATIC PORT heading.
Hope that helps, Mike kb8zgl
From: Tim Sawyer <tim.sawyer@mac.com <javascript:_e(%7B%7D,'cvml','tim.sawyer@mac.com');>> Date: Friday, August 22, 2014 at 10:52 AM To: "app_rpt-users@ohnosec.org <javascript:_e(%7B%7D,'cvml','app_rpt-users@ohnosec.org');>" < app_rpt-users@ohnosec.org <javascript:_e(%7B%7D,'cvml','app_rpt-users@ohnosec.org');>> Subject: [App_rpt-users] pfsense router?
Is anyone using a pfsense router in your Asterisk network? While app_rpt seems to work fine it shows a weird port, not 4569, with “iax2 show registry”. I assume pfsense is doing something weird with NAT that I don’t understand. Can anyone shed some light on this subject?
-- Tim WD6AWP
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org <javascript:_e(%7B%7D,'cvml','App_rpt-users@ohnosec.org');> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. _______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org <javascript:_e(%7B%7D,'cvml','App_rpt-users@ohnosec.org');> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Andrew Sylthe KC9ONA
The solution to this is to set up the outbound NAT like this: And then do Diagnostics -> States -> Filter on the node’s IP address -> Kill. All services including ssh will be temporarily dropped and automatically restarted. Thank you Mike KB6GZL for your help with this -- Tim :wq On Aug 22, 2014, at 8:01 AM, Tim Sawyer <tim.sawyer@mac.com> wrote:
Mike,
Thanks I’ll try that as soon as the pfsense router gets reinstalled. Just for grins could you do “iax2 show registry”? Is the perceived port correct?
*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 67.215.233.178:4569 N 2504 108.13.3.89:4569 60 Registered -- Tim WD6AWP
On Aug 22, 2014, at 7:56 AM, Michael Wolthuis <wolthuis@gmail.com> wrote:
Tim, I run PFSense with many of my Allstar nodes. I have to set STATIC outbound NAT for the specific IP addresses that are Asterisk. This will cause them to not pick random ports outbound.
I am not sure what iax2 show registry does, but I could not get it to work until I put in a static NAT outbound.
Here is a copy of my outbound NAT statement for one of my nodes:
I believe the key is the last YES, which is the STATIC PORT heading.
Hope that helps, Mike kb8zgl
From: Tim Sawyer <tim.sawyer@mac.com> Date: Friday, August 22, 2014 at 10:52 AM To: "app_rpt-users@ohnosec.org" <app_rpt-users@ohnosec.org> Subject: [App_rpt-users] pfsense router?
Is anyone using a pfsense router in your Asterisk network? While app_rpt seems to work fine it shows a weird port, not 4569, with “iax2 show registry”. I assume pfsense is doing something weird with NAT that I don’t understand. Can anyone shed some light on this subject?
-- Tim WD6AWP
Is this how yours looks? It still gives me *CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 67.215.233.178:4569 N 2521 162.218.153.251:6361 60 Registered 67.215.233.178:4569 N 2232 162.218.153.251:6361 60 Registered 67.215.233.178:4569 N 27685 162.218.153.251:6361 60 Registered -- Tim :wq On Aug 22, 2014, at 7:56 AM, Michael Wolthuis <wolthuis@gmail.com> wrote:
Tim, I run PFSense with many of my Allstar nodes. I have to set STATIC outbound NAT for the specific IP addresses that are Asterisk. This will cause them to not pick random ports outbound.
I am not sure what iax2 show registry does, but I could not get it to work until I put in a static NAT outbound.
Here is a copy of my outbound NAT statement for one of my nodes:
WAN 172.16.12.22/32 udp/4569 * udp/4569 WAN address * YES
I believe the key is the last YES, which is the STATIC PORT heading.
Hope that helps, Mike kb8zgl
From: Tim Sawyer <tim.sawyer@mac.com> Date: Friday, August 22, 2014 at 10:52 AM To: "app_rpt-users@ohnosec.org" <app_rpt-users@ohnosec.org> Subject: [App_rpt-users] pfsense router?
Is anyone using a pfsense router in your Asterisk network? While app_rpt seems to work fine it shows a weird port, not 4569, with “iax2 show registry”. I assume pfsense is doing something weird with NAT that I don’t understand. Can anyone shed some light on this subject?
-- Tim WD6AWP
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. _______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
participants (4)
-
Andrew Sylthe -
Corey Dean -
Michael Wolthuis -
Tim Sawyer