BIG registration problem this morning
This morning ALL my nodes are somehow reporting wrong AllStar port numbers from Registration server. Every one of them. A search shows port 54799, shown below for my node 27034. But the actual port I have defined everywhere is and should be 44569! Where did that 54799 number come from? All my incoming connections are down at this point. AllStar Node Number Search for: "27034" --------------------------------------- 27034 KN2R [HUB2] Cape Coral, SW Florida, USA DNS DNS radio@76.101.48.66:54799/27034 Paul / KN2R
We're looking into this. Is your correct port really 44569? On Sun, Aug 12, 2018 at 5:44 AM Paul - KN2R <paulkn2r@gmail.com> wrote:
This morning ALL my nodes are somehow reporting wrong AllStar port numbers from Registration server. Every one of them.
A search shows port 54799, shown below for my node 27034.
But the actual port I have defined everywhere is and should be 44569!
Where did that 54799 number come from? All my incoming connections are down at this point.
AllStar Node Number Search for: "27034" ---------------------------------------
27034
KN2R
[HUB2]
Cape Coral, SW Florida, USA
DNS DNS radio@76.101.48.66:54799/27034
Paul / KN2R
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Tim WD6AWP
Yes 44569. From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Tim Sawyer Sent: Sunday, August 12, 2018 11:17 AM To: Users of Asterisk app_rpt Subject: Re: [App_rpt-users] BIG registration problem this morning We're looking into this. Is your correct port really 44569? On Sun, Aug 12, 2018 at 5:44 AM Paul - KN2R <paulkn2r@gmail.com> wrote: This morning ALL my nodes are somehow reporting wrong AllStar port numbers from Registration server. Every one of them. A search shows port 54799, shown below for my node 27034. But the actual port I have defined everywhere is and should be 44569! Where did that 54799 number come from? All my incoming connections are down at this point. AllStar Node Number Search for: "27034" --------------------------------------- 27034 KN2R [HUB2] Cape Coral, SW Florida, USA DNS DNS radio@76.101.48.66:54799/27034 Paul / KN2R _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. -- Tim WD6AWP
On 8/12/18 9:11 AM, Paul - KN2R wrote:
This morning ALL my nodes are somehow reporting wrong AllStar port numbers from Registration server. Every one of them.
A search shows port 54799, shown below for my node 27034.
But the actual port I have defined everywhere is and should be 44569!
Where did that 54799 number come from? All my incoming connections are down at this point.
From the server:
iax2 show peer 27034 * Name : 27034 Description : Secret : <Set> Context : radio-in Parking lot : Mailbox : Dynamic : Yes Callnum limit: 0 Calltoken req: No Trunk : No Encryption : No Callerid : "" <> Expire : 45018 ACL : No Addr->IP : 76.101.48.66 Port 54799 Defaddr->IP : (null) Port (null) Username : Codecs : (gsm|ulaw|alaw|g726aal2|adpcm|slin|g729|speex|ilbc|g726|g722|siren7|siren14|slin16) Codec Order : (ulaw|alaw|siren14|siren7|g722|slin16|slin|g726|g726aal2|adpcm|gsm|ilbc|speex|g729) Status : Unmonitored Qualify : every 60000ms when OK, every 10000ms when UNREACHABLE (sample smoothing Off) You're registering with that port number. Can you check your bound port number? Thanks, -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net
I have all set and been using port 44569 for well over a year on that server. Now this morning the registration server is reporting the incorrect port number of 54799. I Never used that number. Now inbound connections are not working any more. Paul -----Original Message----- From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Bryan Fields Sent: Sunday, August 12, 2018 11:27 AM To: app_rpt-users@lists.allstarlink.org Subject: Re: [App_rpt-users] BIG registration problem this morning On 8/12/18 9:11 AM, Paul - KN2R wrote:
This morning ALL my nodes are somehow reporting wrong AllStar port numbers from Registration server. Every one of them.
A search shows port 54799, shown below for my node 27034.
But the actual port I have defined everywhere is and should be 44569!
Where did that 54799 number come from? All my incoming connections are down at this point.
From the server:
iax2 show peer 27034 * Name : 27034 Description : Secret : <Set> Context : radio-in Parking lot : Mailbox : Dynamic : Yes Callnum limit: 0 Calltoken req: No Trunk : No Encryption : No Callerid : "" <> Expire : 45018 ACL : No Addr->IP : 76.101.48.66 Port 54799 Defaddr->IP : (null) Port (null) Username : Codecs : (gsm|ulaw|alaw|g726aal2|adpcm|slin|g729|speex|ilbc|g726|g722|siren7|siren14| slin16) Codec Order : (ulaw|alaw|siren14|siren7|g722|slin16|slin|g726|g726aal2|adpcm|gsm|ilbc|spee x|g729) Status : Unmonitored Qualify : every 60000ms when OK, every 10000ms when UNREACHABLE (sample smoothing Off) You're registering with that port number. Can you check your bound port number? Thanks, -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
Both asterisk and tcpdump show the wrong port being reported. Sometimes NAT routers get confused. Could you try rebooting your router? On Sun, Aug 12, 2018 at 8:39 AM Paul - KN2R <paulkn2r@gmail.com> wrote:
I have all set and been using port 44569 for well over a year on that server. Now this morning the registration server is reporting the incorrect port number of 54799. I Never used that number. Now inbound connections are not working any more.
Paul
-----Original Message----- From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Bryan Fields Sent: Sunday, August 12, 2018 11:27 AM To: app_rpt-users@lists.allstarlink.org Subject: Re: [App_rpt-users] BIG registration problem this morning
On 8/12/18 9:11 AM, Paul - KN2R wrote:
This morning ALL my nodes are somehow reporting wrong AllStar port numbers from Registration server. Every one of them.
A search shows port 54799, shown below for my node 27034.
But the actual port I have defined everywhere is and should be 44569!
Where did that 54799 number come from? All my incoming connections are down at this point.
From the server:
iax2 show peer 27034
* Name : 27034 Description : Secret : <Set> Context : radio-in Parking lot : Mailbox : Dynamic : Yes Callnum limit: 0 Calltoken req: No Trunk : No Encryption : No Callerid : "" <> Expire : 45018 ACL : No Addr->IP : 76.101.48.66 Port 54799 Defaddr->IP : (null) Port (null) Username : Codecs :
(gsm|ulaw|alaw|g726aal2|adpcm|slin|g729|speex|ilbc|g726|g722|siren7|siren14| slin16) Codec Order :
(ulaw|alaw|siren14|siren7|g722|slin16|slin|g726|g726aal2|adpcm|gsm|ilbc|spee x|g729) Status : Unmonitored Qualify : every 60000ms when OK, every 10000ms when UNREACHABLE (sample smoothing Off)
You're registering with that port number. Can you check your bound port number?
Thanks,
-- Bryan Fields
727-409-1194 - Voice http://bryanfields.net _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Tim WD6AWP
The portal has a port in it and that’s where you used to specify the port for the rpt_extnodes file to resolve the incorrect reported port. From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Tim Sawyer Sent: Sunday, August 12, 2018 12:06 PM To: Users of Asterisk app_rpt <app_rpt-users@lists.allstarlink.org> Subject: Re: [App_rpt-users] BIG registration problem this morning Both asterisk and tcpdump show the wrong port being reported. Sometimes NAT routers get confused. Could you try rebooting your router? On Sun, Aug 12, 2018 at 8:39 AM Paul - KN2R <paulkn2r@gmail.com <mailto:paulkn2r@gmail.com> > wrote: I have all set and been using port 44569 for well over a year on that server. Now this morning the registration server is reporting the incorrect port number of 54799. I Never used that number. Now inbound connections are not working any more. Paul -----Original Message----- From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org <mailto:app_rpt-users-bounces@lists.allstarlink.org> ] On Behalf Of Bryan Fields Sent: Sunday, August 12, 2018 11:27 AM To: app_rpt-users@lists.allstarlink.org <mailto:app_rpt-users@lists.allstarlink.org> Subject: Re: [App_rpt-users] BIG registration problem this morning On 8/12/18 9:11 AM, Paul - KN2R wrote:
This morning ALL my nodes are somehow reporting wrong AllStar port numbers from Registration server. Every one of them.
A search shows port 54799, shown below for my node 27034.
But the actual port I have defined everywhere is and should be 44569!
Where did that 54799 number come from? All my incoming connections are down at this point.
From the server:
iax2 show peer 27034 * Name : 27034 Description : Secret : <Set> Context : radio-in Parking lot : Mailbox : Dynamic : Yes Callnum limit: 0 Calltoken req: No Trunk : No Encryption : No Callerid : "" <> Expire : 45018 ACL : No Addr->IP : 76.101.48.66 Port 54799 Defaddr->IP : (null) Port (null) Username : Codecs : (gsm|ulaw|alaw|g726aal2|adpcm|slin|g729|speex|ilbc|g726|g722|siren7|siren14| slin16) Codec Order : (ulaw|alaw|siren14|siren7|g722|slin16|slin|g726|g726aal2|adpcm|gsm|ilbc|spee x|g729) Status : Unmonitored Qualify : every 60000ms when OK, every 10000ms when UNREACHABLE (sample smoothing Off) You're registering with that port number. Can you check your bound port number? Thanks, -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org <mailto:App_rpt-users@lists.allstarlink.org> http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org <mailto:App_rpt-users@lists.allstarlink.org> http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. -- Tim WD6AWP
On 8/12/18 12:06 PM, Paul - KN2R wrote:
I have all set and been using port 44569 for well over a year on that server. Now this morning the registration server is reporting the incorrect port number of 54799. I Never used that number. Now inbound connections are not working any more.
Ok, are you behind NAT? What are you doing there that iax is not connecting outbound with a source port of 44569? I just pulled a dump of your traffic to the registration server and I see you're hitting it with a source port of 54799, not 44569. I think this has to be some nat funkyness, using a different outgoing port vs incoming. Can you check that and give some details if you are behind nat as to the setup you have? Thanks, -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net
I have seen this before if you are using PFSense as your outbound router and you are NOT static locking NAT outbound, it will pick a port at random. Other firewalls have also done it if not set for static, but most consumer grade routers do NOT mangle NAT this way. Mike Kb8zgl On 8/12/18, 12:06 PM, "App_rpt-users on behalf of Bryan Fields" <app_rpt-users-bounces@lists.allstarlink.org on behalf of Bryan@bryanfields.net> wrote: On 8/12/18 12:06 PM, Paul - KN2R wrote: > I have all set and been using port 44569 for well over a year on that > server. > Now this morning the registration server is reporting the incorrect port > number of 54799. > I Never used that number. Now inbound connections are not working any more. Ok, are you behind NAT? What are you doing there that iax is not connecting outbound with a source port of 44569? I just pulled a dump of your traffic to the registration server and I see you're hitting it with a source port of 54799, not 44569. I think this has to be some nat funkyness, using a different outgoing port vs incoming. Can you check that and give some details if you are behind nat as to the setup you have? Thanks, -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
I too have seen this, with improperly configured MikroTik routers. On Sun, Aug 12, 2018 at 9:21 AM Michael Wolthuis <wolthuis@gmail.com> wrote:
I have seen this before if you are using PFSense as your outbound router and you are NOT static locking NAT outbound, it will pick a port at random. Other firewalls have also done it if not set for static, but most consumer grade routers do NOT mangle NAT this way.
Mike Kb8zgl
On 8/12/18, 12:06 PM, "App_rpt-users on behalf of Bryan Fields" < app_rpt-users-bounces@lists.allstarlink.org on behalf of Bryan@bryanfields.net> wrote:
On 8/12/18 12:06 PM, Paul - KN2R wrote: > I have all set and been using port 44569 for well over a year on that > server. > Now this morning the registration server is reporting the incorrect port > number of 54799. > I Never used that number. Now inbound connections are not working any more.
Ok, are you behind NAT? What are you doing there that iax is not connecting outbound with a source port of 44569?
I just pulled a dump of your traffic to the registration server and I see you're hitting it with a source port of 54799, not 44569. I think this has to be some nat funkyness, using a different outgoing port vs incoming.
Can you check that and give some details if you are behind nat as to the setup you have?
Thanks, -- Bryan Fields
727-409-1194 - Voice http://bryanfields.net _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Tim WD6AWP
Getting this on a couple of my nodes this morning. [Aug 12 12:55:50] NOTICE[2004]: chan_iax2.c:9712 socket_process: Registration of '29827' rejected: '<unknown>' from: '67.215.233.178' -----Original Message----- From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Michael Wolthuis Sent: Sunday, August 12, 2018 9:22 AM To: Users of Asterisk app_rpt <app_rpt-users@lists.allstarlink.org> Subject: Re: [App_rpt-users] BIG registration problem this morning I have seen this before if you are using PFSense as your outbound router and you are NOT static locking NAT outbound, it will pick a port at random. Other firewalls have also done it if not set for static, but most consumer grade routers do NOT mangle NAT this way. Mike Kb8zgl On 8/12/18, 12:06 PM, "App_rpt-users on behalf of Bryan Fields" <app_rpt-users-bounces@lists.allstarlink.org on behalf of Bryan@bryanfields.net> wrote: On 8/12/18 12:06 PM, Paul - KN2R wrote: > I have all set and been using port 44569 for well over a year on that > server. > Now this morning the registration server is reporting the incorrect port > number of 54799. > I Never used that number. Now inbound connections are not working any more. Ok, are you behind NAT? What are you doing there that iax is not connecting outbound with a source port of 44569? I just pulled a dump of your traffic to the registration server and I see you're hitting it with a source port of 54799, not 44569. I think this has to be some nat funkyness, using a different outgoing port vs incoming. Can you check that and give some details if you are behind nat as to the setup you have? Thanks, -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
One of the ways to test registration is to add the register line to another server on a different network. I'm one of the Allstar admins so I can lookup your node password. I added your 2577 node to a test server here at home. As you can see (below) it assumes the port I have configured for this node. All is ok, system is working the way it's suposed to. I suspect 'iax2 show registry' on your system has long shown the incorrect ports, but it still worked because the portal configuration overrode the network reported port. The new system uses the port reported by the network and ignores the portal config. That has advantage of not needing to set you server port on the allstarlink.org site. So now you need to figure out why the network is reporting the wrong port. Hope this helps. I've removed your registration from my node as the test is complete. *CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 2577 47.157.254.238:4567 60 Registered 44.98.254.145:4569 Y 2502 47.157.254.238:4567 60 Registered On Sun, Aug 12, 2018 at 12:59 PM Greg Stahlman <kj6ko@innercite.com> wrote:
Getting this on a couple of my nodes this morning.
[Aug 12 12:55:50] NOTICE[2004]: chan_iax2.c:9712 socket_process: Registration of '29827' rejected: '<unknown>' from: '67.215.233.178'
-----Original Message----- From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Michael Wolthuis Sent: Sunday, August 12, 2018 9:22 AM To: Users of Asterisk app_rpt <app_rpt-users@lists.allstarlink.org> Subject: Re: [App_rpt-users] BIG registration problem this morning
I have seen this before if you are using PFSense as your outbound router and you are NOT static locking NAT outbound, it will pick a port at random. Other firewalls have also done it if not set for static, but most consumer grade routers do NOT mangle NAT this way.
Mike Kb8zgl
On 8/12/18, 12:06 PM, "App_rpt-users on behalf of Bryan Fields" < app_rpt-users-bounces@lists.allstarlink.org on behalf of Bryan@bryanfields.net> wrote:
On 8/12/18 12:06 PM, Paul - KN2R wrote: > I have all set and been using port 44569 for well over a year on that > server. > Now this morning the registration server is reporting the incorrect port > number of 54799. > I Never used that number. Now inbound connections are not working any more.
Ok, are you behind NAT? What are you doing there that iax is not connecting outbound with a source port of 44569?
I just pulled a dump of your traffic to the registration server and I see you're hitting it with a source port of 54799, not 44569. I think this has to be some nat funkyness, using a different outgoing port vs incoming.
Can you check that and give some details if you are behind nat as to the setup you have?
Thanks, -- Bryan Fields
727-409-1194 - Voice http://bryanfields.net _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Tim WD6AWP
I'm running pfSense and I "could" setup a static port for the outbound NAT but since when does the source port ever match the destination port, for any protocol? I'm not touching it. 46679*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 46679 47.187.195.172:29961 60 Auth. Sent 4569 is what's set on the portal for my node. 29961 appears to be what is recorded on the server from my registration. The portal port needs to be used or there has to be a way to set the port in rpt.conf to have that communicated to the registration server. Relying on the source port (which can be anything) is not a good idea. Next steps? Danny K5CG
Why do some nodes not have this problem? Is NAT somehow different from different routers? I'd really like to understand so I can take it back to the technical folks and explain why it needs to be put back the way it was. On Sun, Aug 12, 2018 at 8:06 PM Danny K5CG <k5cg@hamoperator.org> wrote:
I'm running pfSense and I "could" setup a static port for the outbound NAT but since when does the source port ever match the destination port, for any protocol? I'm not touching it.
46679*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 46679 47.187.195.172:29961 60 Auth. Sent
4569 is what's set on the portal for my node. 29961 appears to be what is recorded on the server from my registration.
The portal port needs to be used or there has to be a way to set the port in rpt.conf to have that communicated to the registration server. Relying on the source port (which can be anything) is not a good idea.
Next steps?
Danny K5CG _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Tim WD6AWP
My understanding pfSense rewrites the source port on outgoing packets. Not all router manufacturers do this. On Sun, Aug 12, 2018 at 10:15 PM, Tim Sawyer <tisawyer@gmail.com> wrote:
Why do some nodes not have this problem? Is NAT somehow different from different routers? I'd really like to understand so I can take it back to the technical folks and explain why it needs to be put back the way it was.
On Sun, Aug 12, 2018 at 8:06 PM Danny K5CG <k5cg@hamoperator.org> wrote:
I'm running pfSense and I "could" setup a static port for the outbound NAT but since when does the source port ever match the destination port, for any protocol? I'm not touching it.
46679*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 46679 47.187.195.172:29961 60 Auth. Sent
4569 is what's set on the portal for my node. 29961 appears to be what is recorded on the server from my registration.
The portal port needs to be used or there has to be a way to set the port in rpt.conf to have that communicated to the registration server. Relying on the source port (which can be anything) is not a good idea.
Next steps?
Danny K5CG _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Tim WD6AWP
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Bryan K6CBR bryan@k6cbr.us Allstar Base: 43918, 43991 Allstar Hub: 43919, 47036 www.k6cbr.us QRZ
Tim, I am for putting the previous Registration server back in operation! All my nodes are having problems registering with different port numbers I do not have configured anywhere. I use a commercial grade SonicWall TZ-205N firewall/router which has been working fine for years! No changes have been made to that server or the router in over a year or two. Now all of a sudden, since the change, all is not working. Paul / KN2R From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Tim Sawyer Sent: Monday, August 13, 2018 1:15 AM To: Users of Asterisk app_rpt Subject: Re: [App_rpt-users] BIG registration problem this morning Why do some nodes not have this problem? Is NAT somehow different from different routers? I'd really like to understand so I can take it back to the technical folks and explain why it needs to be put back the way it was. On Sun, Aug 12, 2018 at 8:06 PM Danny K5CG <k5cg@hamoperator.org> wrote: I'm running pfSense and I "could" setup a static port for the outbound NAT but since when does the source port ever match the destination port, for any protocol? I'm not touching it. 46679*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 46679 47.187.195.172:29961 60 Auth. Sent 4569 is what's set on the portal for my node. 29961 appears to be what is recorded on the server from my registration. The portal port needs to be used or there has to be a way to set the port in rpt.conf to have that communicated to the registration server. Relying on the source port (which can be anything) is not a good idea. Next steps? Danny K5CG _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. -- Tim WD6AWP
I'm partially responsible for this change. I want to make the AllStar portal as simple to use as possible. It seemed to me that not having to put the IAX port in the portal would make life easier. I forget to do that when I move or setup new servers as have many others. When I discovered Asterisk is reporting the actual source port to the portal database I thought it would make sense to use that port for the nodes list. On Mon, Aug 13, 2018 at 3:48 AM Paul - KN2R <paulkn2r@gmail.com> wrote:
Tim,
I am for putting the previous Registration server back in operation!
All my nodes are having problems registering with different port numbers I do not have configured anywhere.
I use a commercial grade SonicWall TZ-205N firewall/router which has been working fine for years!
No changes have been made to that server or the router in over a year or two. Now all of a sudden, since the change, all is *not* working.
Paul / KN2R
*From:* App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] *On Behalf Of *Tim Sawyer *Sent:* Monday, August 13, 2018 1:15 AM *To:* Users of Asterisk app_rpt *Subject:* Re: [App_rpt-users] BIG registration problem this morning
Why do some nodes not have this problem? Is NAT somehow different from different routers? I'd really like to understand so I can take it back to the technical folks and explain why it needs to be put back the way it was.
On Sun, Aug 12, 2018 at 8:06 PM Danny K5CG <k5cg@hamoperator.org> wrote:
I'm running pfSense and I "could" setup a static port for the outbound NAT but since when does the source port ever match the destination port, for any protocol? I'm not touching it.
46679*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 46679 47.187.195.172:29961 60 Auth. Sent
4569 is what's set on the portal for my node. 29961 appears to be what is recorded on the server from my registration.
The portal port needs to be used or there has to be a way to set the port in rpt.conf to have that communicated to the registration server. Relying on the source port (which can be anything) is not a good idea.
Next steps?
Danny K5CG _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
--
Tim WD6AWP _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Tim WD6AWP
Tim, Because some routers follow the assumption doesn't make it a universal concept that applies to all. You have to assume the source port is unpredictable and random. If I rebooted my node, my router or just disconnected my Internet, it would likely be different source port every time it reconnected and registered. Danny K5CG From: "Tim Sawyer" <tisawyer@gmail.com> To: "Users of Asterisk app_rpt" <app_rpt-users@lists.allstarlink.org> Sent: Monday, August 13, 2018 9:35:42 AM Subject: Re: [App_rpt-users] BIG registration problem this morning I'm partially responsible for this change. I want to make the AllStar portal as simple to use as possible. It seemed to me that not having to put the IAX port in the portal would make life easier. I forget to do that when I move or setup new servers as have many others. When I discovered Asterisk is reporting the actual source port to the portal database I thought it would make sense to use that port for the nodes list. On Mon, Aug 13, 2018 at 3:48 AM Paul - KN2R < [ mailto:paulkn2r@gmail.com | paulkn2r@gmail.com ] > wrote: Tim, I am for putting the previous Registration server back in operation! All my nodes are having problems registering with different port numbers I do not have configured anywhere. I use a commercial grade SonicWall TZ-205N firewall/router which has been working fine for years! No changes have been made to that server or the router in over a year or two. Now all of a sudden, since the change, all is not working. Paul / KN2R From: App_rpt-users [mailto: [ mailto:app_rpt-users-bounces@lists.allstarlink.org | app_rpt-users-bounces@lists.allstarlink.org ] ] On Behalf Of Tim Sawyer Sent: Monday, August 13, 2018 1:15 AM To: Users of Asterisk app_rpt Subject: Re: [App_rpt-users] BIG registration problem this morning Why do some nodes not have this problem? Is NAT somehow different from different routers? I'd really like to understand so I can take it back to the technical folks and explain why it needs to be put back the way it was. On Sun, Aug 12, 2018 at 8:06 PM Danny K5CG < [ mailto:k5cg@hamoperator.org | k5cg@hamoperator.org ] > wrote: BQ_BEGIN I'm running pfSense and I "could" setup a static port for the outbound NAT but since when does the source port ever match the destination port, for any protocol? I'm not touching it. 46679*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State [ http://44.98.254.145:4569/ | 44.98.254.145:4569 ] Y 46679 [ http://47.187.195.172:29961/ | 47.187.195.172:29961 ] 60 Auth. Sent 4569 is what's set on the portal for my node. 29961 appears to be what is recorded on the server from my registration. The portal port needs to be used or there has to be a way to set the port in rpt.conf to have that communicated to the registration server. Relying on the source port (which can be anything) is not a good idea. Next steps? Danny K5CG _______________________________________________ App_rpt-users mailing list [ mailto:App_rpt-users@lists.allstarlink.org | App_rpt-users@lists.allstarlink.org ] [ http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users | http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users ] To unsubscribe from this list please visit [ http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users | http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users ] and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. -- Tim WD6AWP _______________________________________________ App_rpt-users mailing list [ mailto:App_rpt-users@lists.allstarlink.org | App_rpt-users@lists.allstarlink.org ] [ http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users | http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users ] To unsubscribe from this list please visit [ http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users | http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users ] and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. BQ_END -- Tim WD6AWP _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
I've changed the nodes list IAX port back to using the AllStarLink.org provided port. Thanks everybody for your input. Good discussion! On Mon, Aug 13, 2018 at 8:10 AM Danny K5CG <k5cg@hamoperator.org> wrote:
Tim,
Because some routers follow the assumption doesn't make it a universal concept that applies to all. You have to assume the source port is unpredictable and random. If I rebooted my node, my router or just disconnected my Internet, it would likely be different source port every time it reconnected and registered.
Danny K5CG
------------------------------ *From: *"Tim Sawyer" <tisawyer@gmail.com> *To: *"Users of Asterisk app_rpt" <app_rpt-users@lists.allstarlink.org> *Sent: *Monday, August 13, 2018 9:35:42 AM *Subject: *Re: [App_rpt-users] BIG registration problem this morning
I'm partially responsible for this change. I want to make the AllStar portal as simple to use as possible. It seemed to me that not having to put the IAX port in the portal would make life easier. I forget to do that when I move or setup new servers as have many others. When I discovered Asterisk is reporting the actual source port to the portal database I thought it would make sense to use that port for the nodes list.
On Mon, Aug 13, 2018 at 3:48 AM Paul - KN2R <paulkn2r@gmail.com> wrote:
Tim,
I am for putting the previous Registration server back in operation!
All my nodes are having problems registering with different port numbers I do not have configured anywhere.
I use a commercial grade SonicWall TZ-205N firewall/router which has been working fine for years!
No changes have been made to that server or the router in over a year or two. Now all of a sudden, since the change, all is *not* working.
Paul / KN2R
*From:* App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] *On Behalf Of *Tim Sawyer *Sent:* Monday, August 13, 2018 1:15 AM *To:* Users of Asterisk app_rpt *Subject:* Re: [App_rpt-users] BIG registration problem this morning
Why do some nodes not have this problem? Is NAT somehow different from different routers? I'd really like to understand so I can take it back to the technical folks and explain why it needs to be put back the way it was.
On Sun, Aug 12, 2018 at 8:06 PM Danny K5CG <k5cg@hamoperator.org> wrote:
I'm running pfSense and I "could" setup a static port for the outbound NAT but since when does the source port ever match the destination port, for any protocol? I'm not touching it.
46679*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 46679 47.187.195.172:29961 60 Auth. Sent
4569 is what's set on the portal for my node. 29961 appears to be what is recorded on the server from my registration.
The portal port needs to be used or there has to be a way to set the port in rpt.conf to have that communicated to the registration server. Relying on the source port (which can be anything) is not a good idea.
Next steps?
Danny K5CG _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
--
Tim WD6AWP _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Tim WD6AWP
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- Tim WD6AWP
Nice one, Tim. That fixed it. Thank you so much for what you’ve been doing. Really appreciated. GD4HOZ From: Tim Sawyer [mailto:tisawyer@gmail.com] Sent: 13 August 2018 16:54 To: Users of Asterisk app_rpt Subject: Re: [App_rpt-users] BIG registration problem this morning I've changed the nodes list IAX port back to using the AllStarLink.org provided port. Thanks everybody for your input. Good discussion! On Mon, Aug 13, 2018 at 8:10 AM Danny K5CG <k5cg@hamoperator.org> wrote: Tim, Because some routers follow the assumption doesn't make it a universal concept that applies to all. You have to assume the source port is unpredictable and random. If I rebooted my node, my router or just disconnected my Internet, it would likely be different source port every time it reconnected and registered. Danny K5CG _____ From: "Tim Sawyer" <tisawyer@gmail.com> To: "Users of Asterisk app_rpt" <app_rpt-users@lists.allstarlink.org> Sent: Monday, August 13, 2018 9:35:42 AM Subject: Re: [App_rpt-users] BIG registration problem this morning I'm partially responsible for this change. I want to make the AllStar portal as simple to use as possible. It seemed to me that not having to put the IAX port in the portal would make life easier. I forget to do that when I move or setup new servers as have many others. When I discovered Asterisk is reporting the actual source port to the portal database I thought it would make sense to use that port for the nodes list. On Mon, Aug 13, 2018 at 3:48 AM Paul - KN2R <paulkn2r@gmail.com> wrote: Tim, I am for putting the previous Registration server back in operation! All my nodes are having problems registering with different port numbers I do not have configured anywhere. I use a commercial grade SonicWall TZ-205N firewall/router which has been working fine for years! No changes have been made to that server or the router in over a year or two. Now all of a sudden, since the change, all is not working. Paul / KN2R From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Tim Sawyer Sent: Monday, August 13, 2018 1:15 AM To: Users of Asterisk app_rpt Subject: Re: [App_rpt-users] BIG registration problem this morning Why do some nodes not have this problem? Is NAT somehow different from different routers? I'd really like to understand so I can take it back to the technical folks and explain why it needs to be put back the way it was. On Sun, Aug 12, 2018 at 8:06 PM Danny K5CG <k5cg@hamoperator.org> wrote: I'm running pfSense and I "could" setup a static port for the outbound NAT but since when does the source port ever match the destination port, for any protocol? I'm not touching it. 46679*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 46679 47.187.195.172:29961 60 Auth. Sent 4569 is what's set on the portal for my node. 29961 appears to be what is recorded on the server from my registration. The portal port needs to be used or there has to be a way to set the port in rpt.conf to have that communicated to the registration server. Relying on the source port (which can be anything) is not a good idea. Next steps? Danny K5CG _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. -- Tim WD6AWP _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. -- Tim WD6AWP _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem. -- Tim WD6AWP
On 8/12/18 11:06 PM, Danny K5CG wrote:
I'm running pfSense and I "could" setup a static port for the outbound NAT but since when does the source port ever match the destination port, for any protocol? I'm not touching it.
Most VoIP-ish protocols require what's known as "full cone NAT". This is where a router/packet mangler takes an external address and port/protocol and maps it to the same internal port/protocol in a bidirectional fashion. When you "port forward" on most consumer grade routers, it creates a full cone NAT. Many consumer routers do full-cone NAT for dynamic protocols as well. Due to IAX being UDP based (stateless) most NAT implementations will automatically map this in both directions, for all external hosts. Simply put if your internal device uses port 5000 it will map as follows: Outbound direction: IntIP:srcPort-5000 > NAT device > ExtSrcIP:srcPort-5000 > ExtDstIP:dst-5000 If the router is doing full-cone NAT (most consumer grade routers do this by default it will add a mapping like this automagically: Inbound direction: IntSrcIP:dst5000 < NAT device < *:5000 This has the distinct advantage of just working behind NAT for certain realtime protocols without needing an application aware gateway. This does however open up the world inbound if you know this, so most higher end firewalls don't do this, and will lock down that inbound connection to what the source has talked to externally. This requires some memory and connection tracking of UDP. When you configure outbound PAT or port address translation which is a many to one, the router will dynamically remap your source ports on the external device so they don't overlap with other users on your network. This will map the local source port of say 4569 to some random high value, say 75401. Your packet will now go out and talk to the external user as your extIP:src75401:dst4569. With IAX, the external user will now be able to talk back to you as there's a mapping on your router of externalHostIP:dst75401 to your internalIP:dst4569, but it's only valid for that one external Host of the IAX server. No other servers can use externalIP:dst75401 to talk to your IAX server as the external srcIP is different. The way to solve this is to statically map extIP:dst4569 to intIP:dst4569 and ensure intIP:4569 to extIP: is not mangled but allowed to pass to extIP:4569. SIP solves this via application layer gateways (ALG) on firewalls, same as FTP. This will make a full cone NAT and is what's needed for IAX to work. Right now you have a unidirectional mapping from ext to int, but not int to ext. Further reading: https://en.wikipedia.org/wiki/Network_address_translation#Methods_of_transla...
46679*CLI> iax2 show registry Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 46679 47.187.195.172:29961 60 Auth. Sent
4569 is what's set on the portal for my node. 29961 appears to be what is recorded on the server from my registration.
Yea, that was a dirty hack.
The portal port needs to be used or there has to be a way to set the port in rpt.conf to have that communicated to the registration server. Relying on the source port (which can be anything) is not a good idea.
95% of the time it works every time. Your have a corner case, and as you have a decent packet filter (pfsense) it's easily configured to work for this. Based on this doc, https://www.3cx.com/docs/pfsense-firewall/ you will need to enable "Port Preservation" for your IAX server.
Next steps?
Turn on Port Preservation and report back. Thanks, -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net
I'm afraid that I, too now have this issue with three of my four nodes. Like Paul, no changes have been made for many, many months (or even years) but suddenly, AllStar has got its ports in a knot. The only one that's right is 2481 which is on its own ADSL connection. The other three share a common public IP. There are the outputs from iax2 show registry on each node and, below that, the relevant bindport line from iax.conf Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 N 2480 87.254.91.169:15280 60 Auth. Sent bindport=4568 Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 2481 89.107.6.110:4569 60 Registered bindport=4569 Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 N 2482 87.254.91.169:25963 60 Registered bindport=4569 Host dnsmgr Username Perceived Refresh State 44.98.254.145:4569 Y 2484 87.254.91.169:43287 60 Registered bindport = 4570 (2480, 2482 and 2484 are all on a private LAN behind the same NAT firewall, hence the different iax ports) I'm also seeing plenty of these: NOTICE[351]: chan_iax2.c:9712 socket_process: Registration of '2481' rejected: '<unknown>' from: '44.98.254.145' for all nodes Subsequently, registration succeeds without intervention from me. Something's gone awry. Any ideas? David Osborn - GD4HOZ -----Original Message----- From: Paul - KN2R [mailto:paulkn2r@gmail.com] Sent: 12 August 2018 17:06 To: 'Users of Asterisk app_rpt' Subject: Re: [App_rpt-users] BIG registration problem this morning I have all set and been using port 44569 for well over a year on that server. Now this morning the registration server is reporting the incorrect port number of 54799. I Never used that number. Now inbound connections are not working any more. Paul -----Original Message----- From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Bryan Fields Sent: Sunday, August 12, 2018 11:27 AM To: app_rpt-users@lists.allstarlink.org Subject: Re: [App_rpt-users] BIG registration problem this morning On 8/12/18 9:11 AM, Paul - KN2R wrote:
This morning ALL my nodes are somehow reporting wrong AllStar port numbers from Registration server. Every one of them.
A search shows port 54799, shown below for my node 27034.
But the actual port I have defined everywhere is and should be 44569!
Where did that 54799 number come from? All my incoming connections are down at this point.
From the server:
iax2 show peer 27034 * Name : 27034 Description : Secret : <Set> Context : radio-in Parking lot : Mailbox : Dynamic : Yes Callnum limit: 0 Calltoken req: No Trunk : No Encryption : No Callerid : "" <> Expire : 45018 ACL : No Addr->IP : 76.101.48.66 Port 54799 Defaddr->IP : (null) Port (null) Username : Codecs : (gsm|ulaw|alaw|g726aal2|adpcm|slin|g729|speex|ilbc|g726|g722|siren7|siren14| slin16) Codec Order : (ulaw|alaw|siren14|siren7|g722|slin16|slin|g726|g726aal2|adpcm|gsm|ilbc|spee x|g729) Status : Unmonitored Qualify : every 60000ms when OK, every 10000ms when UNREACHABLE (sample smoothing Off) You're registering with that port number. Can you check your bound port number? Thanks, -- Bryan Fields 727-409-1194 - Voice http://bryanfields.net _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
participants (9)
-
Bryan Fields -
Bryan St Clair -
Danny K5CG -
David Osborn -
Greg Stahlman -
Michael Wolthuis -
Paul - KN2R -
Scott Weis -
Tim Sawyer