Re: [App_rpt-users] mikrotik and Allstar registration problem
Posting this again because the list didn't take my attachment. If you want to see the screenshot contact me off list. In the mean time here's the command line way to do it: ip firewall nat add action=masquerade chain=srcnat comment="HairPin NAT" out-interface=ether1-WAN src-address=192.168.1.0/24 add action=dst-nat chain=dstnat comment="Asterisk AIX" dst-port=4569 in-interface=ether1-WAN protocol=udp to-addresses=\ 192.168.1.6 to-ports=4569 --------- There is a little thing to know about MikroTik routers and AllStar registration. It took me a long time to sort this out and I almost gave up on MikroTik. But don't despair they are really good routers. You have to have both the out-interface and the in-interface set properly on the masquerade rule. If you forget the out interface the AllStar registration packets go to all interfaces. That really confuses Asterisk if you have AllStar on more then one interface. On Thu, Sep 3, 2015 at 7:29 PM, Tim Sawyer <tisawyer@gmail.com> wrote:
There is a little thing to know about MikroTik routers and AllStar registration. It took me a long time to sort this out and I almost gave up on MikroTik. But don't despair they are really good routers.
You have to have both the out-interface and the in-interface set properly on the masquerade rule. If you forget the out interface the AllStar registration packets go to all interfaces. That really confuses Asterisk if you have AllStar on more then one interface.
Let me know if the attached screen shot doesn't come through.
On Thu, Sep 3, 2015 at 3:32 PM, Jesse Lloyd <ve7lyd@gmail.com> wrote:
Maybe it's not marking UDP packets? All the other protocols you listed are TCP. If you want to test another UDP protocol maybe try TFTP. The server side will tell you what IP has hit it.
Jesse
On Sep 3, 2015, at 2:43 PM, R Dahl <ve6ars@gmail.com> wrote:
Well, I have to admit, I wasn't sure whether this was the right forum either. My network has 3 flaky wifi wan's and the routing mark/distance settings have allowed for a simple failover system. routing marks are applied by the firewall based on ip's and works great for everything but the connection from the allstar server to the rtcm or registration server. Other connections from the allstar server work corrrectly and honor the marks, (ssh, telnet, http, etc...) All this leads me to believe there is something different about the allstar arrangement that I haven't clued into. I also tried applying the routing marks based on mac but no luck there either. Perhaps port and protocol as well? As you suggest, I will try a mikrotik group Thanks, Ross.
On Thu, Sep 3, 2015 at 1:47 PM, David McGough <kb4fxc@inttek.net> wrote:
Hi Ross,
From what you describe, this isn't an Asterisk/AllStar problem at all--your router is load balancing across multiple Internet (WAN) connections.
You need to add a source route for the IP address of your Asterisk server that guarantees that your router always uses the proper WAN connection for this host.
I recommend finding a -local- MikroTik network guru. The problem with working on this kind of stuff remotely is that, with one accidental misstep, you're down and they can't get back in. Oops!
73, David KB4FXC
On Thu, 3 Sep 2015, R Dahl wrote:
I have an Acid (40526) server with an rtcm for radio connection. The mikrotik router has 3 wan connections with the acid server connected to its lan ports as well as the rtcm. My problem is that the registration requests appear to go out an arbitrary wan port rather than the one I want it to use. I try to force it to use a particular wan by assigning a routing mark based on its ip and then have the desired wan with the same routing mark. This approach works for splitting workstations and servers among the wan's but the asterisk registration process ignores it.
iax2 registration shows it as perceived as one of the other wans and is not consistent. traceroute from asterisk server shows it using the desired wan.
This is all mostly over my payscale.
Ross
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- -- Tim
-- -- Tim
Great! thanks Tim, and everyone else who offered suggestions. That got it working consistently. Ross On Thu, Sep 3, 2015 at 8:55 PM, Tim Sawyer <tisawyer@gmail.com> wrote:
Posting this again because the list didn't take my attachment. If you want to see the screenshot contact me off list.
In the mean time here's the command line way to do it:
ip firewall nat
add action=masquerade chain=srcnat comment="HairPin NAT" out-interface=ether1-WAN src-address=192.168.1.0/24
add action=dst-nat chain=dstnat comment="Asterisk AIX" dst-port=4569 in-interface=ether1-WAN protocol=udp to-addresses=\ 192.168.1.6 to-ports=4569
--------- There is a little thing to know about MikroTik routers and AllStar registration. It took me a long time to sort this out and I almost gave up on MikroTik. But don't despair they are really good routers.
You have to have both the out-interface and the in-interface set properly on the masquerade rule. If you forget the out interface the AllStar registration packets go to all interfaces. That really confuses Asterisk if you have AllStar on more then one interface.
On Thu, Sep 3, 2015 at 7:29 PM, Tim Sawyer <tisawyer@gmail.com> wrote:
There is a little thing to know about MikroTik routers and AllStar registration. It took me a long time to sort this out and I almost gave up on MikroTik. But don't despair they are really good routers.
You have to have both the out-interface and the in-interface set properly on the masquerade rule. If you forget the out interface the AllStar registration packets go to all interfaces. That really confuses Asterisk if you have AllStar on more then one interface.
Let me know if the attached screen shot doesn't come through.
On Thu, Sep 3, 2015 at 3:32 PM, Jesse Lloyd <ve7lyd@gmail.com> wrote:
Maybe it's not marking UDP packets? All the other protocols you listed are TCP. If you want to test another UDP protocol maybe try TFTP. The server side will tell you what IP has hit it.
Jesse
On Sep 3, 2015, at 2:43 PM, R Dahl <ve6ars@gmail.com> wrote:
Well, I have to admit, I wasn't sure whether this was the right forum either. My network has 3 flaky wifi wan's and the routing mark/distance settings have allowed for a simple failover system. routing marks are applied by the firewall based on ip's and works great for everything but the connection from the allstar server to the rtcm or registration server. Other connections from the allstar server work corrrectly and honor the marks, (ssh, telnet, http, etc...) All this leads me to believe there is something different about the allstar arrangement that I haven't clued into. I also tried applying the routing marks based on mac but no luck there either. Perhaps port and protocol as well? As you suggest, I will try a mikrotik group Thanks, Ross.
On Thu, Sep 3, 2015 at 1:47 PM, David McGough <kb4fxc@inttek.net> wrote:
Hi Ross,
From what you describe, this isn't an Asterisk/AllStar problem at all--your router is load balancing across multiple Internet (WAN) connections.
You need to add a source route for the IP address of your Asterisk server that guarantees that your router always uses the proper WAN connection for this host.
I recommend finding a -local- MikroTik network guru. The problem with working on this kind of stuff remotely is that, with one accidental misstep, you're down and they can't get back in. Oops!
73, David KB4FXC
On Thu, 3 Sep 2015, R Dahl wrote:
I have an Acid (40526) server with an rtcm for radio connection. The mikrotik router has 3 wan connections with the acid server connected to its lan ports as well as the rtcm. My problem is that the registration requests appear to go out an arbitrary wan port rather than the one I want it to use. I try to force it to use a particular wan by assigning a routing mark based on its ip and then have the desired wan with the same routing mark. This approach works for splitting workstations and servers among the wan's but the asterisk registration process ignores it.
iax2 registration shows it as perceived as one of the other wans and is not consistent. traceroute from asterisk server shows it using the desired wan.
This is all mostly over my payscale.
Ross
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
-- -- Tim
-- -- Tim
participants (2)
-
R Dahl -
Tim Sawyer