DSIProuter to FreePBX - TLS - Connection timeout...

[Micah Quinn]

Hi all,

I'm attempting to setup a SIP proxy on our network's edge to proxy to multiple FreePBX servers internally. The DSIProuter is behind a firewall that is port forwarding 5060/5061 and 10000-20000 to the DSIProuter. The DSIProuter has a single NIC with an IP address on the same subnet as the FreePBX servers. I've got a domain setup for pass thru and an endpoint defined with port 5061 (i.e. "192.168.100.10:5061")

I have two test clients outside the network that are connecting/registering via TLS to DSIProuter. I can initiate a call and the clients are connected; i have audio. However, after approximately 30 seconds, the call drops and Kamailio logs the following errors:

Jul 27 20:33:30 dsip001 /usr/sbin/kamailio[39913]: INFO: [/etc/kamailio/kamailio.cfg:1617:RELAY] [6ca2524e-3c1a-4c57-a71e-8069b0ad2d88:ACK:<null>] Attempting to route call to sip:10...@10.0.0.102:52222;transport=TLS;ob
Jul 27 20:33:30 dsip001 /usr/sbin/kamailio[39913]: ERROR: [<null>:0:<null>] [6ca2524e-3c1a-4c57-a71e-8069b0ad2d88:ACK:<null>] <core> [core/tcp_main.c:2951]: tcpconn_1st_send(): connect 172.16.8.23:33588 failed (RST) Connection refused
Jul 27 20:33:30 dsip001 /usr/sbin/kamailio[39913]: ERROR: [<null>:0:<null>] [6ca2524e-3c1a-4c57-a71e-8069b0ad2d88:ACK:<null>] <core> [core/tcp_main.c:2960]: tcpconn_1st_send(): 172.16.8.23:33588: connect & send for 0x7f52f56f0448 (sock 18) failed: Connection refused (111)
Jul 27 20:33:30 dsip001 /usr/sbin/kamailio[39913]: ERROR: [<null>:0:<null>] [6ca2524e-3c1a-4c57-a71e-8069b0ad2d88:ACK:<null>] <core> [core/forward.h:292]: msg_send_buffer(): tcp_send failed
Jul 27 20:33:30 dsip001 /usr/sbin/kamailio[39913]: ERROR: [/etc/kamailio/kamailio.cfg:1619:RELAY] [6ca2524e-3c1a-4c57-a71e-8069b0ad2d88:ACK:<null>] sl [sl_funcs.c:414]: sl_reply_error(): stateless error reply used: Unfortunately error on sending to next hop occurred (477/SL)

On the Asterisk side of things I show the two clients registered as follows:

  Contact:  10932/sip:10...@172.16.8.23:33588;transport=TL 802f11bc1e Avail         3.078
  Contact:  9999/sip:99...@172.16.8.23:33588;transport=TLS; 5e4abcabdf Avail         4.407

It seems strange to me that both on registered with random ports; ports that kamailio is clearly not listening on.

Any ideas?

[Janduy Euclides]

Hello, I recommend on the side of your FreePBX to disable firewall or fail2ban, it can be a way.

Atenciosamente,

________________________

Janduy Euclides - dCAA, SCE, Xorcom CompletePBX-v4/v5, SBC e PBX Basic.
E-mail: janduye...@gmail.com
Tel.: +55 11 9-9835-1136
Acesse - www.freepbxbrasil.com.br
Visite - Fundação Asterisk Libre - FAL

________________________

--
You received this message because you are subscribed to the Google Groups "dSIPRouter" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dSIPRouter+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dSIPRouter/ee49970b-15c4-449e-8e08-6087c3d9ba9dn%40googlegroups.com.

[Janduy Euclides]

Correcting:
firewall and fail2ban**

leave both disabled.

Atenciosamente,

________________________

Janduy Euclides - dCAA, SCE, Xorcom CompletePBX-v4/v5, SBC e PBX Basic.
E-mail: janduye...@gmail.com
Tel.: +55 11 9-9835-1136
Acesse - www.freepbxbrasil.com.br
Visite - Fundação Asterisk Libre - FAL

________________________

[Micah Quinn]

Hi Janduy,

fail2ban is not enabled. The connection issue is not on the PBX but rather Kamailio.

Here is a simplified version of what is happening:

1. A softphone is connected to DSIProuter via TLS and the Internet.

2. The extension shows a registration similar to the above with a random port number on the DSIProuter.

3. A second hard phone is directly registered to the PBX.

4. Calls placed from the DSIProuter connected softphone to the hard phone work as expected; audio works, no timeout.

5. Calls placed from the hard phone to the softphone connected to DSIProuter work initially, but timeout in 30 seconds due to the above TCP connection issues.

It appears that Asterisk is registering the DSIP connected softphone with the random source port that comes from Kamailio. Somehow the initial INVITE packet is making it to the softphone, but subsequent SIP messages appear to be failing because they are trying to route to the random source port given in the registration.

I've switched to non-TLS and experienced the same issue so I beleive it to be a central issue with how Asterisk is registering the extension. Correct me if I'm wrong. Shouldn't extensions registered via DSIPRouter in pass-thru show the IP address of the DSIProuter and port 5061?

[Ciprian Arsenie]

I don’t understand people putting proxy behind firewalls. Proxy is usually on public ip and pbx on internal networks . Proxy’s job is to protect internal network and to ensure connections between public internet and internal network for rtp and signaling.

Trimis de pe iPhone‑ul meu

Pe 1 aug. 2023, la 12:27, Micah Quinn <micah...@gmail.com> a scris:

Hi Janduy,

To view this discussion on the web visit https://groups.google.com/d/msgid/dSIPRouter/807f5a7a-68e0-42e2-8e40-b6e7ed9c93f0n%40googlegroups.com.

[Micah Quinn]

Ciprian,

Sounds like a different topic for a different thread. ;) Unless you are telling me that DSIProuter is currently incapable of operating in this configuration.

Short list for running behind a firewall:

* More efficient use of IP space

* Better security/accounting

Any ideas on the current issue I'm facing? What additional information can I provide?

[Ciprian Arsenie]

Kamailio and pbx is on the same lan ? Describe a little bit more your network configuration. It is likely possibile to be a issue from nat. Try to make a diagram of the signaling network flow and rtp

Trimis de pe iPhone‑ul meu

Pe 1 aug. 2023, la 15:59, Micah Quinn <micah...@gmail.com> a scris:

Ciprian,

To view this discussion on the web visit https://groups.google.com/d/msgid/dSIPRouter/818a19ea-d822-4675-8308-a06d287e349fn%40googlegroups.com.

[Micah Quinn]

Yes, the PBX and Kamailio are on the same LAN.

I have DSIProuter running on a Debian 11 vitual machine with a single NIC. I also have an OPNsense firewall that is port forwarding to the DSIProuter and providing the public IP for it. The kamailio configuration has the VM's LAN for the internal IP addr and the OPNsense's public IP for the external addr.

The network is as follows:

                                       172.16.8.0/21             172.16.8.0/21

(Internet)   <---------->  (Firewall) <----------->(DSIPRouter) <----------> (PBX)

The firewall is port forwarding TCP 5060/5061 (and 10000-20000 UDP) to the DSIPRouter. Communication between the softphones and then DSIPRouter is TLS 5061. Communication between DSIPRouter and PBX is also TLS 5061, so I can't easily provide an sngrep graph.

I did make some progress this morning by disabling USRLOCDB in the kamailio.cfg file. Now I'm able to establish and maintain a call in excess of 1 minute. Perhaps this is another clue?

The kamailio log file now shows the following on an INVITE:

---------------------------------------------------------------------

Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2459:SET_CALLINFO] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] domainrouting - gwgroupid: 67, gatewaytype: 0
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2344:AUTH] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] DOMAIN_AUTH 10...@pbx.XXX.XXX.com will be routed to pbx.XXX.XXX.com:5061
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2117:LOCATION] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] In the location route.)
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1117:NEXTHOP] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] DOMAINROUTING Routing to Single Endpoint Gateway
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1121:NEXTHOP] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] DOMAINROUTING should be routed to pbx.XXX.XXX.com:5061
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] Attempting to route call to sip:10...@pbx.XXX.XXX.com:5061;transport=tls
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2812:RTPENGINEOFFER] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] reflags: trust-address replace-origin replace-session-connection rtcp-mux-demux ICE=remove RTP/AVP
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: ERROR: [/etc/kamailio/kamailio.cfg:3270:MANAGE_FAILURE] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] tm [t_fwd.c:1752]: t_forward_nonack(): no branches for forwarding
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: ERROR: [/etc/kamailio/kamailio.cfg:3270:MANAGE_FAILURE] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] tm [tm.c:1752]: _w_t_relay_to(): t_forward_noack failed
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: NOTICE: acc [acc.c:287]: acc_log_request(): ACC: transaction answered: timestamp=1690906959;method=INVITE;from_tag=95760a7e95a043d39cd7d6a82572b5b5;to_tag=z9hG4bK90aa.24ca9b614f5790d008fc2d6fdf1613ef.0;call_id=093626190e6b4a8d9c2dc6ad5b8d9670;code=401;reason=Unauthorized;src_user=9999;src_domain=pbx.XXX.XXX.com;src_ip=<softphone_public_ip>;dst_ouser=10932;dst_user=10932;dst_domain=pbx.XXX.XXX.com;calltype=;src_gwgroupid=67;dst_gwgroupid=0
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [093626190e6b4a8d9c2dc6ad5b8d9670:ACK:<null>] Attempting to route call to sip:sip.XXX.XXX.com:5061;transport=tls;lr
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2459:SET_CALLINFO] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] domainrouting - gwgroupid: 67, gatewaytype: 0
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2344:AUTH] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] DOMAIN_AUTH 10...@pbx.XXX.XXX.com will be routed to pbx.XXX.XXX.com:5061
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2117:LOCATION] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] In the location route.)
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1117:NEXTHOP] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] DOMAINROUTING Routing to Single Endpoint Gateway
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1121:NEXTHOP] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] DOMAINROUTING should be routed to pbx.XXX.XXX.com:5061
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] Attempting to route call to sip:10...@pbx.XXX.XXX.com:5061;transport=tls
Aug  1 11:22:39 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2812:RTPENGINEOFFER] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:<null>] reflags: trust-address replace-origin replace-session-connection rtcp-mux-demux ICE=remove RTP/AVP
Aug  1 11:22:40 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2117:LOCATION] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:INVITE:<null>] In the location route.)
Aug  1 11:22:40 dsip001 /usr/sbin/kamailio[3573]: ERROR: [/etc/kamailio/kamailio.cfg:2148:LOCATION] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:INVITE:<null>] <core> [core/lvalue.c:346]: lval_pvar_assign(): non existing right pvar
Aug  1 11:22:40 dsip001 /usr/sbin/kamailio[3573]: ERROR: [/etc/kamailio/kamailio.cfg:2148:LOCATION] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:INVITE:<null>] <core> [core/lvalue.c:404]: lval_assign(): assignment failed at pos: (2148,26-2148,74)
Aug  1 11:22:40 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:INVITE:<null>] Attempting to route call to sip:10932@<softphones_public_ip>:21952;transport=TLS;ob
Aug  1 11:22:40 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2812:RTPENGINEOFFER] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:INVITE:<null>] reflags: trust-address replace-origin replace-session-connection rtcp-mux-demux ICE=remove RTP/AVP media-address=172.16.8.23
Aug  1 11:22:42 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2862:RTPENGINEANSWER] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:INVITE:200] reflags: trust-address replace-origin replace-session-connection rtcp-mux-demux ICE=remove RTP/AVP media-address=172.16.8.23
Aug  1 11:22:42 dsip001 /usr/sbin/kamailio[3573]: NOTICE: [<null>:0:<null>] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:INVITE:200] acc [acc.c:287]: acc_log_request(): ACC: transaction answered: timestamp=1690906962;method=INVITE;from_tag=afebb88a-e0ab-44e6-bf91-50169221d742;to_tag=4b7c62e052cb428aa1621a3324ca0153;call_id=7dd3589e-66f8-4d69-a4f9-f17686b99a46;code=200;reason=OK;src_user=9999;src_domain=172.16.10.100;src_ip=172.16.10.100;dst_ouser=10932;dst_user=10932;dst_domain=<softphones_public_ip>;calltype=;src_gwgroupid=;dst_gwgroupid=0
Aug  1 11:22:42 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:ACK:<null>] Attempting to route call to sip:10932@<softphones_public_ip>:21952;transport=TLS;ob
Aug  1 11:22:42 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2862:RTPENGINEANSWER] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:200] reflags: trust-address replace-origin replace-session-connection rtcp-mux-demux ICE=remove RTP/AVP
Aug  1 11:22:42 dsip001 /usr/sbin/kamailio[3573]: NOTICE: [<null>:0:<null>] [093626190e6b4a8d9c2dc6ad5b8d9670:INVITE:200] acc [acc.c:287]: acc_log_request(): ACC: transaction answered: timestamp=1690906962;method=INVITE;from_tag=95760a7e95a043d39cd7d6a82572b5b5;to_tag=c6cb6a34-fbc0-429d-9041-8c0009bbb108;call_id=093626190e6b4a8d9c2dc6ad5b8d9670;code=200;reason=OK;src_user=9999;src_domain=pbx.XXX.XXX.com;src_ip=<softphones_public_ip>;dst_ouser=10932;dst_user=10932;dst_domain=pbx.XXX.XXX.com;calltype=;src_gwgroupid=67;dst_gwgroupid=0
Aug  1 11:22:42 dsip001 /usr/sbin/kamailio[3573]: WARNING: [/etc/kamailio/kamailio.cfg:1731:WITHINDLG] [093626190e6b4a8d9c2dc6ad5b8d9670:ACK:<null>] rr [loose.c:804]: rr_do_force_send_socket(): no socket found to match second RR (sip:172.16.8.23:42228;transport=TLS;lr;r2=on;did=7ed.59a2)
Aug  1 11:22:42 dsip001 /usr/sbin/kamailio[3573]: WARNING: [/etc/kamailio/kamailio.cfg:1731:WITHINDLG] [093626190e6b4a8d9c2dc6ad5b8d9670:ACK:<null>] rr [loose.c:807]: rr_do_force_send_socket(): second RR uri is not myself (sip:172.16.8.23:42228;transport=TLS;lr;r2=on;did=7ed.59a2)
Aug  1 11:22:42 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [093626190e6b4a8d9c2dc6ad5b8d9670:ACK:<null>] Attempting to route call to sip:172.16.10.100:5061;transport=TLS
Aug  1 11:22:43 dsip001 /usr/sbin/kamailio[3573]: WARNING: [/etc/kamailio/kamailio.cfg:1731:WITHINDLG] [093626190e6b4a8d9c2dc6ad5b8d9670:UPDATE:<null>] rr [loose.c:804]: rr_do_force_send_socket(): no socket found to match second RR (sip:172.16.8.23:42228;transport=TLS;lr;r2=on;did=7ed.59a2)
Aug  1 11:22:43 dsip001 /usr/sbin/kamailio[3573]: WARNING: [/etc/kamailio/kamailio.cfg:1731:WITHINDLG] [093626190e6b4a8d9c2dc6ad5b8d9670:UPDATE:<null>] rr [loose.c:807]: rr_do_force_send_socket(): second RR uri is not myself (sip:172.16.8.23:42228;transport=TLS;lr;r2=on;did=7ed.59a2)
Aug  1 11:22:43 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [093626190e6b4a8d9c2dc6ad5b8d9670:UPDATE:<null>] Attempting to route call to sip:172.16.10.100:5061;transport=TLS
Aug  1 11:22:43 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:2862:RTPENGINEANSWER] [093626190e6b4a8d9c2dc6ad5b8d9670:UPDATE:200] reflags: trust-address replace-origin replace-session-connection rtcp-mux-demux ICE=remove RTP/AVP media-address=172.16.8.23
Aug  1 11:23:19 dsip001 /usr/sbin/kamailio[3573]: WARNING: [/etc/kamailio/kamailio.cfg:1731:WITHINDLG] [093626190e6b4a8d9c2dc6ad5b8d9670:BYE:<null>] rr [loose.c:804]: rr_do_force_send_socket(): no socket found to match second RR (sip:172.16.8.23:42228;transport=TLS;lr;r2=on;did=7ed.59a2)
Aug  1 11:23:19 dsip001 /usr/sbin/kamailio[3573]: WARNING: [/etc/kamailio/kamailio.cfg:1731:WITHINDLG] [093626190e6b4a8d9c2dc6ad5b8d9670:BYE:<null>] rr [loose.c:807]: rr_do_force_send_socket(): second RR uri is not myself (sip:172.16.8.23:42228;transport=TLS;lr;r2=on;did=7ed.59a2)
Aug  1 11:23:19 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [093626190e6b4a8d9c2dc6ad5b8d9670:BYE:<null>] Attempting to route call to sip:172.16.10.100:5061;transport=TLS
Aug  1 11:23:19 dsip001 /usr/sbin/kamailio[3573]: NOTICE: [<null>:0:<null>] [093626190e6b4a8d9c2dc6ad5b8d9670:BYE:200] acc [acc.c:287]: acc_log_request(): ACC: transaction answered: timestamp=1690906999;method=BYE;from_tag=95760a7e95a043d39cd7d6a82572b5b5;to_tag=c6cb6a34-fbc0-429d-9041-8c0009bbb108;call_id=093626190e6b4a8d9c2dc6ad5b8d9670;code=200;reason=OK;src_user=9999;src_domain=pbx.XXX.XXX.com;src_ip=172.16.8.52;dst_ouser=10932;dst_user=;dst_domain=172.16.10.100;calltype=;src_gwgroupid=67;dst_gwgroupid=0
Aug  1 11:23:19 dsip001 /usr/sbin/kamailio[3573]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:BYE:<null>] Attempting to route call to sip:10932@<softphones_public_ip>:21952;transport=TLS;ob
Aug  1 11:23:19 dsip001 /usr/sbin/kamailio[3573]: NOTICE: [<null>:0:<null>] [7dd3589e-66f8-4d69-a4f9-f17686b99a46:BYE:200] acc [acc.c:287]: acc_log_request(): ACC: transaction answered: timestamp=1690906999;method=BYE;from_tag=afebb88a-e0ab-44e6-bf91-50169221d742;to_tag=4b7c62e052cb428aa1621a3324ca0153;call_id=7dd3589e-66f8-4d69-a4f9-f17686b99a46;code=200;reason=OK;src_user=9999;src_domain=172.16.10.100;src_ip=172.16.10.100;dst_ouser=10932;dst_user=10932;dst_domain=<softphones_public_ip>;calltype=;src_gwgroupid=;dst_gwgroupid=

---------------------------------------------------------------------

For testing purposes, I'm willing to change my setup to any recommended configuration including temporarily placing the DSIProuter on a public IP address and adding an additional NIC.

[Ciprian Arsenie]

Well from what i see you route traffic to domain . I suppose domain have public ip and the signaling goes through router and is not the case to do that. Try with local domain and private ip. 

Trimis de pe iPhone‑ul meu

Pe 1 aug. 2023, la 19:30, Micah Quinn <micah...@gmail.com> a scris:

Yes, the PBX and Kamailio are on the same LAN.

To view this discussion on the web visit https://groups.google.com/d/msgid/dSIPRouter/4b8b96f0-9a6b-4f5d-92bb-e9da4793784en%40googlegroups.com.

[Micah Quinn]

The domain does resolve to a local IP address. The only public IP in the configuration is for the external addr of the proxy.

Any ideas why disabling WITH_USRLOCDB would suddenly fix the issue?

[Micah Quinn]

Please disregard the comment about WITH_USRLOCDB. I've re-enabled it as it's required by RTP engine. I'm still attempting to resolve the connection issues. I'll update if I'm able to resolve it.

[AirsayLongCon]

Micah,

Do you have a trunk to dsiprouter setup on your FreePBX? If yes, how do you have it setup? I am having issues getting endpoints to register to FreePBX when I have a trunk setup like shown here

[Micah Quinn]

No, I do not have a trunk setup explicitly for the DSIProuter. (I'm using the FreePBX pass through case) If I understand it correctly, the DSIProuter is simply acting as a pass through proxy. This means registrations too. I think I'm using a slightly different use case than you.

My current issue is a weird one. I'm able to place calls from a DSIP connected client to an phone directly connected to the PBX. RTP seems to work, no timeout afte 30/60 seconds. However, if I call from the directly connected phone to the DSIP connected phone, I get no audio and the connection drops after 30 seconds with error messages similar to the following:

Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [49254b96-7840-4300-b4d0-f1d479e06a9b:BYE:<null>] Attempting to route call to sip:99...@10.0.0.140:44865;transport=TLS;ob
Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: ERROR: [<null>:0:<null>] [49254b96-7840-4300-b4d0-f1d479e06a9b:BYE:<null>] <core> [core/tcp_main.c:2951]: tcpconn_1st_send(): connect 172.16.8.23:56494 failed (RST) Connection refused
Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: ERROR: [<null>:0:<null>] [49254b96-7840-4300-b4d0-f1d479e06a9b:BYE:<null>] <core> [core/tcp_main.c:2960]: tcpconn_1st_send(): 172.16.8.23:56494: connect & send for 0x7fede7e5cda0 (sock 21) failed: Connection refused (111)
Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: ERROR: [<null>:0:<null>] [49254b96-7840-4300-b4d0-f1d479e06a9b:BYE:<null>] tm [../../core/forward.h:292]: msg_send_buffer(): tcp_send failed
Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: WARNING: [<null>:0:<null>] [49254b96-7840-4300-b4d0-f1d479e06a9b:BYE:<null>] tm [t_fwd.c:1588]: t_send_branch(): sending request on branch 0 failed
Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [49254b96-7840-4300-b4d0-f1d479e06a9b:ACK:<null>] Attempting to route call to sip:99...@10.0.0.140:44865;transport=TLS;ob
Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: ERROR: [<null>:0:<null>] [49254b96-7840-4300-b4d0-f1d479e06a9b:ACK:<null>] <core> [core/tcp_main.c:2951]: tcpconn_1st_send(): connect 172.16.8.23:56494 failed (RST) Connection refused
Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: ERROR: [<null>:0:<null>] [49254b96-7840-4300-b4d0-f1d479e06a9b:ACK:<null>] <core> [core/tcp_main.c:2960]: tcpconn_1st_send(): 172.16.8.23:56494: connect & send for 0x7fede7e5cda0 (sock 21) failed: Connection refused (111)
Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: ERROR: [<null>:0:<null>] [49254b96-7840-4300-b4d0-f1d479e06a9b:ACK:<null>] <core> [core/forward.h:292]: msg_send_buffer(): tcp_send failed
Aug  4 10:02:20 dsip001 /usr/sbin/kamailio[50581]: ERROR: [/etc/kamailio/kamailio.cfg:1622:RELAY] [49254b96-7840-4300-b4d0-f1d479e06a9b:ACK:<null>] sl [sl_funcs.c:414]: sl_reply_error(): stateless error reply used: Unfortunately error on sending to next hop occurred (477/SL)

I'm not sure why Kamailio is trying to connect back to itself on that port (172.16.8.23 is the DSIProuter). It seems like instead it should be attempting to connect to the IP address in the location table; the public/port pair that was recorded on successful registration.

[Micah Quinn]

Just wanted to update this thread in case somebody out there has more ideas. I've tried setting up DSIP router with a public IP instead of port forwarding using a firewall and I'm getting the exact same errors:

Aug 31 15:38:05 dsip001 /usr/sbin/kamailio[2740]: INFO: [/etc/kamailio/kamailio.cfg:1620:RELAY] [605aeda7-8603-4361-9bc0-49450f26d7ac:ACK:<null>] Attempting to route call to sip:99...@10.0.0.140:37675;transport=TLS;ob
Aug 31 15:38:05 dsip001 /usr/sbin/kamailio[2740]: ERROR: [<null>:0:<null>] [605aeda7-8603-4361-9bc0-49450f26d7ac:ACK:<null>] <core> [core/tcp_main.c:2951]: tcpconn_1st_send(): connect 172.16.8.23:57224 failed (RST) Connection refused
Aug 31 15:38:05 dsip001 /usr/sbin/kamailio[2740]: ERROR: [<null>:0:<null>] [605aeda7-8603-4361-9bc0-49450f26d7ac:ACK:<null>] <core> [core/tcp_main.c:2960]: tcpconn_1st_send(): 172.16.8.23:57224: connect & send for 0x7fd3d6d3e610 (sock 17) failed: Connection refused (111)
Aug 31 15:38:05 dsip001 /usr/sbin/kamailio[2740]: ERROR: [<null>:0:<null>] [605aeda7-8603-4361-9bc0-49450f26d7ac:ACK:<null>] <core> [core/forward.h:292]: msg_send_buffer(): tcp_send failed
Aug 31 15:38:05 dsip001 /usr/sbin/kamailio[2740]: ERROR: [/etc/kamailio/kamailio.cfg:1622:RELAY] [605aeda7-8603-4361-9bc0-49450f26d7ac:ACK:<null>] sl [sl_funcs.c:414]: sl_reply_error(): stateless error reply used: Unfortunately error on sending to next hop occurred (477/SL)

Calls from externally connected UAs work properly and do not timeout. Calls initiated from UAs connected directly to the PBX timeout with the above errors after approx 30 seconds.

[Micah Quinn]

By the way, I just re-watched Mack's video on freepbx pass thru and he uses a public IP address for his endpoint. It's also unclear from the video, but I would imagine that his DSIProuter has only a single NIC with a public interface. Maybe I'm not understanding this use case, but I'm not sure why you would proxy to another PBX that is already exposed on the Internet via a public IP address.

You received this message because you are subscribed to a topic in the Google Groups "dSIPRouter" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/dSIPRouter/tPDYYCwJRIg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to dSIPRouter+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dSIPRouter/804f64d3-1926-415a-91fa-99eb1d8f9587n%40googlegroups.com.

--

Micah Quinn

[AirsayLongCon]

In your port forwarding set up, did calls from external UA to external UA work?

[Micah Quinn]

No, external to external calls do not work. They have no audio and the INVITEs are not reliable; sometimes they go through, sometimes not.