Not able to reach my PBX public address

RouterOS General
1

Hello friends. Maybe someone can guide me through this issue.

I have configured a grandstream PBX in dual mode so I can reach internal SIP provider with one port and public IP be available for registering outside extensión in the second port.

With this configuration I can reach the internal Sip provider but not the external ip only if I am connected to local lan.

I have isp /29 public ip’s in wan bridge and the second port is connected to grandstream interface configured with public ip in this bridge but I can’t reach it from outside the lan.

If I am connected to lan I can register my extensión but Mikrotik is not participating in the routing so I don’t find out why is not registering since the public IP address is configured directly in my PBX.

2

Very detailed post, is cleary indicated the RouterBOARD used, the RouterOS version, and the configuration of the device.
All this details are suffocating…

3

Hello rextended, sorry for that. The router is CCR1036, Bridged to CRS326, both with routerOS and latest version updated 6.48.4

As an update I have setted up default port on GS to lan2 and now I can register extensions but I have lost connectivity to internal Sip provider.

I have created static routes in gs as well for both ports.

4

I can not full understand the detail, because are on your mind and I have not any device for remote mind reading…

The faster soluction is to set the device on single mode LAN interface and put NATs rules on roouter to reach from outside the PBX,
is also more secure than expose the PBX directly to the whole world…

5

It seems to me more like a topic for a Grandstream forum. As you have a WAN bridge on the Mikrotik, you’d have to have /interface bridge filter or /interface bridge nat rules in place to interfere with the bridging, or you would have to have use-ip-firewall.* set to yes under /interface bridge settings.

Other than that, I fully agree with @rextended that having the PBX directly exposed on a public IP is not a good idea; I don’t share the view that a NAT is the correct way to handle it, though. I would create an Ethernet point-to-point link between the Mikrotik and the PBX, with the public IP at the PBX side and some auxiliary private IP at the Mikrotik side, and use normal IP firewall rules to block access to any ports except the SIP one and the RTP range used by the PBX. But I don’t know how flexible is the networking setup of the PBX.

6

Is why I suggest NAT… :laughing: