Port forwarding not working and I can't see why

crg · October 27, 2016, 12:10pm

I have a PBX behind my RB2011 and it is running SIP trunks. I am having 1 way audio issues (inbound from carrier being blocked). I cannot seem to get the setup correct in IP/Firewall/NAT for this.

Here’s what I need in a basic description:
-UDP ports 10020 through 10531 need to come inbound from the SIP carrier through the RB2011 to 192.168.201.201…same internal UDP ports 10020-10531.

Everything else is good currently. My SIP registration is occurring w/o issue (5060&5061), though I’ve no specific rules in place for this. I suspect a defconf is allowing this. So no worries there.

Any thoughts? I have lost count on the combination’s I have already tried in IP/Firewall/NAT for adding a new rule.

Thank you!

ik3umt · October 27, 2016, 12:43pm

Are you sure is a port forwarding issue ?
Have you tried to enable STUN and see how it goes ?
Or simply a codec issue ?

crg · October 27, 2016, 12:58pm

Very sure it is blocked at the RB2011. I can wireshark at the PBX and the ISP (Impact Telecom) is capturing as well. We see the traffic leaving the PBX to Impact, Impact sees traffic to the PBX, but I do not see the returned UDP traffic in wireshark.

Again, this is only the audio stream that uses UDP ports 10020-10531. The SIP registration that setups up and tears down the call is moving in and out of the RB2011 unmolested.

STUN, I am unfamiliar with that…that’s not a RB setting, is it? It isn’t an option in the PBX, that I do know.

Thank you.

blajah · October 27, 2016, 1:19pm

Allow logging for firewall, and catch which rule is dropping traffic of interest.

SIP helper

ip fire service-port pri

You should provide also what rule do you have right now for NAT.

crg · October 27, 2016, 1:40pm

I am sorry all, I am a phone guy first, not a traditional IT guy.
I am learning my new RB2011 and haven’t figured it out well enough to be fluent yet. How can I go about providing the current settings I have? I’m in the web GUI and/or WinBox but I don’t see a way to easily copy the data. I know how to do a dbase back up.

Also, Blajah, I can’t seem to find where in WinBox or the GUI I attempt the command you provided? If it matters, the PBX is not using a PRI, but SIP trunking.

Thank you!

JB172 · October 27, 2016, 1:49pm

In Winbox press New Terminal and type:
ip firewall nat print

and

ip firewall service-port print

Copy and paste the results here

crg · October 27, 2016, 1:55pm

Sweet,, thank you JB!
[admin@MikroTik_Router] > ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade
chain=srcnat action=masquerade src-address=192.168.201.0/24
dst-address=0.0.0.0/0 out-interface=ether1 log=no log-prefix=""

1 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.101 src-port=5094-5095 dst-port=5094-5095 dscp=46
log=no log-prefix=""

2 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.101 src-port=3496-3497 dst-port=3496-3497 log=no
log-prefix=""

3 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.102 src-port=5092-5093 dst-port=5092-5093 log=no
log-prefix=""

4 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.102 src-port=3490-3491 dst-port=3490-3491 log=no
log-prefix=""

5 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.206 src-port=5062-5063 dst-port=5062-5063 log=no

[admin@MikroTik_Router] >

Those current rules are for other devices/IPs on my LAN and are not actually the ones I'm currently troubleshooting, so really, there is not a current NAT rule for this post.
The Filter Rules are at default values as well. Here's that stuff:
[admin@MikroTik_Router] /ip firewall> export

oct/27/2016 09:54:30 by RouterOS 6.34.3

software id = 2R8G-BU46

/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" dst-address=0.0.0.0/0 out-interface=ether1
src-address=192.168.201.0/24
add chain=dstnat dscp=46 dst-address=192.168.201.101 dst-port=5094-5095 protocol=udp src-address=0.0.0.0
src-port=5094-5095
add chain=dstnat dst-address=192.168.201.101 dst-port=3496-3497 protocol=udp src-address=0.0.0.0 src-port=
3496-3497
add chain=dstnat dst-address=192.168.201.102 dst-port=5092-5093 protocol=udp src-address=0.0.0.0 src-port=
5092-5093
add chain=dstnat dst-address=192.168.201.102 dst-port=3490-3491 protocol=udp src-address=0.0.0.0 src-port=
3490-3491
add chain=dstnat dst-address=192.168.201.206 dst-port=5062-5063 protocol=udp src-address=0.0.0.0 src-port=
5062-5063
add chain=dstnat dst-address=192.168.201.206 dst-port=3464-3465 protocol=udp src-address=0.0.0.0 src-port=
3464-3465
[admin@MikroTik_Router] /ip firewall> firewall

dliebchen · October 27, 2016, 2:22pm

Hi,

I am also new to RouterOS but I had similar problem. As I can see you set up some NAT rules which should be fine. But your firewall seems to drop them. You have to set up forward rules for every entry in your NAT table.

Example; you want to run a FTP Service:

NAT so that port 21 is NATed to 192.168.0.200 (f.e)
Firewall rule (forward chain) so that port 21 is accepted

Good luck

blajah · October 27, 2016, 2:23pm

Whoa
Well, there can be couple issues.

In first place try to change dst-nat rules so it does not contain source IP but interface as criteria, and action should be dst-nat:
Your rule #1

 chain=dstnat action=dst-nat to-addresses=192.168.201.101 to-ports=5094-5095 dscp=46 
       in-interface=Your_WAN_interface_name dst-port=5094-5095 log=no log-prefix=""

crg · October 27, 2016, 2:50pm

Man, I’m starting to lose it. For kicks, I blew out all the NAT rules, save for:
chain=srcnat action=masquerade src-address=192.168.201.0/24
dst-address=0.0.0.0/0 out-interface=ether1 log=no log-prefix=“”

Then I went to Filter Rules and disabled all them.

So effectively (by my fractured logic ) there should be no Filter Rules or NAT rules enabled. I have then made a test inbound call and I still do not have 2 way audio…inbound UDP 10020-10531 packets are not making it to the PBX from the SIP provider.

Where else in the RB2011 would incoming traffic be blocked? I have not done a whole lot of config changes on this setup, so it isn’t exactly super densely programmed.

blajah · October 27, 2016, 3:01pm

Take it nice and slowly.

As for masquerade you need this:

chain=srcnat action=masquerade out-interface=ether1 log=no 
      log-prefix=""

This is all you need.

If you have disabled NAT rules it’s expected you do not see traffic coming in, because your router does not have a clue what to do with that traffic.

Now, you need to tell to router where to forward that traffic:

chain=dstnat action=dst-nat to-addresses=192.168.201.101 
      to-ports=10020-10531 protocol=udp in-interface=ether1 
      dst-port=10020-10531 log=no log-prefix=""

crg · October 27, 2016, 3:10pm

I’m actually not about to lose my s***, just a bad example of trying to be funny in text..dooh!

I just tweaked my NAT rules:
admin@MikroTik_Router] > ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix=“”

1 chain=dstnat action=dst-nat to-addresses=192.168.201.201 to-ports=10020-10531 protocol=udp in-interface=ether1 log=no log-prefix=“”
[admin@MikroTik_Router] >

the IP 192.168.201.201 is actually where those ports need to route to. Still not getting the packets inbound.

crg · October 27, 2016, 3:12pm

forgot dest ports: Corrected:
[admin@MikroTik_Router] > ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface=ether1 log=no
log-prefix=“”

1 chain=dstnat action=dst-nat to-addresses=192.168.201.201
to-ports=10020-10531 protocol=udp in-interface=ether1
dst-port=10020-10531 log=no log-prefix=“”
[admin@MikroTik_Router] >

Still no incoming audio. Sorry about that…

crg · October 27, 2016, 4:04pm

Ok, I have a really good handle on NAT programming now…thank you all for the assistance.
I have proven the forwarding sequence is correct in the RB2011, which led to a discovery that has nothing to do w/ the router.

I have 2 way audio now on incoming and outgoing calls.

I have learned much today with the NAT setup and also the Terminal print command. Very handy.

Thank you all for your patience and assistance. Hopefully, I’ll be good for a while now.

blajah · October 27, 2016, 5:48pm

You’re welcome.

discipulus · October 27, 2016, 6:26pm

How did you get this working?