SIP NAT Problem

RouterOS General
1

Hello!

I have Mikrotik RB750G with OS ver 4.13
I have WAN connection with DHCP and PPTP VPN to SIP-PBX (172.31.0.5) behind pptp server (non mikrotik).
Behind a RB750G router are 2 IP-Phone.

Schema

[2*IP-Phone] – (lan) – [RB750G] -----(pptp) ---- [pptp-server (vyatta 6.1)] — PBX (172.31.0.5)

Periodically phones lose conection to PBX. Command /ip firewall connection remove
restore the normal work for some time.

Firewall and router configuration (the rest by default)

 
/ip firewall filter
add action=accept chain=input comment="default configuration" disabled=no \
    protocol=icmp
add action=accept chain=input comment="default configuration" \
    connection-state=established disabled=no in-interface=ether1-gateway
add action=accept chain=input comment="default configuration" \
    connection-state=related disabled=no in-interface=ether1-gateway
add action=drop chain=input comment="default configuration" disabled=no \
    in-interface=ether1-gateway
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" disabled=\
    no out-interface=ether1-gateway
add action=masquerade chain=srcnat comment="" disabled=no dst-address=\
    172.31.0.0/24 out-interface=pptp-phone
/ip firewall service-port
set sip disabled=no ports=5060,5061
 
 
/ip route
add comment="" disabled=no distance=1 dst-address=172.31.0.0/24 gateway=\
    pptp-phone scope=30 target-scope=10

Any ideas ?

2 
/ip firewall filter
add action=accept chain=input comment="default configuration" disabled=no \
    protocol=icmp
add action=accept chain=input comment="default configuration" \
    connection-state=established disabled=no in-interface=ether1-gateway
add action=accept chain=input comment="default configuration" \
    connection-state=related disabled=no in-interface=ether1-gateway
add action=drop chain=input comment="default configuration" disabled=no \
    in-interface=ether1-gateway

Why u r using this ?? your Phone will also work without this command so try after removing these commands.
I think After removing filter rules established connections will automatcally flush out.

3

input chain is for traffic destined “to” the router - not thru the router. Use the forward chain as well.

why are you natting thru the vpn tunnel? isnt that the point of the tunnel to get rid of natting?