Hey guys,
I'm having an issue with SIP phones that are not able to properly connect to our server. Server is WAN, phones are LAN.
Internal Network (192.168.62.0/24) -> MikoTik (192.168.62.1) (50.x.x.x) -> Comcast Modem
They have 1 static IP Address.
Phone appears to make connection to server and register, but unable to make calls.
Following dumps:
[admin@MPACTik] > /ip address print detail
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf
address=192.168.62.1/24 network=192.168.62.0 interface=ether2-master
actual-interface=bridge1
1 address=50.x.x.x/30 network=50.x.x.x interface=ether1
actual-interface=ether1
[admin@MPACTik] > /ip route print detail
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
0 A S dst-address=0.0.0.0/0 gateway=50.x.x.x
gateway-status=50.x.x.x reachable via ether1 distance=1 scope=30
target-scope=10
1 ADC dst-address=50.x.x.x/30 pref-src=50.x.x.x gateway=ether1
gateway-status=ether1 reachable distance=0 scope=10
2 ADC dst-address=192.168.62.0/24 pref-src=192.168.62.1 gateway=bridge1
gateway-status=bridge1 reachable distance=0 scope=10
[admin@MPACTik] > /interface print detail
Flags: D - dynamic, X - disabled, R - running, S - slave
0 R name="ether1" default-name="ether1" type="ether" mtu=1500 actual-mtu=1500
l2mtu=1598 max-l2mtu=4074 mac-address=E4:8D:8C:67:7A:A9 fast-path=yes
last-link-down-time=oct/25/2016 14:35:31
last-link-up-time=oct/25/2016 15:03:50 link-downs=5
1 RS name="ether2-master" default-name="ether2" type="ether" mtu=1500
actual-mtu=1500 l2mtu=1598 max-l2mtu=4074 mac-address=E4:8D:8C:67:7A:AA
fast-path=yes last-link-down-time=oct/20/2016 16:08:21
last-link-up-time=oct/20/2016 16:51:44 link-downs=1
2 S name="ether3" default-name="ether3" type="ether" mtu=1500 actual-mtu=1500
l2mtu=1598 max-l2mtu=4074 mac-address=E4:8D:8C:67:7A:AB fast-path=yes
link-downs=0
3 S name="ether4" default-name="ether4" type="ether" mtu=1500 actual-mtu=1500
l2mtu=1598 max-l2mtu=4074 mac-address=E4:8D:8C:67:7A:AC fast-path=yes
link-downs=0
4 S name="ether5" default-name="ether5" type="ether" mtu=1500 actual-mtu=1500
l2mtu=1598 max-l2mtu=4074 mac-address=E4:8D:8C:67:7A:AD fast-path=yes
link-downs=0
5 R name="bridge1" type="bridge" mtu=auto actual-mtu=1500 l2mtu=1598
mac-address=E4:8D:8C:67:7A:AA fast-path=yes
last-link-up-time=oct/06/2016 15:04:49 link-downs=0
[admin@MPACTik] > /ip firewall export
oct/27/2016 12:19:56 by RouterOS 6.34.2
software id = 1YS4-CU7T
/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept establieshed,related"
connection-state=established,related
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add chain=forward comment="defconf: accept established,related"
connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=
invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface=ether1
/ip firewall mangle
add action=mark-connection chain=forward connection-state=new dst-address=
104.167.5.59 dst-port=5060 log=yes new-connection-mark=sip-connection
protocol=tcp
add action=mark-packet chain=forward connection-mark=sip-connection log=yes
new-packet-mark=SIP
add action=mark-connection chain=forward connection-state=new dst-address=
104.167.5.59 log=yes log-prefix=RTP-Conn new-connection-mark=rtp-connection
port=10000-20000 protocol=udp
add action=mark-packet chain=forward connection-mark=rtp-connection log=yes
new-packet-mark=RTP
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=
ether1
add action=dst-nat chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp
to-addresses=192.168.62.2 to-ports=443
add action=dst-nat chain=dstnat dst-port=80 in-interface=ether1 protocol=tcp
to-addresses=192.168.62.2 to-ports=80
add action=dst-nat chain=dstnat dst-port=4125 in-interface=ether1 protocol=tcp
to-addresses=192.168.62.2 to-ports=4125
add action=dst-nat chain=dstnat dst-port=25 in-interface=ether1 protocol=tcp
to-addresses=192.168.62.2 to-ports=25
add action=dst-nat chain=dstnat dst-port=587 in-interface=ether1 protocol=tcp
to-addresses=192.168.62.2 to-ports=587
add action=dst-nat chain=dstnat dst-port=110 in-interface=ether1 protocol=tcp
to-addresses=192.168.62.2 to-ports=110
add action=dst-nat chain=dstnat dst-port=995 in-interface=ether1 protocol=tcp
to-addresses=192.168.62.2 to-ports=995
add action=dst-nat chain=dstnat dst-port=143 in-interface=ether1 protocol=tcp
to-addresses=192.168.62.2 to-ports=143
add action=dst-nat chain=dstnat dst-port=993 in-interface=ether1 protocol=tcp
to-addresses=192.168.62.2 to-ports=993
add action=dst-nat chain=dstnat dst-port=6002 in-interface=ether1 protocol=udp
to-addresses=192.168.62.1 to-ports=6002
add action=dst-nat chain=dstnat dst-port=6004 in-interface=ether1 protocol=udp
to-addresses=192.168.62.2 to-ports=6004
add action=passthrough chain=dstnat dst-address=50.x.x.x dst-port=5060
protocol=tcp to-addresses=192.168.62.87 to-ports=5060
add action=passthrough chain=dstnat dst-address=50.x.x.x dst-port=5060
protocol=udp to-addresses=192.168.62.87 to-ports=5060
add action=passthrough chain=dstnat dst-address=50.x.x.x dst-port=
10000-20000 protocol=tcp to-addresses=192.168.62.87 to-ports=10000-20000
add action=passthrough chain=dstnat dst-address=50.x.x.x dst-port=
10000-20000 protocol=udp to-addresses=192.168.62.87 to-ports=10000-20000
add action=masquerade chain=srcnat dst-address=50.x.x.x out-interface=
bridge1
add action=dst-nat chain=dstnat dst-address=50.x.x.x protocol=tcp
to-addresses=192.168.62.2 to-ports=443
add action=masquerade chain=srcnat out-interface=bridge1 src-address=
192.168.62.0/24
add action=dst-nat chain=dstnat dst-address=50.x.x.x protocol=tcp
to-addresses=192.168.62.2 to-ports=587
/ip firewall service-port
set sip disabled=yes
[admin@MPACTik] >
Any advice?
Thanks,
Discipulus -- The Student