Community discussions

 
crg
just joined
Topic Author
Posts: 10
Joined: Mon Oct 24, 2016 5:02 pm

Port forwarding not working and I can't see why

Thu Oct 27, 2016 3:10 pm

I have a PBX behind my RB2011 and it is running SIP trunks. I am having 1 way audio issues (inbound from carrier being blocked). I cannot seem to get the setup correct in IP/Firewall/NAT for this.

Here's what I need in a basic description:
-UDP ports 10020 through 10531 need to come inbound from the SIP carrier through the RB2011 to 192.168.201.201...same internal UDP ports 10020-10531.

Everything else is good currently. My SIP registration is occurring w/o issue (5060&5061), though I've no specific rules in place for this. I suspect a defconf is allowing this. So no worries there.

Any thoughts? I have lost count on the combination's I have already tried in IP/Firewall/NAT for adding a new rule.

Thank you!
 
ik3umt
Member Candidate
Member Candidate
Posts: 248
Joined: Tue Jul 08, 2014 3:58 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 3:43 pm

Are you sure is a port forwarding issue ?
Have you tried to enable STUN and see how it goes ?
Or simply a codec issue ?
 
crg
just joined
Topic Author
Posts: 10
Joined: Mon Oct 24, 2016 5:02 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 3:58 pm

Very sure it is blocked at the RB2011. I can wireshark at the PBX and the ISP (Impact Telecom) is capturing as well. We see the traffic leaving the PBX to Impact, Impact sees traffic to the PBX, but I do not see the returned UDP traffic in wireshark.

Again, this is only the audio stream that uses UDP ports 10020-10531. The SIP registration that setups up and tears down the call is moving in and out of the RB2011 unmolested.

STUN, I am unfamiliar with that...that's not a RB setting, is it? It isn't an option in the PBX, that I do know.

Thank you.
 
User avatar
blajah
Member Candidate
Member Candidate
Posts: 224
Joined: Fri Jun 12, 2015 8:58 pm
Location: Belgrade, Serbia
Contact:

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 4:19 pm

I have a PBX behind my RB2011 and it is running SIP trunks. I am having 1 way audio issues (inbound from carrier being blocked). I cannot seem to get the setup correct in IP/Firewall/NAT for this.

Here's what I need in a basic description:
-UDP ports 10020 through 10531 need to come inbound from the SIP carrier through the RB2011 to 192.168.201.201...same internal UDP ports 10020-10531.
Allow logging for firewall, and catch which rule is dropping traffic of interest.
Everything else is good currently. My SIP registration is occurring w/o issue (5060&5061), though I've no specific rules in place for this. I suspect a defconf is allowing this. So no worries there.
SIP helper :)
ip fire service-port pri
You should provide also what rule do you have right now for NAT.
I have bigger routing table.
 
crg
just joined
Topic Author
Posts: 10
Joined: Mon Oct 24, 2016 5:02 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 4:40 pm

I am sorry all, I am a phone guy first, not a traditional IT guy.
I am learning my new RB2011 and haven't figured it out well enough to be fluent yet. How can I go about providing the current settings I have? I'm in the web GUI and/or WinBox but I don't see a way to easily copy the data. I know how to do a dbase back up.

Also, Blajah, I can't seem to find where in WinBox or the GUI I attempt the command you provided? If it matters, the PBX is not using a PRI, but SIP trunking.

Thank you!
 
JB172
Member
Member
Posts: 306
Joined: Fri Jul 24, 2015 3:12 pm
Location: AWMN

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 4:49 pm

In Winbox press New Terminal and type:
ip firewall nat print

and

ip firewall service-port print

Copy and paste the results here
 
crg
just joined
Topic Author
Posts: 10
Joined: Mon Oct 24, 2016 5:02 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 4:55 pm

Sweet,, thank you JB!
[admin@MikroTik_Router] > ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade
chain=srcnat action=masquerade src-address=192.168.201.0/24
dst-address=0.0.0.0/0 out-interface=ether1 log=no log-prefix=""

1 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.101 src-port=5094-5095 dst-port=5094-5095 dscp=46
log=no log-prefix=""

2 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.101 src-port=3496-3497 dst-port=3496-3497 log=no
log-prefix=""

3 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.102 src-port=5092-5093 dst-port=5092-5093 log=no
log-prefix=""

4 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.102 src-port=3490-3491 dst-port=3490-3491 log=no
log-prefix=""

5 chain=dstnat action=accept protocol=udp src-address=0.0.0.0
dst-address=192.168.201.206 src-port=5062-5063 dst-port=5062-5063 log=no

[admin@MikroTik_Router] >

Those current rules are for other devices/IPs on my LAN and are not actually the ones I'm currently troubleshooting, so really, there is not a current NAT rule for this post.
The Filter Rules are at default values as well. Here's that stuff:
[admin@MikroTik_Router] /ip firewall> export
# oct/27/2016 09:54:30 by RouterOS 6.34.3
# software id = 2R8G-BU46
#
/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" dst-address=0.0.0.0/0 out-interface=ether1 \
src-address=192.168.201.0/24
add chain=dstnat dscp=46 dst-address=192.168.201.101 dst-port=5094-5095 protocol=udp src-address=0.0.0.0 \
src-port=5094-5095
add chain=dstnat dst-address=192.168.201.101 dst-port=3496-3497 protocol=udp src-address=0.0.0.0 src-port=\
3496-3497
add chain=dstnat dst-address=192.168.201.102 dst-port=5092-5093 protocol=udp src-address=0.0.0.0 src-port=\
5092-5093
add chain=dstnat dst-address=192.168.201.102 dst-port=3490-3491 protocol=udp src-address=0.0.0.0 src-port=\
3490-3491
add chain=dstnat dst-address=192.168.201.206 dst-port=5062-5063 protocol=udp src-address=0.0.0.0 src-port=\
5062-5063
add chain=dstnat dst-address=192.168.201.206 dst-port=3464-3465 protocol=udp src-address=0.0.0.0 src-port=\
3464-3465
[admin@MikroTik_Router] /ip firewall> firewall
 
dliebchen
just joined
Posts: 5
Joined: Thu Oct 20, 2016 5:21 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 5:22 pm

Hi,

I am also new to RouterOS but I had similar problem. As I can see you set up some NAT rules which should be fine. But your firewall seems to drop them. You have to set up forward rules for every entry in your NAT table.

Example; you want to run a FTP Service:
1. NAT so that port 21 is NATed to 192.168.0.200 (f.e)
2. Firewall rule (forward chain) so that port 21 is accepted

Good luck
Last edited by dliebchen on Thu Oct 27, 2016 5:24 pm, edited 1 time in total.
 
User avatar
blajah
Member Candidate
Member Candidate
Posts: 224
Joined: Fri Jun 12, 2015 8:58 pm
Location: Belgrade, Serbia
Contact:

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 5:23 pm

Whoa :)
Well, there can be couple issues.

In first place try to change dst-nat rules so it does not contain source IP but interface as criteria, and action should be dst-nat:
Your rule #1
 chain=dstnat action=dst-nat to-addresses=192.168.201.101 to-ports=5094-5095 dscp=46 
       in-interface=Your_WAN_interface_name dst-port=5094-5095 log=no log-prefix=""
I have bigger routing table.
 
crg
just joined
Topic Author
Posts: 10
Joined: Mon Oct 24, 2016 5:02 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 5:50 pm

Man, I'm starting to lose it. For kicks, I blew out all the NAT rules, save for:
chain=srcnat action=masquerade src-address=192.168.201.0/24
dst-address=0.0.0.0/0 out-interface=ether1 log=no log-prefix=""

Then I went to Filter Rules and disabled all them.

So effectively (by my fractured logic :) ) there should be no Filter Rules or NAT rules enabled. I have then made a test inbound call and I still do not have 2 way audio...inbound UDP 10020-10531 packets are not making it to the PBX from the SIP provider.

Where else in the RB2011 would incoming traffic be blocked? I have not done a whole lot of config changes on this setup, so it isn't exactly super densely programmed.
 
User avatar
blajah
Member Candidate
Member Candidate
Posts: 224
Joined: Fri Jun 12, 2015 8:58 pm
Location: Belgrade, Serbia
Contact:

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 6:01 pm

Take it nice and slowly.

As for masquerade you need this:
chain=srcnat action=masquerade out-interface=ether1 log=no 
      log-prefix=""  
This is all you need.

If you have disabled NAT rules it's expected you do not see traffic coming in, because your router does not have a clue what to do with that traffic.

Now, you need to tell to router where to forward that traffic:
chain=dstnat action=dst-nat to-addresses=192.168.201.101 
      to-ports=10020-10531 protocol=udp in-interface=ether1 
      dst-port=10020-10531 log=no log-prefix=""
I have bigger routing table.
 
crg
just joined
Topic Author
Posts: 10
Joined: Mon Oct 24, 2016 5:02 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 6:10 pm

I'm actually not about to lose my s***, just a bad example of trying to be funny in text..dooh!

I just tweaked my NAT rules:
admin@MikroTik_Router] > ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix=""

1 chain=dstnat action=dst-nat to-addresses=192.168.201.201 to-ports=10020-10531 protocol=udp in-interface=ether1 log=no log-prefix=""
[admin@MikroTik_Router] >

the IP 192.168.201.201 is actually where those ports need to route to. Still not getting the packets inbound.
 
crg
just joined
Topic Author
Posts: 10
Joined: Mon Oct 24, 2016 5:02 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 6:12 pm

forgot dest ports: Corrected:
[admin@MikroTik_Router] > ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface=ether1 log=no
log-prefix=""

1 chain=dstnat action=dst-nat to-addresses=192.168.201.201
to-ports=10020-10531 protocol=udp in-interface=ether1
dst-port=10020-10531 log=no log-prefix=""
[admin@MikroTik_Router] >

Still no incoming audio. Sorry about that...
 
crg
just joined
Topic Author
Posts: 10
Joined: Mon Oct 24, 2016 5:02 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 7:04 pm

Ok, I have a really good handle on NAT programming now...thank you all for the assistance.
I have proven the forwarding sequence is correct in the RB2011, which led to a discovery that has nothing to do w/ the router.

I have 2 way audio now on incoming and outgoing calls.

I have learned much today with the NAT setup and also the Terminal print command. Very handy.

Thank you all for your patience and assistance. Hopefully, I'll be good for a while now.

:)
 
User avatar
blajah
Member Candidate
Member Candidate
Posts: 224
Joined: Fri Jun 12, 2015 8:58 pm
Location: Belgrade, Serbia
Contact:

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 8:48 pm

You're welcome.
I have bigger routing table.
 
discipulus
just joined
Posts: 2
Joined: Thu Oct 27, 2016 8:21 pm

Re: Port forwarding not working and I can't see why

Thu Oct 27, 2016 9:26 pm

How did you get this working?

Who is online

Users browsing this forum: No registered users and 28 guests