Hello All. How are you doing?

I've implemented a PBX with asterisk in my LAN but the problem that I'm having is that when there is a video call between a softphone that is in the lan and one that is in an external network the mikrotik router RB2011 is filtering the incoming video, not the outcoming. I don't have this problem if the video call is make between softphones that are in the LAN. Also, I don't have problem with the audio signal, just the video.

As the ISP gives me just one public IP, there is a NAT. This is the firewall nat configuration:
As you can see the first action is regarding the generic nat NAT. The second action allow me to stablish a signaling with the PBX which is in the LAN with a softphone which is out the LAN (without this line the connection is not stablish).

And the last line is a try to allow the video incoming stream but it's not working. You can see here that the Private IP pool is 100.64.0.0/24 and the ports for rtp package are random between the ports ranges 10000-20000 (this is an Asterisk
characteristic) and I can changes the ports ranges but for every call I need 2 rtp ports and if there is a video stream 4 ports for every 2 softphones which stablish a video call. The rtp ports ranges 10000-20000 is an standar in asterisk.
Also the mikrotik port which is connected to the public network is ether6 and the port that connect the LAN is ether2, there is there a switch configuration with the ports ether1, ether3, ether4 and ether5 with the ether2 as master-ports.

How I must configure the nat ? What I'm missing?

Best regards.

I'm not sure your problem lies in the NAT-policy. Are you allowing incoming traffic through your firewall on the given ports? A good NAT-translastion doesn't mean the traffic is actually entering your network

Thanks for the reply.

Well first I tried with this rules:


Where you can see that there is a chain=forwards with an action accept in the last line and it taking cares thats ports. But it don't fix the problem.

Just a doubt that I have, define a port range like this
Is that sentence fine?

If I'm not mistaken, the video used is H323 - a "joy" to work, with NAT. I don't remember the caveats, but take a look at the H323 signaling, and NAT behavior.

Something that I've note is that when the softphone that is in the public network makes a voice call, the comunications is stablish but just for a seconds and then the call get off. That not happens when the softphone in the lan makes the call.

There is any documentation about this? regarding the wiki Firewall/Nat is not complete for this type of problem.

just try this :
/ip fi service-port disable sip,h323

Code: Select all

add action=accept chain=forward dst-port=10000-20000 protocol=udp src-port=\
    10000-20000

I would leave off the src-port part of that rule. Source ports can be all over the place.

Thanks, the problem was the src-ports.

Can I make you a question k6ccc? Why it is? It supposed that the softphones must works in a fixed ranges of ports?

I found in RFC 768 for udp

"Source Port is an optional field, when meaningful, it indicates the port
of the sending process, and may be assumed to be the port to which a
reply should be addressed in the absence of any other information. If
not used, a value of zero is inserted."

Thanks, the problem was the src-ports.

Can I make you a question k6ccc? Why it is? It supposed that the softphones must works in a fixed ranges of ports?

Very simple. The device that is originating the packet picks a semi-random port number to use for the origination. It will always be a port number that is otherwise not used on that device. High port numbers are normally used.