Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Sometime yesterday, my Asterisk box quit talking to my voip provider. I've determined it to be the router, as I have a mirrored router on standby should this one causes problems - which it did.

The router is running Ubuntu 10.04, kernel: 2.6.32-39-server.

I've pared down the iptables to bare minimum in the hopes that might be the problem:

-A FORWARD -o eth0 -j LOG  --log-level 7 --log-prefix BANDWIDTH_OUT:
-A FORWARD -i eth0 -j LOG  --log-level 7 --log-prefix BANDWIDTH_IN:
-A OUTPUT -o eth0 -j LOG  --log-level 7 --log-prefix BANDWIDTH_OUT:
-A INPUT -i eth0 -j LOG  --log-level 7 --log-prefix BANDWIDTH_IN:
-A FORWARD -m state -i eth0 -o eth1 --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 8080 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 10000 -j ACCEPT
-A INPUT -m state -i eth0 --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A FORWARD -p udp -m udp --dport 4569 -j ACCEPT
# Completed

# Completed
-A PREROUTING -p udp -m udp --dport 4569 -j DNAT  --to
-A PREROUTING -p tcp -m tcp --dport 5930 -j DNAT  --to
-A PREROUTING -p tcp -m tcp --dport 30 -j DNAT  --to
-A PREROUTING -p tcp -m tcp --dport 10001 -j DNAT  --to
-A PREROUTING -p tcp -m tcp --dport 8000 -j DNAT  --to
-A PREROUTING -p udp -m udp --dport 10001:20000 -j DNAT  --to
# Completed

I've even:

apt-get purge iptables


apt-get install iptables

I've tried connecting to the voip provider from another computer using Zoiper & that was blocked as well:

745 65.421743   ICMP    98  Destination unreachable (Port unreachable)

I can also ping the IP and get a successful return:

root@pbx:~ $ ping
PING ( 56(84) bytes of data.
64 bytes from ( icmp_seq=1 ttl=54 time=26.1 ms
64 bytes from ( icmp_seq=2 ttl=54 time=28.8 ms
64 bytes from ( icmp_seq=3 ttl=54 time=25.7 ms
64 bytes from ( icmp_seq=4 ttl=54 time=27.9 ms
64 bytes from ( icmp_seq=5 ttl=54 time=23.9 ms

--- ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4002ms
rtt min/avg/max/mdev = 23.934/26.542/28.848/1.734 ms

Using another network, I was able to connect successfully to the voip provider as well as when I swapped the router out for the back up.

Everything else I have checked seems to pass through ok. I can connect from outside of the network to the PBX, and just about anything else I need to connect to. It just seems that the router has taken a dislike to anything VOIP related.

share|improve this question

If you are using SIP VoIP telephony, you have to use this iptables command:

iptables -A FORWARD -p udp --dport 5060 -j ACCEPT

This is for SIP messages. You will need some ports for voice packets too:

iptables -A FORWARD -p udp --sport 1024: --dport 1024: -j ACCEPT
share|improve this answer
I'm using IAX2, which uses port 4569. Switching to SIP just made it more problematic while trying to diagnose. – Go3Team Mar 15 '12 at 16:37
@Go3Team are IAX using UDP? Hmm... I've found, that yes. Try capture packets and see, what packets sending your Asterisk and if it got responses. – Jan Marek Mar 16 '12 at 5:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.