Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Sometime yesterday, my Asterisk box quit talking to my voip provider. I've determined it to be the router, as I have a mirrored router on standby should this one causes problems - which it did.

The router is running Ubuntu 10.04, kernel: 2.6.32-39-server.

I've pared down the iptables to bare minimum in the hopes that might be the problem:

*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -o eth0 -j LOG  --log-level 7 --log-prefix BANDWIDTH_OUT:
-A FORWARD -i eth0 -j LOG  --log-level 7 --log-prefix BANDWIDTH_IN:
-A OUTPUT -o eth0 -j LOG  --log-level 7 --log-prefix BANDWIDTH_OUT:
-A INPUT -i eth0 -j LOG  --log-level 7 --log-prefix BANDWIDTH_IN:
-A FORWARD -m state -i eth0 -o eth1 --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 8080 -j ACCEPT
-A INPUT -p tcp -m tcp -i eth0 --dport 10000 -j ACCEPT
-A INPUT -m state -i eth0 --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A FORWARD -p udp -m udp --dport 4569 -j ACCEPT
COMMIT
# Completed

*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
-A PREROUTING -p udp -m udp --dport 4569 -j DNAT  --to 192.168.1.23:4569
-A PREROUTING -p tcp -m tcp --dport 5930 -j DNAT  --to 192.168.1.130:5900
-A PREROUTING -p tcp -m tcp --dport 30 -j DNAT  --to 192.168.1.130:22
-A PREROUTING -p tcp -m tcp --dport 10001 -j DNAT  --to 192.168.1.130:10000
-A PREROUTING -p tcp -m tcp --dport 8000 -j DNAT  --to 192.168.1.130:8000
-A PREROUTING -p udp -m udp --dport 10001:20000 -j DNAT  --to 192.168.2.3:10001-20000
COMMIT
# Completed

I've even:

apt-get purge iptables

&

apt-get install iptables

I've tried connecting to the voip provider from another computer using Zoiper & that was blocked as well:

745 65.421743   174.34.146.162  192.168.1.105   ICMP    98  Destination unreachable (Port unreachable)

I can also ping the IP and get a successful return:

root@pbx:~ $ ping atlanta.voip.ms
PING atlanta.voip.ms (174.34.146.162) 56(84) bytes of data.
64 bytes from 174.34.146.162.rdns.ubiquityservers.com (174.34.146.162): icmp_seq=1 ttl=54 time=26.1 ms
64 bytes from 174.34.146.162.rdns.ubiquityservers.com (174.34.146.162): icmp_seq=2 ttl=54 time=28.8 ms
64 bytes from 174.34.146.162.rdns.ubiquityservers.com (174.34.146.162): icmp_seq=3 ttl=54 time=25.7 ms
64 bytes from 174.34.146.162.rdns.ubiquityservers.com (174.34.146.162): icmp_seq=4 ttl=54 time=27.9 ms
64 bytes from 174.34.146.162.rdns.ubiquityservers.com (174.34.146.162): icmp_seq=5 ttl=54 time=23.9 ms

--- atlanta.voip.ms ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4002ms
rtt min/avg/max/mdev = 23.934/26.542/28.848/1.734 ms

Using another network, I was able to connect successfully to the voip provider as well as when I swapped the router out for the back up.

Everything else I have checked seems to pass through ok. I can connect from outside of the network to the PBX, and just about anything else I need to connect to. It just seems that the router has taken a dislike to anything VOIP related.

share|improve this question
add comment

1 Answer

If you are using SIP VoIP telephony, you have to use this iptables command:

iptables -A FORWARD -p udp --dport 5060 -j ACCEPT

This is for SIP messages. You will need some ports for voice packets too:

iptables -A FORWARD -p udp --sport 1024: --dport 1024: -j ACCEPT
share|improve this answer
    
I'm using IAX2, which uses port 4569. Switching to SIP just made it more problematic while trying to diagnose. –  Go3Team Mar 15 '12 at 16:37
    
@Go3Team are IAX using UDP? Hmm... I've found, that yes. Try capture packets and see, what packets sending your Asterisk and if it got responses. –  Jan Marek Mar 16 '12 at 5:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.