0

We have a small company network here (192.168.178.x) and a private network in home office (192.168.2.x). These networks are both running a FritzBox router and are connected via VPN trough FritzBox to FritzBox (IPSec, 192.168.2.1 resolves to 192.168.178.128 in remote network).

Now I try to connect to the companies telephone System with my Softphone (local computer IP is 192.168.2.41) and the telephone system is addressed at 192.168.178.10 and is running an local VoIP service.

I can register my softphone / account, I can call someone, I can get called, but nobody is hearing me and I do not hear anybody.

So the route should look like this:

192.168.2.41 (client computer with softphone) ->
192.168.2.1 FritzBox ->
192.168.178.1 FritzBox remote VPN Server ->
192.168.178.10 telephone system / VoIP Server

I have tried to catch some packages within the FritzBoxes and check them with Wireshark. But it am not really able to understand them. While calling the connection between 192.168.2.41 and 192.168.178.62 is active. But I even do not now which device 192.168.178.62 should be.

Any ideas why there do not get any voice data transferred?

Improve this question
6
  • the telephone system/PBX it's based on asterisk?
    – DarkVex
    Feb 17, 2020 at 21:34
  • No it’s an Auerswald COMmander 6000
    – Kevin Lieser
    Feb 17, 2020 at 21:37
  • I'm not familiar with this PBX but usually the NAT option on asterisk will resolve it, I think there is something similar on the Auerswald COMmander. Check also the softphone stun if it's enabled or disabled, I've seen sometime for example with zoiper softphone breaking the RTP (voice traffic) with the stun enabled when was not needed
    – DarkVex
    Feb 17, 2020 at 21:48
  • Check if you are letting both UDP and TCP through.
    – Eduardo Trápani
    Feb 18, 2020 at 1:17
  • @DarkVex STUN is disabled.
    – Kevin Lieser
    Feb 18, 2020 at 1:58

2 Answers 2

Reset to default
1

A standard SIP VoIP call involves 4 IP tuples: two control channels and two voice channels, one of each from each client to the other client. Both ends of the call are both server (inbound connections) and client (outbound connections). Usually, a dynamic high numbered port is used for the voice channel. A clients control channel is used to pass the voice connection IP and port opened by the client to the opposing call client within the control channel payload. Each client then initiates a voice channel (RTP mentioned above), resulting in one voice channel each way. In your case the home office client would pass the local IP (192.168.2.41), not the virtual IP (192.168.178.128) of the far end of the VPN. This results in the main office client attempting to connect to an unroutable IP rather than the virtual IP.

Your remote VPN softclient must be able to pass a routable IP to the office client for the voice channel connection or you need a firewall capable of SIP session inspection and management (aka a SIP gateway).

Some softclients can do a reverse cone connection (remote client initiates all call paths) to mitigate virtual IPs and NAT on a VPN. You can look for that function in your soft client docs. Otherwise, the local IPs of both VoIP clients must be transparently and directly routable by both clients.

If you have a STUN server running, enabling STUN on the client will give the client a way to lookup its virtual IP on the office end of the VPN and use that IP for registration and SIP sessions. Both server and home client must be enabled to work. Note, the STUN service must be running on a server that is directly routable by the PBX (no NAT). Usually this is the same server as the SIP registrar and catalog services.

Q: does the same behavior occur between clients on the same subnet? I’m guessing not.

Improve this answer
9
  • In the Remote Network my network is only Accessibility with 192.168.178.128 what resolved in my FritzBox VPN connection. The client 192.168.2.41 is not accessible directly. To get that working I would change the VPN mode to completely combine these networks. But since this is a private home office network that’s not what I want. Is there a way to use a STUN Server for that? In my soft Phone I can configure a STUN server. But where on the other side? In the PBX / telephone system? I think both need to connect to the same STUN server. When I am direct at work in the same network it’s working.
    – Kevin Lieser
    Feb 18, 2020 at 2:12
  • The STUN server needs to be running in the office network. Usually the same server as PBX will host the service. Client will need STUN enabled as a client, to lookup its remote IP and the NAT port. STUN does not work with all NAT configs (full cone is simplest that works). You will have to read the STUN docs and make sure VPN is set up compatibly.
    – Yaro
    Feb 18, 2020 at 2:20
  • So when I Setup a STUN server on one of our online Linux server it will not work? The STUN server must be inside the companies network and running on the same host as the PBX?
    – Kevin Lieser
    Feb 18, 2020 at 2:25
  • The STUN server must be on a subnet routable by the PBX such that the office end of the VPN is the IP the STUN server “sees” the softphone connecting from. The STUN server tells the client in a control payload, I see you connecting from IP x.x.x.x and port nnnn. The client can then substitute that IP for its local IP.
    – Yaro
    Feb 18, 2020 at 2:31
  • Have you tested initiating a TCP connection from an office client to a service on your home network? Many home office VPNs are effectively “one way”. If so, your only solution is configuring your client for reverse cone (all inbound channels).
    – Yaro
    Feb 18, 2020 at 2:36
0

I solved the problem by adding the VoIP internal number directly in the FritzBox registered to the PBX on the remote network. So the remote Network can directly communicate with the FritzBox of my network (VPN client).

So I just need to co figure a phone on my FritzBox using the new internal number. That worked great.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .