<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi everyone. I'm having some trouble with an OpenVPN tunnel that
isn't working *quite* as well as we'd hoped.<br>
<br>
First, here's our technical details:<br>
<br>
The OpenVPN server (v2.3.4-5+deb8u1) is a Debian 8 box behind a NAT
router. The router has UDP port 1194 forwarded to our server. This
server also runs our office Asterisk PBX, so there isn't any
networking hardware or firewall between the VPN tunnel and the
Asterisk PBX.<br>
<br>
The OpenVPN client is an Asus RT-N66U router, which if I'm not
mistaken, runs a somewhat modified version of Tomato. <br>
<br>
I've got the VPN tunnel working well enough. I can do practically
anything from a computer hooked up to the client router as if I were
in the main office where the server is. But any SIP client I use -
whether it's a hardware SIP phone or a soft phone like Zoiper, can
connect to the Asterisk server without issue. Making calls can work,
accepting calls works, but I only get 1 way voice traffic. I can
hear voice data coming in FROM the Asterisk PBX, but I cannot send
any. <br>
<br>
In my experience with SIP, this usually means a firewall is breaking
the connection from the client phone to the Asterisk server. I just
can't for the life of me find what could be wrong. None of the other
traffic is being blocked. The ipfw firewall on the Asterisk PBX is
extremely open (see below). The firewall on the client router is
turned off, and as far as I can tell, most NAT routers don't even
block outbound traffic in the first place.<br>
<br>
I can't see how traffic from the TUN interface on the OpenVPN server
even can be blocked going to another IP address on the same box, but
here are the IPFW rules:<br>
<br>
root@ldinfo:/etc/asterisk# iptables -L -n<br>
Chain INPUT (policy ACCEPT)<br>
target prot opt source destination<br>
ACCEPT all -- 192.168.0.0/24 192.168.0.3<br>
ACCEPT all -- 192.168.1.0/24 192.168.0.3<br>
ACCEPT all -- 10.8.0.0/24 192.168.0.3<br>
ACCEPT all -- X.X.X.X 192.168.0.3<br>
ACCEPT all -- 192.168.0.3 X.X.X.X<br>
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:1194<br>
REJECT all -- 112.220.127.26 0.0.0.0/0 reject-with
icmp-port-unreachable<br>
<br>
Chain FORWARD (policy ACCEPT)<br>
target prot opt source destination<br>
<br>
Chain OUTPUT (policy ACCEPT)<br>
target prot opt source destination<br>
<br>
Chain POSTROUTING (0 references)<br>
target prot opt source destination<br>
<br>
192.168.0.0/24 is the network the Asterisk PBX and OpenVPN server
are on.<br>
192.168.1.0/24 is the network that the remote router is on.<br>
10.8.0.0/24 is the network that the TUN device creates.<br>
X.X.X.X is our datacenter.<br>
192.168.0.3 is the IP address of our PBX.<br>
<br>
Any assistance would be greatly appreciated.<br>
<br>
<p>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</p>
</body>
</html>