<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>You need to ensure that traffic to the SIP box is sent to the correct IP. Also if you use split-tunnel (eg: not redirect-gateway def1) you must make sure NAT and traffic redirection works as is so the Asus router knows it should send the traffic through tunnel and not via WAN.<div><br></div><div>IMPORTANT: Then you must, in the ASUS RT-N66U make a port forward inwards from TUN to the phone client.</div><div><br></div><div>I would suggest wiresharking on the client side and see which IP Asterisk suggest the client should connect back to. This should be the internal IP of the asterisk server as seen from the openvpn server's point of view.</div><div><br></div><div>Another important thing: The local network in the Openvpns machine locatiin, may NOT have same subnet as the network behind the asus.</div><div>All these must be separate, like:</div><div>server network: 192.168.1.0/24</div><div>Openvpn tunnel network: 192.168.2.0/24</div><div>Asus network: 192.168.3.0/24</div><div><br></div><div>Else you get bizarre routing problems when states appear in the state table.</div><div><br></div><div style="font-size:100%;color:#000000"><!-- originalMessage --><div>-------- Originalmeddelande --------</div><div>Från: Ernie Dunbar <maillist@lightspeed.ca> </div><div>Datum: 2017-04-19 00:25 (GMT+01:00) </div><div>Till: 'Asterisk Users Mailing List - Non-Commercial Discussion' <asterisk-users@lists.digium.com> </div><div>Rubrik: [asterisk-users] SIP connections over OpenVPN connection get one-way voice. </div><div><br></div></div>
Hi everyone. I'm having some trouble with an OpenVPN tunnel that
isn't working *quite* as well as we'd hoped.<br>
<br>
First, here's our technical details:<br>
<br>
The OpenVPN server (v2.3.4-5+deb8u1) is a Debian 8 box behind a NAT
router. The router has UDP port 1194 forwarded to our server. This
server also runs our office Asterisk PBX, so there isn't any
networking hardware or firewall between the VPN tunnel and the
Asterisk PBX.<br>
<br>
The OpenVPN client is an Asus RT-N66U router, which if I'm not
mistaken, runs a somewhat modified version of Tomato. <br>
<br>
I've got the VPN tunnel working well enough. I can do practically
anything from a computer hooked up to the client router as if I were
in the main office where the server is. But any SIP client I use -
whether it's a hardware SIP phone or a soft phone like Zoiper, can
connect to the Asterisk server without issue. Making calls can work,
accepting calls works, but I only get 1 way voice traffic. I can
hear voice data coming in FROM the Asterisk PBX, but I cannot send
any. <br>
<br>
In my experience with SIP, this usually means a firewall is breaking
the connection from the client phone to the Asterisk server. I just
can't for the life of me find what could be wrong. None of the other
traffic is being blocked. The ipfw firewall on the Asterisk PBX is
extremely open (see below). The firewall on the client router is
turned off, and as far as I can tell, most NAT routers don't even
block outbound traffic in the first place.<br>
<br>
I can't see how traffic from the TUN interface on the OpenVPN server
even can be blocked going to another IP address on the same box, but
here are the IPFW rules:<br>
<br>
root@ldinfo:/etc/asterisk# iptables -L -n<br>
Chain INPUT (policy ACCEPT)<br>
target prot opt source destination<br>
ACCEPT all -- 192.168.0.0/24 192.168.0.3<br>
ACCEPT all -- 192.168.1.0/24 192.168.0.3<br>
ACCEPT all -- 10.8.0.0/24 192.168.0.3<br>
ACCEPT all -- X.X.X.X 192.168.0.3<br>
ACCEPT all -- 192.168.0.3 X.X.X.X<br>
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:1194<br>
REJECT all -- 112.220.127.26 0.0.0.0/0 reject-with
icmp-port-unreachable<br>
<br>
Chain FORWARD (policy ACCEPT)<br>
target prot opt source destination<br>
<br>
Chain OUTPUT (policy ACCEPT)<br>
target prot opt source destination<br>
<br>
Chain POSTROUTING (0 references)<br>
target prot opt source destination<br>
<br>
192.168.0.0/24 is the network the Asterisk PBX and OpenVPN server
are on.<br>
192.168.1.0/24 is the network that the remote router is on.<br>
10.8.0.0/24 is the network that the TUN device creates.<br>
X.X.X.X is our datacenter.<br>
192.168.0.3 is the IP address of our PBX.<br>
<br>
Any assistance would be greatly appreciated.<br>
<br>
<p>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</p>
</body></html>