Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

i2004 over vpn to BCM

Status
Not open for further replies.

Zenofex

IS-IT--Management
Nov 14, 2005
3
US
Background: We have a i2004 that connects to our vpn through a 4 port linux router. We are running a BCM
v 3.6 build 2.2c.

Problem :Hey everyone, Im having a issue where my ip phone is periodically not recieving a dialtone/voice on either side of the phone connection. The ip phone does register and can make outgoing calls but will sometimes have no voice or dialtone.

link to schematic:

My diagnosis and things ive tried:
At first i thought that the problem was with the firewall on the linux router. so i started by adding adding the following lines inside of my firewall.user file to direct the vpn traffic:

iptables -A forwarding_rule -o ppp0 -j ACCEPT
iptables -A forwarding_rule -i ppp0 -j ACCEPT
iptables -t nat -A postrouting_rule -o ppp0 -j MASQUERADE

Then i read that the registration of the ip phone is done through port udp 7000. so i added the appropriate line inside of my firewall.user and tried again. success the phone registered but i had no voice traffic. I then added a line to direct port traffic 51000:51255 (Im sorry im not posting the iptable commands for this as i am not verry good with the whole structure of linux iptables and chains.)
. After doing this i recieved dialtone initially but after about 10 minutes or so i checked again and the dialtone and voice was gone. So then i tried to make a outgoing call and a incomming call and both worked, but still no voice.

Now im stumped, i feel like ive tried soo much to get this to work and now need the help of someone more experienced to either help with my iptables or to give me some insight on what im doing wrong. THANK YOU EVERYONE WHO HELPS IVE BEEN STRESSING OVER THIS FOR A WHILE. THANKS!
 
I would say you need to open the following ports to enable the voice pass through.

Signaling between the IP telephones and the Business Communications Manager uses Business Communications Manager port 7000. However, voice packets are exchanged using the default RTP ports 28000 through 28255 at the Business Communications Manager, and ports 51000 through 51200 at the IP telephones. If these ports are blocked by the firewall or NAT, you will experience one-way or no-way speech paths.


 
Would you happen to know if those were udp or tcp? thanks
 
mrmarshall, hey i added some firewall rules to my router and im getting periodic voice paths again, heres pretty much what im putting in:

/usr/sbin/iptables -A forwarding_rule -o $1 -j ACCEPT
/usr/sbin/iptables -A forwarding_rule -i $1 -j ACCEPT
/usr/sbin/iptables -t nat -A postrouting_rule -o $1 -j MASQUERADE

###########BCM REGISTER PORT#################
/usr/sbin/iptables -t nat -A prerouting_rule -i ppp0 -p udp --sport 7000
/usr/sbin/iptables -A input_rule -i ppp0 -p udp --sport 7000

###########incoming voice###########
/usr/sbin/iptables -t nat -A prerouting_rule -i ppp0 -p udp --sport 28000
/usr/sbin/iptables -A input_rule -i ppp0 -p udp --sport 28000

###########outgoing voice###########
/usr/sbin/iptables -t nat -A postrouting_rule -o ppp0 -p udp --dport 5100
/usr/sbin/iptables -A output_rule -o ppp0 -p udp --dport 5100

/sbin/route add -net 10.0.0.0 netmask 255.0.0.0 dev ppp0
/sbin/route add -net 10.10.0.0 netmask 255.255.0.0 dev pp0

and heres my iptables -L log:


Chain INPUT (policy DROP)
target prot opt source destination
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp option=!2 flags:SYN/SYN
input_rule all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
ACCEPT gre -- anywhere anywhere
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain FORWARD (policy DROP)
target prot opt source destination
DROP all -- anywhere anywhere state INVALID
TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
forwarding_rule all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy DROP)
target prot opt source destination
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
output_rule all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable

Chain forwarding_rule (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere

Chain input_rule (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp spt:7000
ACCEPT udp -- anywhere anywhere udp spts:28000:28255

Chain output_rule (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpts:51000:52000


any ideas where im going wrong?
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top