VoIP RTP stream not always working

Hi,

please post your ATA access rule. For a home user you should not need to disable the helpers. Are you using Application control? You will not need a specific NAT, but maybe QOS, depends on your link speed.

Does your rule have SIP service and I had to add ICMP to keep VoIP service happy.

Ian

Hi Ian,

Here's my rule for the ATA:

This is the first rule in my list.

Thanks for your help.

Len

Hi Ian,

Here's my rule for the ATA:

This is the first rule in my list.

Thanks for your help.

Len

Hi Len,

here is my VoIP firewall rule for comparison. I have the QOS as part of the application policy.

My IPS is tuned for blocking VPNs etc

Ian

Thanks for that Ian.  Do you mind me asking a couple questions about your setup?

• What are you using for your ATA/SIP phone?
• What is your RTP port range?
• Are you using any DNAT rules for VoIP?
• In Sophos, do you have the SIP module and H.323 helper enabled?  Did you adjust the UDP timeout from default?
• I'm assuming you have your VoIP equipment on a separate network, based on your rule.  I have all my internet devices on one network and use MAC addresses to identify in the rules.  I could try creating a separate network for my ATA in case Sophos messes up occasionally with MAC based rules.

Appreciate your input.

Len

Hi,

my current ATAs are the Telstra supplied NBN device which I only use the phone part and Linksys SPA3102. I used to run a third one using a Cisco ATA but when I had to downgrade to one ISP I cancelled that service.

I don't have any  RTP range with the current setup, ATA when it sets up the call opens the required extra ports as part of the connection.

I use the default XG NAT rule.

I have my VoIP ATAs on a seperate network, but previously they were on VLAN when I only had a 2 port XG. I limit the access via clientless users and static IP assignments as well as the FQDNs of the VoIP service providers.

When I was using VoIP on the UTM i used to get phone calls directly from scammers so that is when I started limiting what the ATAs could connect and broadcast to.

I have not adjusted UDP timeouts for VoIP, but I do have QOS enabled in the VoIP application policy to provide the VoIP devices with approx minimum 32 to 96 KB/s of shared capacity at the best settings in the XG.

My link is a 50/20 and my wife talks for hours to her overseas cousins while I surf and play with file transfers without complaints. She also watch streaming TV at the same time.

Ian

Thanks for the info Ian.

Apparently this is the default RTP range:

<RTP_Port_Min ua="na">16384</RTP_Port_Min>

<RTP_Port_Max ua="na">16482</RTP_Port_Max>

Perhaps my understanding is wrong, but since your rule is 'outbound', only servers that your ATA has established a connection with should be able to get back to the ATA. In other words, if there are no DNAT (inbound) rules, then there shouldn't be a concern of rogue servers trying to access your ATA.  Based on this understanding, I have not limited services for my ATA.

I may try going back to my Asus router to see if the problem goes away.

Thanks again.

Len

i will expand when i get homian

Hi Len,

on the UTM the VoIP protocols were broadcast which enabled strange people to call my phone number hence the tightened access rules. Once bitten twice shy.

The ATA sets up a connection to the ISP VoIP server which then allows for incoming calls to use the existing session/connection  and does not require an incoming firewall rule or NAT rule. That is why the ATA registers with the VoIP server.

Ian