Fusion behind NAT (EC2)

S

s2svoip

Member
Dec 9, 2019
291
12
18
46
wondering what the best practice setup is for fusion PBX behind NAT, I know the best way is direct IP and I wish i had done that from the start but alas.

I have fusion on AWS EC2 and periodically see some one way audio (assume NAT issues), its very inconsistent, some clients have no issues, some have issues every 6 months, there's no consistency, and if they client reboots their modem/router the issues goes away for 1-6months. I am trying to grab packet captures from sngrep and handsets when the issue is occurring, but its been difficult to time this. this is my setup:

EC2 Port forwarding:
5070 UDP/TCP open to all.
16384 - 32768 UDP open to all.
Upstream trunk provider is whitelisted
downstream clients handset static WAN IPs are whitelisted

fusion internal & external sip profile
ext-rtp-ip "autonat:external wan IP"
ext-sip-ip: "autonat:external wan IP"


Handsets (also behind router) register to internal on UDP 5070, have tested TCP 5070 also
static.sip.nat_stun.enable=1
static.sip.nat_stun.server=stun.cloudflare.com
static.sip.nat_stun.port=3478

Handsets mostly show in Status, Registered TCP or "Registered UDP", and not registered TCP-NAT or UDP-NAT

does anyone see any glaring issues with this, as I assume I am doing something wrong, registering to the internal sip profile ?
 
You don't need this:
Handsets (also behind router) register to internal on UDP 5070, have tested TCP 5070 also
static.sip.nat_stun.enable=1
static.sip.nat_stun.server=stun.cloudflare.com
static.sip.nat_stun.port=3478

Manually type your external IP here, make sure its static IP that doesnt change:

fusion internal & external sip profile
ext-rtp-ip "autonat:external wan IP"
ext-sip-ip: "autonat:external wan IP"

You should have zero issues, any issues from that point onward is going to be caused on my CPE equipment for example SIP ALG being enabled.
 
All I have done is set ext-rtp-ip and ext-sip-ip to the correct external ips on each profile.

We do nothing at all on the handsets. I've successfully used this on Oracle cloud now for the last 5 years, we have hundreds of domains. The internal IPs of the boxes are 10.x.x.x
 
thanks @gflow and @DigitalDaz

your just confirming what I suspect that my setup is pretty correct, I will remove the stun stuff. its so strange because ive seen it with multiple clients where sip alg is disabled or dosent exists (Ubiquiti routers for example) but the problem is so intermittent.

In my device config I have a primary and secondary address, for fail-over, would this cause any issues ?
 
You must log in or register to reply here.
Top Bottom