ACL order of evaluation (issue with FXO gateway in my house with my IP phones)

[pbxcom]

Hi,

Summary: Adding FXO gateway to cloud-hosted Fusion causes IP phones (from same location as gateway) to stop working, because both FXO gateway and IP phones connect from the same public IP, the IP phones get evaluated by the CIDR acl node and not the proper domain.xyz acl node (both in domains acl).
The CIDR acl was added to allow inbound PSTN calls from the FXO gateway, but it always gets higher priority and GUI doesn't allow changing order/sequence of evaluation, the IP Phones then get evaluated by the CIDR entry too.


More details:

- Cloud hosted Fusion so I can move in/out of my residence and have my sip client working.
- No SIP provider, just a grandstream HT813 used as an FXO gateway.

Outgoing works fine (I created an extension for HT813 and by dialing this extension # from my IP phone, I get a dial tone and can call to the PSTN).
For incoming/inbound, HT813 config guide tells me to "Forward all calls to VOIP ext@domain/ip). I did that..

Now on Fusion, for these inbound calls to come thru, I need to put the IP from which HT813 connects in the domains acl, so it will be treated as a carrier and calls get accepted.

Here lies the problem, the HT813 connects from the same IP as my IP Phones while I'm in my residence. So as soon as I add my own public IP (the IP form which HT813 connects to cloud FusionPBX), calls from extension to extension (or even to *9664) stop working, looking at logs, I see my extension hits the first ACL entry (namely the CIDR public IP that I added to allow the FXO gateway to send inbound rules), it never reaches the domain.xyz acl where it would be evaluated as an internal extension. If I disconnect the wifi on my phone and use mobile operator (different IP) then it works normally.

How can I change the ACL order evaluation so that CIDR is evaluated last?

 

[DigitalDaz]

Interesting, I have never considered this. I'm not fully awake yet but I would probably go into the external sip profile and disable the "auth-calls" true requirement.

Then, instead, to protect your external profile modify your iptables rules to only allow your carrier and your ip to port 5080

 

[pbxcom]

Interesting, I have never considered this. I'm not fully awake yet but I would probably go into the external sip profile and disable the "auth-calls" true requirement.

Then, instead, to protect your external profile modify your iptables rules to only allow your carrier and your ip to port 5080

Thanks. That sounds like a solution. I was looking around in /etc/freeswitch to find the acl.conf.xml, thinking maybe the GUI handling part is what sorts the list and so simply modifying the list manually allows control of execution order.

Matter of fact, I wonder if there's another way to configure the gateway. Reason being is I'm behind a dynamic IP that changes too often. The CIDR I used is a /16 and my ISP issues random IPs. Another method not dependent on source IP would be ideal. Outbound works this way, but not inbound unfortunately.

 

[DigitalDaz]

No idea on your infrastucture but doing it over a vpn, I'd use wireguard if possible, will get rid of that problem.

 

[pbxcom]

No idea on your infrastucture but doing it over a vpn, I'd use wireguard if possible, will get rid of that problem.

Hey thanks for the tip. I had thought of that, in fact, I was thinking to keep Fusion on a local box within my residence, and then to provide connectivity when I'm outside (ISP provides NATed IP), a VPN from my residence to a cloud provider would be up, I can then use the cloud provider's public IP (cloud VPS connected to my residence with wireguard) to connect to my Fusion on my LAN.

What do you think? Note the major change here is I move Fusion to LAN and use cloud only as a routable hop (as opposed to hosting fusion on cloud).

If there's a more elegant way please let me know.