IP authentication incoming calls are forbidden

[pacmen]

Hello everyone and thanks for trying to assist.


I’m having issues with incoming calls.


I’m trying to connect with local provider for incoming calls and terminations for one of my Domains. The provider uses IP-based authentication instead of SIP Registrations it also appears to be that the provider uses ‘AudioCodes Mediant 9000 SBC’, also the providers only sends to sip port 5060 and to ip not FQN.



I was managed to make outgoing calls trough the provider and I wasn’t able to get incoming calls.

I’ve added providers IP addresses one for signals and one for Media in Access List and opened all ports on firewall between the WAN to the FusionPBX vm.



When scheduled tests time arrived we tested receiving a call, the provider says the was rejected due to ‘SIP/2.0 407 Proxy Authentication Required’, then I’ve checked somewhere and found that Sip Profile value - ‘calls-auth’ needed to be changed to false. So I’ve changed it in Internal and External Profiles.



Then we test once again and the error was changed to ‘SIP/2.0 403 Forbidden’ in most cases that mean authentication or firewall issue.



So I’ve pulled up my last trick and changed the incoming port from the provider from 5060 to 5080 using ‘dstnat action’ sadly nothing have changed.



When incoming call arriving from the provider I don’t see any logs on FusionPBX, but I do sniffing my router packets and can see the SIP conversion.



Attaching the pcaps.

Download proxy auth.pcap | LimeWire

Download proxy auth.pcap on LimeWire

limewire.com

I really appreciate any ideas and help.

 

[pbxgeek]

You need to ensure the provider sends traffic to port 5080 (default external profile port). Then, you need to add their IPs to the ACL list and possibly to your firewall list, depending on how strict your rules are. Any provider can be asked to send traffic to a different port. 5060 Is used fro internal profile by default and you should not use it for external traffic

 

[pacmen]

My provider doesn't agree to change is settings.
I've asked in some telegram community about the ACL list i need to add providers ip address. I've put the provider IP address in new list I've created instead of 'provider' list. this make any difference?