Setting up External Access

[gyverchang]

Hi there,

After using Grandstream UCM PBX for over 5 years, we are looking to replace it, however, given how expensive it is, we are looking for alternatives and FusionPBX looks like a great solution as we have spare hardware to host it.

I have successfully set up FusionPBX and all internal calls are working perfectly, however, getting it to work external seems to be quite complicated.

I have port forwarded all required ports, such as 5060-5090 TCP/UDP, 80/443 and necessary RTP ports, however, I cannot get registration to work externally. The current domain in use is voice.domain.com, I have added A Records(on cloudflare) to the public ip. However, none of the external softphones such as Zoiper or Grandstream Wave successfully registered.

Am I missing anything? For Grandstream UCM, after portforwarding, everything works like a charm. Setting up external access for FusionPBX seems to require more configuration.

Would appreciate some assistance regarding this, thank you!

 

[DigitalDaz]

Use sngrep to try and capture and inbound register attempt. At least you will see then that its even hitting the PBX.

 

[gyverchang]

I saw attempts to register appearing on logs once or twice but was refused due to ACL. What the basic practices to allow external registraions? Are there any other steps to set up external access?

 

[DigitalDaz]

ACL refused is perfectly standard, it then will auth challenge them. You shouldn't have touched the ACL except for potentially carriers.

Also, you are trying to register to port 5060?

 

[gyverchang]

I didn't touch ACL until now. Yes, I'm trying to register to the default port 5060.

 

[DigitalDaz]

Then get us a log from sngrep

 

[gyverchang]

Register attempts are appearing on sngrep with proxy set as the FQDN of the pbx.

 

[DigitalDaz]

You actually need to go into the register message itself

 

[gyverchang]

My apologies, this is my first time using sngrep

 

[DigitalDaz]

In that list can you get me one of that first 403 and then the subsequent register please.

 

[DigitalDaz]

At a guess from the above, you need to go into your internal and external sip profiles and change your ext-sip-ip and ext-rtp-ip to:

autonat:X.X.X.X

Where X.X.X.X is your public IP.

 

[gyverchang]

Here you go.

 

[DigitalDaz]

No, there is something badly wrong there, you are not being auth challenged. At the linux command propt, do an fs_cli and get a log from there of the register attempt. It looks like something has definitely been changed in the config.

 

[gyverchang]

Is this the log from fs_cli.

 

[DigitalDaz]

After the above, you should be getting an auth challenge and you are not.

 

[gyverchang]

How can this problem be resolved? Is it related to the ACL settings?

 

[DigitalDaz]

I have no idea, you said you haven't changed anything from defaults. The ACL thing looks fine.

 

[gyverchang]

This is the internal SIP profile, is this correctly configured. I did not change anything here.

 

[DigitalDaz]

I am definitely seeing differences to my profile but I'm not saying they are wrong, if you are saying you haven't touched yours then I need to test a new install in case this is a bug.

 

[gyverchang]

I did add auto-nat as recommended by the official documentation as we are behind NAT.