Reply
New Member
Posts: 22
Registered: ‎07-15-2016

EdgeMax SourceNAT

currently my ISP is blocking / using port 5060 for its own VoIP service.

 

im using a different SIP provider.

the only problem my SIP client is a fritzbox and is using port 5060 as source to connect to the external VOIP client.

but outbound WAN:5060 is blocked.

 

how to make a correct NAT on the cmdline to translate the source of my internal ip (fritzbox SIP client) for example translate 192.168.20.5:5060 publicip:5090 (for example) so that port 5060 outbound is translated to 5090 when it leaves my WAN port.

 

i tried several source nat construction, but cant get it working.

when looking in to the packet tracer of the edgemax router i always see publicip:5060 wil connect to the external SIP provider.

because of the blocking of port 5060 at ISP side, i cant get a connection.

 

port 5060 as source seems to be hard coded in the fritzbox.

 

 

SuperUser
Posts: 7,201
Registered: ‎01-05-2012
Kudos: 1899
Solutions: 937

Re: EdgeMax SourceNAT

Try instead with a DNAT rule, inbound interface your LAN, dport 5060, inside-address port 5090.

Cheers,

jonatha

Veteran Member
Posts: 6,838
Registered: ‎03-24-2016
Kudos: 1777
Solutions: 784

Re: EdgeMax SourceNAT

Yes you can.

Even your config might be working right now !  If so all it takes is flushing your NAT table

sudo conntrack -F

If connection is already made using source port 5060, it will live on forever (that is , as long as fritzbox keeps sending, thus keeping translation with old source port alive)

 

However:  If ISP blocks destination port udp5060....you're out of luck

 

New Member
Posts: 22
Registered: ‎07-15-2016

Re: EdgeMax SourceNAT

@redfive

never thinked about that, always  trying with an SNAT construction.

thnx gonna try that

New Member
Posts: 22
Registered: ‎07-15-2016

Re: EdgeMax SourceNAT

@16againthe problem is the fritzbox hardcoded that its using an socket ipfritzbox:5060 to connect to SIP external server.

the default translate the following fritizboxip:5060 nat publicip:5060

 

i want the following fritizboxip:5060 nat publicip:5090 (for example)

Veteran Member
Posts: 6,838
Registered: ‎03-24-2016
Kudos: 1777
Solutions: 784

Re: EdgeMax SourceNAT

Something like below will change source port to value above 6000, adapt at will.

Make sure it's above existing masquerade (and flush NAT table)

 

set service nat rule 5001 description SIP_ChangeSourceport
set service nat rule 5001 destination port 5060
set service nat rule 5001 log disable
set service nat rule 5001 outbound-interface eth0
set service nat rule 5001 outside-address port 6000-65535
set service nat rule 5001 protocol udp
set service nat rule 5001 type masquerade

New Member
Posts: 22
Registered: ‎07-15-2016

Re: EdgeMax SourceNAT

[ Edited ]

ok @16again, gonna try this.
why is de default masquerade not translating the source port of the fritzbox to a random port number as expected on the outbound interface?

Veteran Member
Posts: 6,838
Registered: ‎03-24-2016
Kudos: 1777
Solutions: 784

Re: EdgeMax SourceNAT

By default, the masquerade rule tries to use same source port as original packet.

 

So using a single phone, you end up with source port 5060.

On the connection for a 2nd phone, source port 5060 is already in use, so it has to be translated.

 

New Member
Posts: 22
Registered: ‎07-15-2016

Re: EdgeMax SourceNAT

@16again

 

changed the rules a bit

 

set service nat rule 5000 description SIP_ChangeSourceport
set service nat rule 5000 source port 5060
set service nat rule 5000 log disable
set service nat rule 5000 outbound-interface switch0.300
set service nat rule 5000 outside-address port 6000-65535
set service nat rule 5000 protocol udp
set service nat rule 5000 type masquerade

 

after that


rule   type  intf     translation
----   ----  ----     -----------
5000   MASQ  switch0.300  saddr ANY to publicip
    proto-udp         sport ANY to 6000-65535

 

buth i cant get any connection

Veteran Member
Posts: 6,838
Registered: ‎03-24-2016
Kudos: 1777
Solutions: 784

Re: EdgeMax SourceNAT

this command will show active translation:

 

sudo conntrack -L | grep 5060

New Member
Posts: 22
Registered: ‎07-15-2016

Re: EdgeMax SourceNAT

[ Edited ]

Ok gonna lookup in the logs

 

what is the right NAT translation,  source of destination port in the nat configuration syntaxis?

 

New Member
Posts: 22
Registered: ‎07-15-2016

Re: EdgeMax SourceNAT

i did the test again

 

but is doest work, when i set in source port 5060 want to translate it to 6000 and higer. It seems to be working with conntrack - L | grep 5060

 

but i cant get any connection.

 

if i say destination port 5060 then the transltion looks not ok in the conntrack log

 

any ideas?

 

i just want the edgemax to skip port 5060 as using as a socket on the WAN ip

 

New Member
Posts: 22
Registered: ‎07-15-2016

Re: EdgeMax SourceNAT

anyone an idea to solve this?

Veteran Member
Posts: 6,838
Registered: ‎03-24-2016
Kudos: 1777
Solutions: 784

Re: EdgeMax SourceNAT

Does source port get translated?  Post result of:

sudo conntrack -L | grep 5060

Regular Member
Posts: 700
Registered: ‎06-01-2016
Kudos: 101
Solutions: 23

Re: EdgeMax SourceNAT

I think you might need to try a “modify” rule rather than a NAT rule— modify the port to whatever your SIP provider’s alternate port is. 

New Member
Posts: 22
Registered: ‎07-15-2016

Re: EdgeMax SourceNAT

wich NAT do you think is the correct one?

Reply