FreePBX, Remote user, and registration

[AdamF]

@eddiejennings said in FreePBX, Remote user, and registration:

Have you looked at the Responsive Firewall status to see if their IP is being blocked as an attacker?

Yes, And they are in as a trusted IP as well.

[EddieJennings]

Have you looked in the System Admin module at the Intrusion detection to see if Fail2Ban has blocked them? I've had hosts in both the Trusted and Local firewall zones be blocked by the Intrusion detection function in the past.

[gjacobse]

Tagging @scottalanmiller

[AdamF]

@eddiejennings said in FreePBX, Remote user, and registration:

Have you looked in the System Admin module at the Intrusion detection to see if Fail2Ban has blocked them? I've had hosts in both the Trusted and Local firewall zones be blocked by the Intrusion detection function in the past.

Yes, I've also checked there. Nothing is blocked. In fact, the endpoint registers again after a few minutes, and then after a brief period of time, spews errors on the asterisk console, and then becomes unreachable.

I am almost certain it has to do with the local modem/router that the user replaced, but it's difficult to troubleshoot/prove.

[EddieJennings]

@fuznutz04 said in FreePBX, Remote user, and registration:

@eddiejennings said in FreePBX, Remote user, and registration:

Have you looked in the System Admin module at the Intrusion detection to see if Fail2Ban has blocked them? I've had hosts in both the Trusted and Local firewall zones be blocked by the Intrusion detection function in the past.

Yes, I've also checked there. Nothing is blocked. In fact, the endpoint registers again after a few minutes, and then after a brief period of time, spews errors on the asterisk console, and then becomes unreachable.

I am almost certain it has to do with the local modem/router that the user replaced, but it's difficult to troubleshoot/prove.

Odd. What are the errors you see on the console, that might help us figure out what's going on?

@JaredBusch might be able to help.

[AdamF]

For example:

[2018-01-18 10:14:22] WARNING[1952]: chan_sip.c:3785 __sip_xmit: sip_xmit of 0x7f401408e1c0 (len 752) to IP ADDRESS:58701 returned -2: Interrupted system call
[2018-01-18 10:14:22] ERROR[1952]: chan_sip.c:4274 __sip_reliable_xmit: Serious Network Trouble; __sip_xmit returns error for pkt data

[JaredBusch]

Have the user's phone go to a STUN server.

Use stun.stunprotocol.org:3478 in your phone.

Make sure you allow stun.stunprotocol.org in your firewall.

In a Yealink phone it goes here:
Enable Stun on the account tab at the bottom.

Then go to the Network tab and put in the settings. This will cause the phone to reboot.

[scottalanmiller]

@gjacobse said in FreePBX, Remote user, and registration:

Tagging @scottalanmiller

Ha, it's the week of this.

[scottalanmiller]

Definitely use STUN, fixes odd issues that you'd never guess.

[AdamF]

@JaredBusch & @scottalanmiller

Thanks, I'll try this as soon as I can get ahold of the user.

[AdamF]

Follow up on this, the user went out and got a new modem. Immediately resolved the issue, so I was never able to test if STUN would have resolved it or not. I'll keep this in mind though for next time.