Problems with VPN Traffic (likely self inflicted)

AndyInNYC

I'm using Yealink T46G phones which have built-in OpenVPN software to connect to a phone system (RentPBX) running an OpenVPN server.

My remote phone is properly connecting using the 10.11.12.x subnet, but the server and phone are passing traffic across the PUBLIC IP of the phone (i.e. the remote users house). This is causing INVITES and other items to fail and the call gets dropped.

I have two lines in my server config I don't understand (I used Yealink's howto) which might be the cause. Essentially, I want the phone to ONLY use the 10.11.12.x subnet as though it were 'local' to the RentPBX machine.

ifconfig on the server returns the following:

eth0      Link encap:Ethernet  HWaddr AA:00:0E:6A:71:01
          inet addr:RENTPBXIP  Bcast:CLOSETOTHERENTPBXIP  Mask:255.255.255.192
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1955988 errors:0 dropped:0 overruns:0 frame:0
          TX packets:758695 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:242786373 (231.5 MiB)  TX bytes:182599716 (174.1 MiB)
          Interrupt:17

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:188829 errors:0 dropped:0 overruns:0 frame:0
          TX packets:188829 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:14716030 (14.0 MiB)  TX bytes:14716030 (14.0 MiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.11.12.1  P-t-P:10.11.12.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:121414 errors:0 dropped:0 overruns:0 frame:0
          TX packets:46432 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:18705729 (17.8 MiB)  TX bytes:26490305 (25.2 MiB)

My client config is:

client
persist-tun
persist-key
cipher BF-CBC
auth SHA1
tls-client
ns-cert-type server
remote RENTPBXIP
nobind
port 1194
proto udp
dev tun
comp-lzo
verb 3
ca /config/openvpn/keys/ca.crt
cert /config/openvpn/keys/client.crt
key /config/openvpn/keys/client.key

And the Server config is:

local RENTPBXIP
port 1194
proto udp
dev tun
# added based on pbxinaflash.com
daemon
persist-tun
persist-key
cipher BF-CBC
tls-server
#end added
mode server
server 10.11.12.0 255.255.255.0
push "route 10.2.1.0 255.255.255.0"
push "dhcp-option DNS 10.2.1.1"
keepalive 20 60
client-to-client
duplicate-cn
comp-lzo
verb 3
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh1024.pem
log-append /etc/openvpn/openvpn.log

Inside those lines are:

server 10.11.12.0 255.255.255.0
push "route 10.2.1.0 255.255.255.0"
push "dhcp-option DNS 10.2.1.1"

My server 10.11.12..... line seems right - the IPs are 10.11.12.x
But the push lines (which are from Yealink's howto) seem like they should be:

push "route 10.11.12.0 ..." (etc)

or should it be:

push "route 127.0.0.0 ..." (and the same for the second line)?

Answers?

Additionally, I don't seem to be trapping traffic on ONLY the VPN since the PBX is logging RPT traffic on the public IP where the remote phone sits.

I have NAT=YES in the freepbx configuration for the phone which essentially says the phone is behind a NAT, but I'm thinking that since the phone is essentially (through the VPN) inside the LAN that this setting should be NO.

Before I start messing with settings and having remote users "try this, try that" and getting cut off from calls, I'd like to make sure my VPN settings force all phone traffic (the only traffic on the VPN) to use only the VPN.

Am I missing a setting?

I'm happy to post more info if needed; I just don't know what else I could/should show.

Andrew

maikcat

your vpn config looks ok,

if your phone can connect and you can ping it/access it via vpn then tunnel is ok.

what sip settings are you using on your phone?

Michael.

AndyInNYC

Thanks for responding.

The only SIP settings I'm using on the phone are to use port 5060 and server address of 10.11.12.1 (i.e. the VPN).

On FreePBX's extension setup I'm using NAT=YES. Nothing that I see points to the public IP.

Should I be using the following commands:

push "redirect-gateway def1"
push "remote-gateway 10.11.12.1"
push "dhcp-option DNS 8.8.8.8"

(I think 8.8.8.8 is google) from my googling.

Clearly I'm doing something wrong since the PBX is pushing packets to the users public IP.

See below - MY_NONVPN_IP is correct since I don't use the VPN on my phone due to account conflicts. REMOTEIP should be 10.11.12.38 (or whatever .x)

pbx*CLI>  [2014-09-15 16:04:07] DEBUG[3557][C-00000053]: res_rtp_asterisk.c:3513 ast_rtcp_read: RTCP NAT: Got RTCP from other end. Now sending to address REMOTEIP:11781
pbx*CLI>        > 0xb7411270 -- Probation passed - setting RTP source address to MY_NONVPN_IP:11800
[2014-09-15 16:04:07] DEBUG[3557][C-00000053]: res_rtp_asterisk.c:3967 ast_rtp_read: RTP NAT: Got audio from other end. Now sending to address MY_NONVPN_IP:11800
Got  RTP packet from    MY_NONVPN_IP:11800 (type 00, seq 000000, ts 3221661647, len 000160)
pbx*CLI>  Sent RTP packet to      10.11.12.38:11780 (type 00, seq 059320, ts 3221661640, len 000160)
pbx*CLI>        > 0xb5775080 -- Probation passed - setting RTP source address to REMOTEIP:11780
[2014-09-15 16:04:08] DEBUG[3557][C-00000053]: res_rtp_asterisk.c:3967 ast_rtp_read: RTP NAT: Got audio from other end. Now sending to address REMOTEIP:11780
Got  RTP packet from    REMOTEIP:11780 (type 00, seq 000000, ts 1638191900, len 000160)
pbx*CLI>  Sent RTP packet to      MY_NONVPN_IP:11800 (type 00, seq 003404, ts 1638191896, len 000160)
      > 0xb7411270 -- Probation passed - setting RTP source address to MY_NONVPN_IP:11800
Got  RTP packet from    MY_NONVPN_IP:11800 (type 00, seq 000001, ts 3221661807, len 000160)
Sent RTP packet to      REMOTEIP:11780 (type 00, seq 059321, ts 3221661800, len 000160)
pbx*CLI>        > 0xb5775080 -- Probation passed - setting RTP source address to REMOTEIP:11780
pbx*CLI>  Got  RTP packet from    REMOTEIP:11780 (type 00, seq 000001, ts 1638192060, len 000160)
Sent RTP packet to      MY_NONVPN_IP:11800 (type 00, seq 003405, ts 1638192056, len 000160)
pbx*CLI>  Got  RTP packet from    MY_NONVPN_IP:11800 (type 00, seq 000002, ts 3221661967, len 000160)
Sent RTP packet to      REMOTEIP:11780 (type 00, seq 059322, ts 3221661960, len 000160)
pbx*CLI>  Got  RTP packet from    MY_NONVPN_IP:11800 (type 00, seq 000003, ts 3221662127, len 000160)
Sent RTP packet to      REMOTEIP:11780 (type 00, seq 059323, ts 3221662120, len 000160)
pbx*CLI>  Got  RTP packet from    REMOTEIP:11780 (type 00, seq 000002, ts 1638192220, len 000160)
Sent RTP packet to      MY_NONVPN_IP:11800 (type 00, seq 003406, ts 1638192216, len 000160)
pbx*CLI>  Got  RTP packet from    REMOTEIP:11780 (type 00, seq 000003, ts 1638192380, len 000160)
Sent RTP packet to      MY_NONVPN_IP:11800 (type 00, seq 003407, ts 1638192376, len 000160)
pbx*CLI>  Got  RTP packet from    MY_NONVPN_IP:11800 (type 00, seq 000004, ts 3221662287, len 000160)

The phone registers as expected:

<--- Transmitting (NAT) to 10.11.12.38:5062 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.11.12.38:5062;branch=z9hG4bK678706115;received=10.11.12.38;rport=5062
From: "USERNAME" <sip:1040@10.11.12.1>;tag=1936430616
To: "USERNAME" <sip:1040@10.11.12.1>;tag=as57b9e839
Call-ID: 1771037218@10.11.12.38
CSeq: 2 REGISTER
Server: FPBX-2.11.0(11.12.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Expires: 3600
Contact: <sip:1040@10.11.12.38:5062>;expires=3600
Date: Mon, 15 Sep 2014 23:03:01 GMT
Content-Length: 0

Calls OUT are killed with:

<--- Transmitting (NAT) to 10.11.12.38:5062 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.11.12.38:5062;branch=z9hG4bK678706115;received=10.11.12.38;rport=5062
From: "USERNAME" <sip:1040@10.11.12.1>;tag=1936430616
To: "USERNAME" <sip:1040@10.11.12.1>;tag=as57b9e839
Call-ID: 1771037218@10.11.12.38
CSeq: 2 REGISTER
Server: FPBX-2.11.0(11.12.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Expires: 3600
Contact: <sip:1040@10.11.12.38:5062>;expires=3600
Date: Mon, 15 Sep 2014 23:03:01 GMT
Content-Length: 0

pbx*CLI>  Sent RTP packet to      MYCELLIP:25070 (type 00, seq 022064, ts 53074296, len 000160)
pbx*CLI>  [2014-09-15 16:06:40] WARNING[1576]: chan_sip.c:4024 retrans_pkt: Retransmission timeout reached on transmission 204452674@10.11.12.38 for seqno 2 (Critical Response) -- See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 10175ms with no response
[2014-09-15 16:06:40] WARNING[1576]: chan_sip.c:4053 retrans_pkt: Hanging up call 204452674@10.11.12.38 - no reply to our critical packet (see https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions).

The PBX ACCEPTS all traffic from 10.11.12 through IP tables.

I'm puzzled.

Andrew

maikcat

can you post the output of ifconfig on your phone?

Michael.

AndyInNYC

Setting the phone's syslog at 6, I have the following info available (I can't log into the phone to run 'ifconfig').

eth0      Link encap:Ethernet  HWaddr 00:15:65:72:42:61  
          inet addr:10.1.10.175  Bcast:10.1.10.255  Mask:255.255.255.0
          inet6 addr: fe80::215:65ff:fe72:4261/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:139967 errors:0 dropped:0 overruns:0 frame:0
          TX packets:78875 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1024 
          RX bytes:24263541 (23.1 MiB)  TX bytes:13724417 (13.0 MiB)
          Interrupt:8 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.11.12.38  P-t-P:10.11.12.37  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:2966 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8174 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1655825 (1.5 MiB)  TX bytes:1449461 (1.3 MiB)

andrew

AndyInNYC

Anyone have any thoughts on why I'm having this issue? I'd really love to resolve it.

Andrew