RV042G - Port Forwarding Not Working. Ideas?

[stuart_j_miller]

Hi Guys,

Hopefully someone can help me on this. I'm in the process of deploying an RV042G in our office and have an issue with port forwarding for our VOIP PBX. The setup/issue is as follows:

I have a 3CX IP PBX with a LAN IP of 192.168.51.49. The PBX is using SIP trunks for inbound/outbound calls. The RV042 has been configured under the 'Forwarding' section to forward SIP and RTP ports (5060, and 9000-9049 respectively) to the PBX (192.18.51.49) with seperate entries for both TCP and UDP. Outgoing connections work fine, however incoming connections (which the port forwarding is obviously for) are refused/no response. So I can only come to the conclusion that the ports are not fowarding correctly?

If I place the PBX in the DMZ everything works fine.

Could anyone shed any light on why port forwarding isn't working? And more importantly, how do I resolve this?

Thanks in advance, hoping someone can help me out here!

[Tom Watts]

Hi Stuart, you may be running in to an odd limitation of the product. To the best of my recollection the RV0xx routers have an embedded SIP ALG in the firewall which cannot be disabled.That being the case, I would speculate your PBX would require no SIP ALG functionality.

-Tom
Please mark answered for helpful posts

[stuart_j_miller]

Hi Tom,

Thanks for the quick response. I don't doubt you at all, just need to work the logic through in my head(!). As I understand it the 'undesired' effects of ALG are that it can modify SIP packets resulting in corruption and similar issues, resulting in failed calls. My SIP trunk provider has been quite helpful in asssiting with this, and they say that the relevant ports (5060, 9000-9049) required are not in fact open. I have validated that this is the case with various online tools also.

So, is that still symptomatic of ALG, and would the fact that outbound calls work (ie, my PBX initiating comms with the SIP trunk) also point to this? Or is it in fact a port forwarding issue?

Once again, thanks.

Stu

[Tom Watts]

Hi Stuart, it may be an interesting idea to modify the state table of the router firewall. The first contention may be to disable the router firewall to see if everything works as expected. If that's the case, we can change the router state table to be more specific to your needs.

If you notice there is a default firewall rule to permit all outbound connection while deny inbound connection. We can make that work in your favor.

Please disable the router firewall and see if it works as expected, if so, I'll provide an example how to change the state table to work in your favor.

-Tom
Please mark answered for helpful posts

[stuart_j_miller]

Hi Tom, Marty,

Tom, I've tried with firewall disabled, which did work. Drilling down specifically it was disabling one of the elements of the firewall that worked (can't remember which, not at office right now). Was a type of packet inspection from memory. Will post back later with details of the actual setting - might be helpful for others who may have this issue in the future, which is what these forums are all about

Marty, Now that looks very interesting. I'm going to head into the office now to try that - Being pre-occupied with getting the phones working before monday has meant I overlooked creating a QVPN user to do it remotely!

Guys, thanks for your help. Much appreciated and will post back with outcome.

Cheers

Stu

[mpyhala]

Stuart,

You can test with SIP ALG disabled. See the URL in the screenshot:

- Marty

[stuart_j_miller]

Hi Marty,

Just had a look at this. I can get that hidden page, however there is no facility to disable SIP ALG. I assume this is down to different firmware version?

To clarify, my unit is running on V4.2.1.02

What version is running in that screengrab?

Cheers

Stu

[stuart_j_miller]

Me again Marty,

Scrap that - Just upgraded to 4.2.2.08. Disabling SIP ALG was then available and I have disabled. Still no incoming calls though.

So I think we've eliminated SIP ALG being an issue, as ports still appear to be closed despite there being port forwarding rules.

Anything else to try?

Thanks

Stu

[Tom Watts]

Hi Stuart, please try to disable the router's firewall entirely and let us know how that works out, if there is the same problem or not.

-Tom
Please mark answered for helpful posts

[stuart_j_miller]

Hi Tom,

With firewall completely disabled the issue continues. Ports appear to be closed.

Stu

[Tom Watts]

Hi Stuart, what type of internet connection do you have? What is the modem vendor and model number? Can you provide a screenshot of your port forwarding rules as well?

-Tom
Please mark answered for helpful posts

[stuart_j_miller]

Hi Tom,

The connection is Ethernet First Mile (EFM). Modem is provided by our service supplier. Its a RAD EtherAccess LA-210. It appears to be locked down and I haven't been able to access any config pages for this. However, I believe it is setup as a bridge.

Screenshot of port forwarding:

Cheers

Stu

[stuart_j_miller]

Bit of an update: Been on the phone to Cisco and had a webex session so they could go through the router. Definately no issues as far as the configuration is concerned. However, I was told that there is a known issue which means what we've tried so far is possibly all in vain anyway! Its been left with them now and they'll be coming back to me, possibly with a firmware fix. We shall see.. In the mean time, Tom, if you have any other suggestions I'm willing to give them a try!

Stu

[Tom Watts]

Hi Stuart, try to modify the state table. This is an example

Action Deny

Service All

Source interface WAN

Source IP any

Destination IP any

Save

Action Permit

Service SIP - 5060

Source interface WAN

Source IP -xx.xx.xx.xx

Destination IP - xx.xx.xx.xx

Save

-Tom
Please mark answered for helpful posts

[stuart_j_miller]

Hi Tom,

Still nothing I'm afraid...Thanks for sticking with this though!

Stu