Mikrotik routerboard 1100 x2h need to open ports - voip

I have a Mikrotik routerboard 1100 x2h router and I need to open udp ports both incoming and out going for voip service. the ports are 5199, 3479, 5060 and range 2222 - 2269. I have tried from the web gui and winbox and cant figure the correct settings. Could someone please help with this?
premiumtsAsked:
Who is Participating?
 
MarcusSjogrenConnect With a Mentor Commented:
Hi,

By the way... You have an outgoing NAT for ether1 and 2 so There must be some incoming NAT on Ether1 or it won't work. I suppose the PBX tries to contact the IP of Ether1 when calls are coming in, right?

So, you have to make a dst-NAT for in-interface=ether1, protocol=UDP and the ports that you stated in the access-list.

Please send IP of Ether1, Ether11, IP-phone and what IP the PBX tries to contact on incoming calls.

Marcus
0
 
eeRootCommented:
Can you post a screenshot from the web gui showing what is not working?
0
 
premiumtsAuthor Commented:
Hi  eeRoot

There are a few different screens. I will take screenshots today and attach them.

Thanks
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
MarcusSjogrenCommented:
Hi,

Please see my attached image.

1. Specify chain, usualy "input", could also be "forward" if the packets are passing from one mikrotik interface to another.

2. Specify destination address (if you want to)

3. Specify protocol as "UDP"

4. Specify destination port.
Destination port formats are either <P>, <P1-Pn> or <P1,P2,P3 ... Pn> where P is port number.

Good luck!

Edit: Depending on your config you might need to make an identical rule with the chain "output" and to also specify which interface the traffic is going to/from.
To enable outbound on ether1 you would set chain="output" and "out-interface=ether1" and vice versa for input.

Also note that Mikrotik reads the access-list from top to bottom and catches first match.
Winbox-Firewall.png
0
 
premiumtsAuthor Commented:
I have uploaded screen shots of the firewall rules and nat rules. I added the UPD rules as stated and still no luck. We can make outbound calls but incoming calls phones dont ring
router.rtf
0
 
MarcusSjogrenCommented:
Hi,

On which ether-interface is the telephone traffic originated?

Marcus
0
 
premiumtsAuthor Commented:
we have the switch which the phone is plugged into on eth 11
0
 
premiumtsAuthor Commented:
so eth 1 is internet and eth 11 is switch on router
0
 
MarcusSjogrenCommented:
The Mikrotik is using IP tables (more or less) for the firewall, which makes it a little bit different than Cisco and other common firewalls.

Here is a quite good description of how it works. I think that you need to put a new rule above rule #3 which is "forward", "UDP", "<ports>", "in-interface=Ether11".

After that I believe you should be able to remove the rule added for "output"-chain.

http://www.mikrotik.com/testdocs/ros/2.9/ip/flow.php
0
 
premiumtsAuthor Commented:
I got lost reading the art but did add a rule at number 2 of "forward", "UDP", "<ports>", "in-interface=Ether11 - still same thing.
0
 
MarcusSjogrenCommented:
How is this setup? Is ether11 its own subnet?
If so, can you ping the mikrotik ether11 and ether1 from behind it if you put an "allow everything, in-interface=Ether11"? E.g you connect a laptop to the switch.

Just to start of with the knowledge that you have the proper connectivity.
0
 
premiumtsAuthor Commented:
The way it is setup is there are 2 vlans on the router. Lets say ports 1,2,3,4,11,12 are vlan 1 which is 10.0.0.x subnet. then ports 5,6,7,8 are vlan 2 which is a 192.168.10.x network just for wireless routers throughout the building.

10.0.0.x is the internal network and voip phones.

From the server I can ping the phones IP address and also pull up the web gui of the phone. I can pint the internal and external address of the router.

From the router I can also ping the phone address.

The odd thing is if I call the phone 50 times maybe 1 or 2 times out of the 50 the phone will ring. The rest of the times I will hear the ringing on my cell phone but the physical phone will never ring.

EDIT: Ps. this was setup by an outside consultant for the company and when we asked him he had no clue as to how to get this working
0
 
MarcusSjogrenCommented:
If you look at interfaces in the router and compare the rx and tx utilization vs what you have purchased from you provider, are you almost reaching the maximum?

Sound like a QoS-issue to be honest. There is no way the access-rules work 2 times out of 50.

Does it work if you only have the telephones connected (no PCs etc)?
0
 
premiumtsAuthor Commented:
I know its not a qos issue as we are no where near the limit. I already tried shuting off all computers and it is the same result.

If I plug a phone directly into the isp modem there are no issues. It is as soon as it is put back behind the Mikrotik that the issues happen
0
All Courses

From novice to tech pro — start learning today.