Router behind Speed Boster = VoIP impossible?

[Adoni91]

Hello, I hope it's okay to write in English as my Greek is not very good

My issue:
VoIP/SIP connections are not working anymore since I put my Router (Fritzbox) in a DMZ behind the Cosmote Home Speed Booster.
I believe this is because HA35 is keeping SIP ports "for himself".
Can you give me any advice to fix this?
Everything else (VPN...) is working without problems.

My configuration:
ADSL/4G <-- Cosmote Home Speed Booster Huawei HA35-10 <-- Fritz!Box 7490 International, Firmware 07.12

1. Fritzbox is in the DMZ of the HA35
2. I have followed the steps outlined here for putting another router behind the HA35
3. My old configuration was to have the Fritzbox directly connected to the internet; in that setup, everything works flawlessly, so I can be sure that there are no errors in my SIP configurations (I got the password from 13888) and was able to call without problems for many months
4. All other services (such as MyFritz remote configuration, VPN to Fritzbox etc.) are all working without problems

My troubleshootings steps:
- I have found that it seems that the HA35 is not forwarding port 5060 to the Fritzbox, regardless of the DMZ setting
- Manually trying to set up port forwarding for 5060 on the HA35 brings up this message:
"The external port IDs cannot be 7547, 990, 5060, 37215, 37443 or 50000-50020." (see screenshot)

- Putting the Cosmote VoIP details directly into the HA35 (ims.otenet.gr etc.) works, the account will register and show as "Online". However that is of no use to me, as all my phones are wireless/DECT and connected to the Fritzbox
- I have tried several SIP providers, firstly of course Cosmote but also Sipgate and Plivo. None of them could register and connections timed out. With some experimentation, I got the Sipgate account to register by using these new settings in the Fritzbox:

Registrar: sipgate.de:5260
Proxy: tcpproxy.sipgate.de;transport=tcp
STUN-Server: stun.sipgate.net:10000
and also setting up manual port forwarding in the HA35 for port 5260 in addition to the DMZ (just to be sure).
With these new settings, the Sipgate account is now registering ok (green light) but making calls is still impossible (SIP error 408 = timeout).

Of course, even if I can get Sipgate to work, I still don't have proxy and stun server information for Cosmote (I don't know if they exist).

Further questions & thoughts:
- If the HA35 cannot be persuaded/hacked to forward port 5060 and all SIP traffic to the DMZ, what other options do I have to get my telephony working? Directly connect phones to the HA35 by wire is not an option, as the HA35 is very far away (on the roof) and all my phones are DECT and/or softphones (apps) connected to the Fritzbox (I don't have any wired VoIP phones).

- I have thought, is it possible to use the HA35 as a SIP server (the Fritzbox has this functionality)? In this case, I could use the Fritzbox as the SIP client/endpoint and everything would be golden. However I could not find any such information about the HA35.

The situation for me is very bad because I don't get a mobile phone signal in my house and have to rely on the SIP connection now that my landline is All-IP. On the other hand, throwing out the HA35 again is not an option, as my landline speed is too slow for anything without the bonding tunnel with 4G, so I don't really want to lose the extra speed the HA35 provides.

I tried to give all the information I have and I hope you can help.

Thank you very much!

P.S.: In case it is required, here are the firmware details for the HA35:
Product type: HA35-10
Country code: OTE
Hardware version: AV1HA35M VER.A
Software version: V100R019C00SPC002
Profile version: DTEU001

[sdikr]

There is no reason to Forward 5060 to your Fritz, it is also a very big security risk.

I think that your problem has to do with the connection trying to go via the mobile connection of the speedbooster,
You could try to force the connection to be made via tha xdsl line

[Adoni91]

There is no reason to Forward 5060 to your Fritz, it is also a very big security risk.

Why? The Fritzbox has a good firewall, and if it is in the DMZ, by default the port should be forwarded to it anyway. However, as you can see from my screenshot, it is impossible to forward it even manually, as the HA35 blocks it (presumably, to use it for its own VoIP endpoint).

I think that your problem has to do with the connection trying to go via the mobile connection of the speedbooster,
You could try to force the connection to be made via tha xdsl line

This is a good idea! Can you advise me on how I can force SIP connections to go only via DSL and not over the bonding tunnel or 4G? Where can I set this in the HA35?

Thank you!

[sdikr]

Why? The Fritzbox has a good firewall, and if it is in the DMZ, by default the port should be forwarded to it anyway. However, as you can see from my screenshot, it is impossible to forward it even manually, as the HA35 blocks it (presumably, to use it for its own VoIP endpoint).


This is a good idea! Can you advise me on how I can force SIP connections to go only via DSL and not over the bonding tunnel or 4G? Where can I set this in the HA35?

Thank you!

Has a good firewall are the last worlds that someone said before his account was used to phone to many high cost numbers.
You do not need port 5060 open, unless you want to connect to your fritz from the Internet (you and all the others).


For the bonding have a look at this post

[Adoni91]

Thanks.

To try this (before setting up all the exception rules), I have now switched off the bonding tunnel (disabled it) and also disabled the 4G connection in the HA35.

Now, the HA35 only connects to the internet directly via ADSL, and an IP address check confirms this.

The situation at the Fritzbox presents itself now as follows:

- Sipgate SIP account can register (green), however on outgoing calls the opposite end is not heard (however they hear me). This still points to a forwarding issue. Removing / adding the STUN server and/or Proxy Server has not helped.

- Cosmote SIP account cannot register and consequently cannot receive or make outgoing calls.

So even though we have now completely switched off bonding and 4G in the HA35, SIP connections are still not working properly.

To confirm again, the Fritzbox is in the DMZ but I have now (following your advice) not created any additional port forwardings whatsoever.

I have also confirmed that the SIP settings in the Fritzbox work (both accounts register fine) when it is directly connected to the ADSL line, so again I suspect something else with the HA35 is the issue.

Also I have looked at the link you provided and I have a concern regarding the bonding exceptions, as these are on an IP basis: How would I be able to except COSMOTE sip connections from bonding? Are their address spaces / subnets fixed and documented somewhere?

Thank you very much for your continued advice.

[sdikr]

Thanks.

To try this (before setting up all the exception rules), I have now switched off the bonding tunnel (disabled it) and also disabled the 4G connection in the HA35.

Now, the HA35 only connects to the internet directly via ADSL, and an IP address check confirms this.

The situation at the Fritzbox presents itself now as follows:

- Sipgate SIP account can register (green), however on outgoing calls the opposite end is not heard (however they hear me). This still points to a forwarding issue. Removing / adding the STUN server and/or Proxy Server has not helped.

- Cosmote SIP account cannot register and consequently cannot receive or make outgoing calls.

So even though we have now completely switched off bonding and 4G in the HA35, SIP connections are still not working properly.

To confirm again, the Fritzbox is in the DMZ but I have now (following your advice) not created any additional port forwardings whatsoever.

I have also confirmed that the SIP settings in the Fritzbox work (both accounts register fine) when it is directly connected to the ADSL line, so again I suspect something else with the HA35 is the issue.

Also I have looked at the link you provided and I have a concern regarding the bonding exceptions, as these are on an IP basis: How would I be able to except COSMOTE sip connections from bonding? Are their address spaces / subnets fixed and documented somewhere?

Thank you very much for your continued advice.

The sound problem usually have to do with RTP ports, try to change the rtp range on your fritz,
On your fritz do you have Cosmote dns? or some other like Google? it has to have your isp dns to be able to connect with the sip server

I repeat again, you do not need dmz, or Port forward for sip to work as a client

I am afraid i do not know their ip range, so i cannot help you with that.

[jkoukos]

Default RTP port range for every Fritz is 7078-7110 and need to be opened on front router to Fritz.
As for the SIP port 5060 it shouldn't be opened, but VoIP telephony on HA35 must be unenergized.

[psyxakias]

Hello Adoni91, I have HA35+booster service but never tried to DMZ and use VOIP in a separate router.

I suppose you have already disabled HA35's telephony while trying these tests - right? (Telephony > Edit > [UNCHECK] Enable > Save)

[nickxatz]

Hi all, i have same problem Huwaei HA35 and a grandstream router that i have for a voip virtual center that i use for my company, till yesterday with speedport all were working good and today when i changed router voip does not register anymore. Does anybody found any solution?

- - - Updated - - -

I have you solution, call cosmote and ask them to disable sip alg setting and then all voip will be ok

[austria]

Hi all, i have same problem Huwaei HA35 and a grandstream router that i have for a voip virtual center that i use for my company, till yesterday with speedport all were working good and today when i changed router voip does not register anymore. Does anybody found any solution?

- - - Updated - - -

I have you solution, call cosmote and ask them to disable sip alg setting and then all voip will be ok

Hello, i have also the same problems, i cant call with my voip freevoipdel.com - helps you disable from sip als settings?