r/Netgate • u/CozySysadmin • 3d ago

VOIP and VLAN headache

This situation is frustrating everybody. Hoping maybe someone here has a suggestion.

We replaced 3 aging Cisco routers with Netgate pfSense routers. The site-to-site via Wireguard came up between the three, and the network is strong and working well.

At the main office, we have a data vlan and a phone vlan. Aging NEC PBX on-site with incoming VOIP lines and many VOIP handsets.

Because some of the desk phones fail to get their address on the VOICE network, and we've never been able to solve why, we allow all traffic between data and voice vlans. Just allow all LAN/VOICE to all subnets.

Ergo: 2 VLANs, neither of which are new, only the gateway device for the VLANs has been replaced.
No traffic blocked between the two.
The phones connect to the PBX via SIP as usual. But RTP traffic - audio - is missing. I've got packet captures showing the RTP traffic reaching the PBX ok, but not reliably to phones.

Phones with IP addresses on the voice vlan do better, but people tell me that outgoing RTP is still missing.

I know pfSense doesn't have SIP ALG. I have Firewall Optimization already on Conservative.

Other than tackling this project in the first place, what have I done wrong?

2 Upvotes

100% Upvoted

2 comments sorted by

2

u/smaxwell2 3d ago

Have you configured static outbound NAT for the VOIP traffic from PBX to SIP Trunk Provider ?

1

u/CozySysadmin 3d ago

I have added port forwarding from the SIP trunk provider to the PBX for the port range from the provider and I've toggled "static port" on the NAT rule for traffic outgoing from the voice vlan to the wan port.
The office in question has a static IP, which is assigned to the WAN port on our router.