Networking Blog

So frustratingly, I haven’t posted in waay too long here, but been busy with work ‘n stuff!

This year (in January) I was lucky enough to upgrade my traditional DSL @ 30Mbps to FTTH (Fiber to the Home) @ 300Mbps, and it’s crazy fast! I love it (I cannot say this enough! I love it to bits!!) It makes working at home such a pleasure. However one frustrating thing about the solution is that they migrate away from your traditional copper telephone line, to a SIP trunk across the fiber.

Now, I don’t play well with provider supplied modems, and the Huawei modem supplied, while it would work, doesn’t give me any control over content available at my house (i.e. protect my kids online activities, keeping their eyes away from things they should never see at their ages!)

I played with the idea of dragging an old Cisco ATA out of storage and loading the SIP image to it and fudging it until it worked (Cisco ATA’s were a b*tch to configure even back in the day when i was working with VoIP), so i had a brain fart – why not put the supplied Huawei modem behind my own firewall of choice – Sophos XG.

While this kindof worked – for the first few minutes all was well, until i discovered that inbound calls started failing – it seems the SIP registration was going stale, and inbound SIP calls disappeared into the ether. They wouldn’t work until you kicked an outgoing call off to re-register, open whatever ports on the firewall etc, until they closed again, and nobody would ring you!

This is where things got desperate – eir in all their wisdom, don’t use standard SIP ports, so unfortunately Sophos XG’s SIP awareness was kicked into blindness. And it’s SIP awareness is not configurable. D’oh, why oh why eir, why oh why!

OK, so after some digging, (there’s not much out there in googleland, other than a few helpful pointers on Reddit and boards.ie) and some tcpdumps to see what was going on on my firewall, it seems that i needed to create some inbound NAT translations to the external IP (the WAN address) of my supplied Huawei router. Here’s what i did.

1. Give the WAN address a static IP, maintaining the eir DNS servers (otherwise nothing works!) – also remember to disable the VLAN ID, as this is only required when connected directly to the FTTH box installed at your home.
2. DNS Servers for eir are: 159.134.0.1 and 159.134.0.2
3. Configure gateway etc as you require at your house.
4. In Sophos XG, create a new firewall ‘business application rule’ using the template ‘DNAT/Full Nat/Load Balancing’
5. Name it to your demanding standard naming convention – i chose ‘Allow SIP from eir to Internal’ – imaginative i know! Create this rule at the top of your ruleset.
6. Source: WAN; Allowed Client Networks: Any
7. Destination host/network: Select your Wan Port; Services: Eir_Sip (Detail below – create your own custom service)
8. Forward To Protected Server(s): Create a host entry with your Huawei Wan address (you configured a static IP for this earlier in step 1); Protected Zone: LAN
9. Leave all else as default, you can choose to enable logging for this rule if required. Save!!.

Services Custom Definition:

I created a custom definition for the service, it’s created as follows:

Name: Eir_SIP

Type: TCP/UDP

Protocol        Source Port       Destination Port

TCP                1:65535              6050

UDP                1:65535              6050

TCP                1:65535              10000:10100

UDP                1:65535              1000:10100

Credit for this goes to boards.ie user cnocbui at this post:

https://www.boards.ie/vbulletin/showpost.php?p=110875525&postcount=9622

So far, so good. It’ s been reliable for the last 24 hours and anyone can ring me now 🙂 Though they probably won’t, they have my mobile number anyway !!

Hope this post helps anyone out there, let me know if it has!
Liam.