Skip to content
BrightPBX

Best practices to set up a router and/or firewall

Avoid a double NAT network

A Network Address Translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. 

A “Double NAT” setup is where a router is placed one after another. 

A typical scenario where you would find a double NAT setup is with a personal home Internet network. The ISP would provide a modem with a built-in router but then you have purchased your own latest and greatest router. All of your devices are connected to your personal router. While common Internet usage on computers behind the double NAT works fine, VoIP devices exhibit unusual behaviour.

To resolve the double NAT issue, you can simply configure your modem/router into “bridge mode”. This will disable all routing functions from the modem/router and allow only the personal router to perform the routing functions. Consult your ISP or manual on how to set up bridge mode on your modem/router.

Firewall allowances

The following fully qualified domain names (FQDNs) should be included in the firewall rules:

  • pbx1-z1.brightpbx.ca
  • pbx1-z2.brightpbx.ca
  • pbx2-z1.brightpbx.ca
  • pbx2-z2.brightpbx.ca
  • p.zswitch.brightpbx.ca
  • provision.brightpbx.ca

Other possible reasons why problems occur

  • Implement QoS to prioritize traffic, targeting everything sent from the phones to the system using the above IP range. This can be achieved through DSCP marking (46) or a guaranteed 100 kbps per device.
  • Disable SIP ALG (SIP Module, SIP Transformations, SIP Helper, SIP Proxy, etc.). If an option is labeled SIP, it is best to disable it, as these options are primarily helpful for on-premise VoIP systems and can severely hinder cloud-based VoIP traffic
  • Enabled UPnP
  • Enabled SPI (Stateful Packet Inspection) and/or SIP ALG (Application Layer Gateway) that could overwrite/modify SIP headers
  • Enabled other NAT (Network Address Translation) Traversal technique that might overwrite/modify SIP headers
  • Too short UDP timeout of the Firewall – should be at least 120 seconds
  • Disabled Consistent NAT
  • Blocked SIP and RTP ports

If problems persist after adjusting above

If the problem persists, after adjusting the reasons above, consider the following:

  • If everything indicates successful configuration, reboot the modem and VoIP device
  • Configure a different VoIP device (IP Phone, ATA, or soft phone) and re-test
  • Test your router/phone on a different internet connection.
  • If you are using multiple routers and other networking equipment, try plugging your VoIP device directly into the Internet modem. If this resolves your issue, you may have to troubleshoot your other VoIP devices.
  • Do a factory reset and reconfigure the VoIP device from scratch
  • Upgrade router to the latest firmware. New firmware may fix SIP bugs
  • Try disabling your firewall briefly. Reboot your router and VoIP device and check if you can make/receive calls. If you can, then enable the firewall again and try the next two solutions
  • Configure and connect the VoIP device to the router’s DMZ port
  • Forward SIP and RTP ports to the VoIP device