Best practices to set up a router and/or firewall
Avoid a double NAT network
Section titled “Avoid a double NAT network”Network Address Translation (NAT) maps one IP address space into another by modifying address information in the IP header of packets as they transit a routing device.
A “double NAT” setup is where one router is placed after another. The typical scenario is a home network: the ISP provides a modem with a built-in router, but you have also bought your own router, and all your devices connect to it. Ordinary internet usage on computers behind a double NAT works fine, but VoIP devices behave strangely.
To resolve this, configure your modem/router into bridge mode. This disables all routing functions on the modem/router and allows only your own router to perform them. Consult your ISP or manual for how to set up bridge mode.
Firewall allowances
Section titled “Firewall allowances”The following fully qualified domain names should be included in your firewall rules:
| FQDN | Purpose |
|---|---|
pbx1-z1.brightpbx.ca | PBX |
pbx1-z2.brightpbx.ca | PBX |
pbx2-z1.brightpbx.ca | PBX |
pbx2-z2.brightpbx.ca | PBX |
p.zswitch.brightpbx.ca | Provisioning |
provision.brightpbx.ca | Provisioning |
Other possible causes of problems
Section titled “Other possible causes of problems”- Implement QoS to prioritize traffic from the phones to the system, through DSCP marking (46) or a guaranteed 100 kbps per device.
- Disable SIP ALG (also called SIP Module, SIP Transformations, SIP Helper, SIP Proxy). If an option is labelled SIP, it is best disabled — these options mainly help on-premise VoIP systems and can severely hinder cloud-based VoIP traffic.
- Enabled UPnP
- Enabled SPI (Stateful Packet Inspection) or SIP ALG (Application Layer Gateway), which could overwrite or modify SIP headers
- Another NAT traversal technique that might overwrite or modify SIP headers
- A firewall UDP timeout that is too short — it should be at least 120 seconds
- Consistent NAT disabled
- Blocked SIP and RTP ports
If problems persist after adjusting the above
Section titled “If problems persist after adjusting the above”- If everything indicates successful configuration, reboot the modem and VoIP device
- Configure a different VoIP device (IP phone, ATA, or softphone) and re-test
- Test your router or phone on a different internet connection
- If you are using multiple routers and other networking equipment, try plugging your VoIP device directly into the internet modem. If this resolves the issue, troubleshoot your other equipment.
- Do a factory reset and reconfigure the VoIP device from scratch
- Upgrade the router to the latest firmware — new firmware may fix SIP bugs
- Try disabling your firewall briefly. Reboot your router and VoIP device and check whether you can make and receive calls. If you can, re-enable the firewall and try the next two solutions.
- Configure and connect the VoIP device to the router’s DMZ port
- Forward SIP and RTP ports to the VoIP device