Q on VoIPo SIP outbound vs. router

**stevech** · 03-09-2011 05:31 PM

Trying this question here before I file a trouble ticket...
My router's event log (syslog stored internally), has several per minute notices. Each says the router blocked a SIP packet from the Grandstream ATA directed to server 72.51.46.124:5060. This is OUTBOUND.

My router has firewall settings for SIP/ALG and this is enabled. I assume this is for inbound SIP connections (receiving a call).

The firewall settings in the router do not have anything specific on blocking ports for OUTBOUND.

Port-forwarding for inbound seems N/A for this discussion, but it's enabled none the less, to forward to the ATA.

The exact router message is "SIP ALG rejected packet from 192.168.1.51:5079 to 72.51.46.124:5060" (where .51 is the Grandstream on the LAN) All log messages have the same destination SIP server IP.

which suggests that the ALG in the router decided the SIP packet is invalid and should not be forwarded to the Internet?

I also tried putting the ATA in the router's DMZ. No help.

All this does is quickly fill up my router's log. It may also be a problem when the ATA tries to contact a designated SIP server for registration, but I have no loss of service problems for registration.

**holmes4** · 03-09-2011 06:32 PM

Can you turn ALG off? This is often recommended.

**stevech** · 03-09-2011 09:00 PM

Originally Posted by holmes4

Can you turn ALG off? This is often recommended.

Yes, I can turn ALG/SIP off, and a list of others such as MMS, IPsec, PPTP, and RTSP. The latter is used by VoIP for the bearer traffic, right?

Is the purpose of router-based ALG to avoid the need to do explicit port-forwarding or "triggered" forwarding, etc? I don't know.

**voipinit** · 03-10-2011 03:12 PM

VOIPo is sending keep alive packets to keep customers routers ports from closing. Your router settings are set not to reply (permit an outbound packet) to an inbound packet request that is only a single packet reply to a solicitation (similar to blocking WAN ping requests). If you are not having registration issues or call quality issues, I wouldn't worry about it and keep your current configuration.

**stevech** · 03-10-2011 03:37 PM

Originally Posted by voipinit

Your router settings are set not to reply (permit an outbound packet) to an inbound packet request that is only a single packet reply to a solicitation (similar to blocking WAN ping requests).

What setting would prohibit a reply initiated by the ATA?

**voipinit** · 03-10-2011 06:42 PM

I'll tell you what I know:

To answer your question it is most likely SIP ALG but I don't know your other options either configurable or not configurable (if any) regarding the routers firewall.

SIP ALG is supposed to do 3 things (few commercial routers do this well - most don't):

Open the appropriate ports for VOIP traffic.
Check VOIP packets to ensure it complies with SIP protocols.
Allow auditing by producing log messages.

My guess:
It appears your router SIP ALG is accepting the incoming keep alive from VOIPo like it should since it is valid VOIP traffic, but is not accepting your ATA's reply (and thus generates a log message). This could be from SIP ALG not recognizing the ATA's reply as VOIP traffic or it not complying with the routers SIP ALG algorithm violating the SIP protocol (either correctly or incorrectly).

**sr98user** · 03-11-2011 06:23 AM

There are 3 things in play here..

SIP ALG - which rewrites SIP header with public IP and public port.
If this is on and it works correctly then you probably don't need a
STUN server.

Firewall - which inspects UDP/TCP sessions and open/closes port ASAP.
Probably does other things too. Like DOS attack etc.

NAT - which maps and internal IP/port to external IP/port. There are different
types of NAT. But its mostly about directing/blocking traffic from WAN.

My guess is probably the Firewall (maybe NAT is involved) that is blocking your outgoing traffic. In your original post you mentioned that it tries to block traffic to 72.51.46.124. That is sip-west.voipwelcome.com. Is that where you are connected to? I thought that server was not up and running.

**stevech** · 03-11-2011 07:04 PM

Yes, I'm served by the west SIP server.

I would like to stop all the outbound rejections because it fills up my router's SYSLOG. And the barrage (3 per minute) of incoming "pings" from SIP servers is bad too.

I didn't have all this with my prior VoIP provider. But that provider did not have a reliable server feature set, nor humane customer support.

**sr98user** · 03-14-2011 07:36 AM

If you are getting 3 per minute, its probably the keep alive packets from the ATA to the SIP server to keep the UDP NAT entries alive. I am not sure why your router is blocking that traffic. Does it give any reason at all? What router do you have?

Depending on the NAT entry timeout for the UDP packets, you could increase the keep alive interval. To do that, you would need to the timeout or should be able to configure it.

**stevech** · 03-14-2011 10:56 AM

Originally Posted by sr98user

If you are getting 3 per minute, its probably the keep alive packets from the ATA to the SIP server to keep the UDP NAT entries alive. I am not sure why your router is blocking that traffic. Does it give any reason at all? What router do you have?

Depending on the NAT entry timeout for the UDP packets, you could increase the keep alive interval. To do that, you would need to the timeout or should be able to configure it.

I am seeing my router's log (Cradlepoint MBR900) filled with rejected incoming packets from VoIPo's SIP servers. Also, my ATA's ALG function is trying to send SIP packets out but the router log says it did not forward, apparently because the Grandstream's SIP packet is not formatted properly according to the Cradlepoint.