0

I try to get a HylaFax + IAXModem + Asterisk Setup on a Debian 10 server running. The server is directly connected to the Internet, the firewall is disabled (no rules set up). The only thing that server has to do is sending fax. I use a sipgate trunk. During HylaFax is trying to send the fax, I see this Output in the Asterisk console (SIP debugging and verbosity is on/10):

    -- Accepting AUTHENTICATED call from 127.0.0.1:4570:
    --        > requested format = alaw,
    --        > requested prefs = (),
    --        > actual format = alaw,
    --        > host prefs = (alaw),
    --        > priority = mine
    -- Executing [RECIPIENT@fax_out:1] Set("IAX2/iaxmodem-7708", "CALLERID(num)=CALLER") in new stack
    -- Executing [RECIPIENT@fax_out:2] Set("IAX2/iaxmodem-7708", "CALLERID(name)=CALLER") in new stack
    -- Executing [RECIPIENT@fax_out:3] SIPAddHeader("IAX2/iaxmodem-7708", "P-Preferred-Identity:<sip:CALLER>") in new stack
    -- Executing [RECIPIENT@fax_out:4] Dial("IAX2/iaxmodem-7708", "SIP/sipconnect.sipgate.de/RECIPIENT,,r") in new stack
  == Using SIP RTP CoS mark 5
Audio is at 17702
Adding codec alaw to SDP
Adding codec ulaw to SDP
Adding non-codec 0x1 (telephone-event) to SDP
Reliably Transmitting (no NAT) to 217.10.68.150:5060:
INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 127.0.1.1:5060;branch=z9hG4bK12349644
Max-Forwards: 70
From: "CALLER" <sip:[email protected]>;tag=as65bc91b0
To: <sip:[email protected]:5060>
Contact: <sip:[email protected]:5060>
Call-ID: [email protected]
CSeq: 102 INVITE
User-Agent: Asterisk PBX 16.2.1~dfsg-1+deb10u1
Date: Mon, 21 Oct 2019 12:22:20 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
P-Preferred-Identity: <sip:CALLER>
P-Asserted-Identity: "CALLER" <sip:[email protected]>
Content-Type: application/sdp
Content-Length: 270

v=0
o=root 698738770 698738770 IN IP4 127.0.1.1
s=Asterisk PBX 16.2.1~dfsg-1+deb10u1
c=IN IP4 127.0.1.1
t=0 0
m=audio 17702 RTP/AVP 8 0 101
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=maxptime:150
a=sendrecv

---
    -- Called SIP/sipconnect.sipgate.de/RECIPIENT

<--- SIP read from UDP:217.10.68.150:5060 --->
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 127.0.1.1:5060;rport=5060;received=X.X.X.X;branch=z9hG4bK12349644
From: "CALLER" <sip:[email protected]>;tag=as65bc91b0
To: <sip:[email protected]:5060>;tag=c63713a666d5644779294882ed89253a.0c69
Call-ID: [email protected]
CSeq: 102 INVITE
Proxy-Authenticate: Digest realm="sipconnect.sipgate.de", nonce="Xa2kKF2tovxRNF/AcCiPaUlB/z/ev7jl"
Content-Length: 0

<------------->
--- (8 headers 0 lines) ---
Transmitting (no NAT) to 217.10.68.150:5060:
ACK sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 127.0.1.1:5060;branch=z9hG4bK12349644
Max-Forwards: 70
From: "CALLER" <sip:[email protected]>;tag=as65bc91b0
To: <sip:[email protected]:5060>;tag=c63713a666d5644779294882ed89253a.0c69
Contact: <sip:[email protected]:5060>
Call-ID: [email protected]
CSeq: 102 ACK
User-Agent: Asterisk PBX 16.2.1~dfsg-1+deb10u1
Content-Length: 0


---
Audio is at 17702
Adding codec alaw to SDP
Adding codec ulaw to SDP
Adding non-codec 0x1 (telephone-event) to SDP
Reliably Transmitting (no NAT) to 217.10.68.150:5060:
INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 127.0.1.1:5060;branch=z9hG4bK248f1ffc
Max-Forwards: 70
From: "CALLER" <sip:[email protected]>;tag=as65bc91b0
To: <sip:[email protected]:5060>
Contact: <sip:[email protected]:5060>
Call-ID: [email protected]
CSeq: 103 INVITE
User-Agent: Asterisk PBX 16.2.1~dfsg-1+deb10u1
Proxy-Authorization: Digest username="USER", realm="sipconnect.sipgate.de", algorithm=MD5, uri="sip:[email protected]:5060", nonce="Xa2kKF2tovxRNF/AcCiPaUlB/z/ev7jl", response="42016e991f588a252062bb86b35a3f6c"
Date: Mon, 21 Oct 2019 12:22:20 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
P-Preferred-Identity: <sip:CALLER>
P-Asserted-Identity: "CALLER" <sip:[email protected]>
Content-Type: application/sdp
Content-Length: 270

v=0
o=root 698738770 698738771 IN IP4 127.0.1.1
s=Asterisk PBX 16.2.1~dfsg-1+deb10u1
c=IN IP4 127.0.1.1
t=0 0
m=audio 17702 RTP/AVP 8 0 101
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=maxptime:150
a=sendrecv

---

<--- SIP read from UDP:217.10.68.150:5060 --->
SIP/2.0 100 trying -- your call is important to us
Via: SIP/2.0/UDP 127.0.1.1:5060;rport=5060;received=X.X.X.X;branch=z9hG4bK248f1ffc
From: "CALLER" <sip:[email protected]>;tag=as65bc91b0
To: <sip:[email protected]:5060>
Call-ID: [email protected]
CSeq: 103 INVITE
Content-Length: 0

<------------->
--- (7 headers 0 lines) ---

<--- SIP read from UDP:217.10.68.150:5060 --->
SIP/2.0 180 Ringing
Via: SIP/2.0/UDP 127.0.1.1:5060;rport=5060;received=X.X.X.X;branch=z9hG4bK248f1ffc
Record-Route: <sip:172.20.40.8;lr>
Record-Route: <sip:217.10.68.150;lr;ftag=as65bc91b0>
From: "CALLER" <sip:[email protected]>;tag=as65bc91b0
To: <sip:[email protected]:5060>;tag=as21618100
Call-ID: [email protected]
CSeq: 103 INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces
Contact: <sip:[email protected]:5060>
Content-Length: 0

<------------->
--- (12 headers 0 lines) ---
sip_route_dump: route/path hop: <sip:217.10.68.150;lr;ftag=as65bc91b0>
sip_route_dump: route/path hop: <sip:172.20.40.8;lr>
    -- SIP/sipconnect.sipgate.de-00000003 is ringing

<--- SIP read from UDP:217.10.68.150:5060 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 127.0.1.1:5060;rport=5060;received=X.X.X.X;branch=z9hG4bK248f1ffc
Record-Route: <sip:172.20.40.8;lr>
Record-Route: <sip:217.10.68.150;lr;ftag=as65bc91b0>
From: "CALLER" <sip:[email protected]>;tag=as65bc91b0
To: <sip:[email protected]:5060>;tag=as21618100
Call-ID: [email protected]
CSeq: 103 INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces
Contact: <sip:[email protected]:5060>
Content-Type: application/sdp
Content-Length: 298

v=0
o=root 1290589385 1290589385 IN IP4 217.116.117.70
s=sipgate VoIP GW
c=IN IP4 212.9.44.253
t=0 0
m=audio 15550 RTP/AVP 8 0 101
a=silenceSupp:off - - - -
a=rtpmap:8 PCMA/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
a=rtcp:15551
a=ptime:20
<------------->
--- (13 headers 14 lines) ---
Found RTP audio format 8
Found RTP audio format 0
Found RTP audio format 101
Found audio description format PCMA for ID 8
Found audio description format PCMU for ID 0
Found audio description format telephone-event for ID 101
Capabilities: us - (alaw|ulaw), peer - audio=(ulaw|alaw)/video=(nothing)/text=(nothing), combined - (alaw|ulaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event|), peer - 0x1 (telephone-event|), combined - 0x1 (telephone-event|)
       > 0x7f4634015640 -- Strict RTP learning after remote address set to: 212.9.44.253:15550
Peer audio RTP is at port 212.9.44.253:15550
sip_route_dump: route/path hop: <sip:217.10.68.150;lr;ftag=as65bc91b0>
sip_route_dump: route/path hop: <sip:172.20.40.8;lr>
set_destination: Parsing <sip:217.10.68.150;lr;ftag=as65bc91b0> for address/port to send to
set_destination: set destination to 217.10.68.150:5060
Transmitting (no NAT) to 217.10.68.150:5060:
ACK sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 127.0.1.1:5060;branch=z9hG4bK12463de5
Route: <sip:217.10.68.150;lr;ftag=as65bc91b0>,<sip:172.20.40.8;lr>
Max-Forwards: 70
From: "CALLER" <sip:[email protected]>;tag=as65bc91b0
To: <sip:[email protected]:5060>;tag=as21618100
Contact: <sip:[email protected]:5060>
Call-ID: [email protected]
CSeq: 103 ACK
User-Agent: Asterisk PBX 16.2.1~dfsg-1+deb10u1
Content-Length: 0


---
    -- SIP/sipconnect.sipgate.de-00000003 answered IAX2/iaxmodem-7708
    -- Channel SIP/sipconnect.sipgate.de-00000003 joined 'simple_bridge' basic-bridge <262f871a-8fc7-4bb9-a64b-981378a84acd>
    -- Channel IAX2/iaxmodem-7708 joined 'simple_bridge' basic-bridge <262f871a-8fc7-4bb9-a64b-981378a84acd>
       > 0x7f4634015640 -- Strict RTP switching to RTP target address 212.9.44.253:15550 as source

<--- SIP read from UDP:217.10.68.150:5060 --->

<------------->

<--- SIP read from UDP:217.10.68.150:5060 --->
BYE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 217.10.68.150;branch=z9hG4bKd711.674d11475dd9179e68c4eb52c2088642.0
Via: SIP/2.0/UDP 172.20.40.8;branch=z9hG4bKd711.39ae43c7fc3d82443eba26f3d75b5f39.0
Via: SIP/2.0/UDP 217.116.117.70:5060;branch=z9hG4bK5d2cbd05
Max-Forwards: 68
From: <sip:[email protected]:5060>;tag=as21618100
To: "CALLER" <sip:[email protected]>;tag=as65bc91b0
Call-ID: [email protected]
CSeq: 102 BYE
Reason: Q.850;cause=16
Content-Length: 0
X-hint: rr-enforced

<------------->
--- (12 headers 0 lines) ---
Sending to 217.10.68.150:5060 (no NAT)
Scheduling destruction of SIP dialog '[email protected]' in 6400 ms (Method: BYE)

<--- Transmitting (no NAT) to 217.10.68.150:5060 --->
SIP/2.0 200 OK
Via: SIP/2.0/UDP 217.10.68.150;branch=z9hG4bKd711.674d11475dd9179e68c4eb52c2088642.0;received=217.10.68.150
Via: SIP/2.0/UDP 172.20.40.8;branch=z9hG4bKd711.39ae43c7fc3d82443eba26f3d75b5f39.0
Via: SIP/2.0/UDP 217.116.117.70:5060;branch=z9hG4bK5d2cbd05
From: <sip:[email protected]:5060>;tag=as21618100
To: "CALLER" <sip:[email protected]>;tag=as65bc91b0
Call-ID: [email protected]
CSeq: 102 BYE
Server: Asterisk PBX 16.2.1~dfsg-1+deb10u1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


<------------>
    -- Channel SIP/sipconnect.sipgate.de-00000003 left 'simple_bridge' basic-bridge <262f871a-8fc7-4bb9-a64b-981378a84acd>
    -- Channel IAX2/iaxmodem-7708 left 'simple_bridge' basic-bridge <262f871a-8fc7-4bb9-a64b-981378a84acd>
  == Spawn extension (fax_out, RECIPIENT, 4) exited non-zero on 'IAX2/iaxmodem-7708'
    -- Hungup 'IAX2/iaxmodem-7708'
Really destroying SIP dialog '[email protected]' Method: BYE

In /var/spool/hylafax/log/xferfaxlog:

10/21/19 15:38  SEND    000000096       ttyIAX0 41      ""      [email protected]        "RECIPIENT"   ""      2220072 0       0:00:03 0:00:00 "No carrier detected"   ""      ""      ""      "root"  "00 00 00"

(I replaced the sender/recipient number and username here)

The Firewall isn't running currently:

root@asterisk:/etc/asterisk# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

This is my Asterisk configuration:

In /etc/asterisk/sip.conf:

[general]
context=unauthenticated
bindport=5060
bindaddr=0.0.0.0
realm=domain.tld
externhost=domain.tld:5060
localnet=127.0.0.0/255.255.255.0
nat=no
srvlookup=yes
allowguest=no
alwaysauthreject=yes

register => USER:[email protected]/USER
[sipconnect.sipgate.de]
type=peer
host=sipconnect.sipgate.de
outboundproxy=sipconnect.sipgate.de
port=5060
username=USER
defaultuser=USER
fromuser=USER
fromdomain=sipconnect.sipgate.de
secret=PASS
dtmfmode=rfc2833
insecure=port,invite
canreinvite=no
directmedia=no
registertimeout=600
sendrpid=pai
usereqphone=no
t38pt_udptl=no
disallow=all
allow=alaw
allow=ulaw
qualify=yes
context=unauthenticated

(I replaced credentials and domain name here)

In /etc/asterisk/extensions.conf:

[general]

[sipgate_in]
exten => sipgate_in,1,Goto(siptrunk,${CUT(CUT(SIP_HEADER(To),@,1),:,2)},1)

[siptrunk]
exten => 1234567,1,Dial(IAX2/iaxmodem)
exten => 1234567,n,Hangup

[fax_out]
exten => _X.,1,Set(CALLERID(num)=00491231234567)
exten => _X.,n,Set(CALLERID(name)=${CALLERID(num)})
exten => _X.,n,SipAddHeader(P-Preferred-Identity:<sip:${CALLERID(num)}>)
exten => _X.,n,Dial(SIP/sipconnect.sipgate.de/${EXTEN},,r)

[unauthenticated]

(I replaced the sender number here)

In /etc/asterisk/iax.conf:

[general]
bindport=4569
bindaddr=127.0.0.1
calltokenoptional=127.0.0.1/255.255.255.0

[iaxmodem]
port=4570
type=friend
host=dynamic
qualify=yes
secret=pwd
requirecalltoken=no
disallow=all
allow=alaw
jitterbuffer=no
trunk=no
context=fax_out

(I replaced credentials here)

In /etc/iaxmodem/ttyIAX0:

device     /dev/ttyIAX0
owner      uucp:uucp
mode       660
port       4570
refresh    60
server     127.0.0.1
peername   iaxmodem
secret     pwd
codec      alaw
nojitterbuffer

(I replaced credentials here)

The IAXModem ttyIAX0 did Register successfully, Asterisk is online at the sipgate trunk. Sending a fax from a known working setup to the recipient succeed. Previously I received some network protocol errors, but since I didn't activate the firewall during testing, these come from somewere any try to register as device etc...

At the recipient is a 3CX running that doesn't use T.38, so I disabled T.38 in my configuration too, just to be sure that T.38 is not the problem.

As I understand, the debug output says the target device hang up before the fax was sent. Do I see this right? Does anyone has any idea why the communication behaves like this? How can I get the reason for the early hanging up?

Update: I was able to send a fax to another target number now. Maybe I did everything right, but the 3CX fax makes a problem. But I'm still unsure about the debug protocol - does it look like it should in this case?

Update 2: T.38 fallback has been enabled at the target 3CX, now it receives fax from my Asterisk PBX. I don't know much about that 3CX configuration, what that "fallback" means - but, however, it works now. I'm still curious how I can get the reason for the early hangup - maybe it's not possible at all. I hope my configuration is now good for the real life...

4
  • 1
    Test with tcpdump port 5060 to see the network traffic for the port. If you see traffic in both directions, then indeed it is a Firewall issue. If you traffic only going from your server to sipgate, then you may check with them why they are not replying. Also, a SIP debug may give you some hint of what may be happening.
    – Jerdguez
    Commented Oct 17, 2019 at 15:41
  • @Jerdguez Thanks, it seems there are some people out who are scanning IPs and try to register as VoIP device at bad configured PBX and so on. I've updated my post with the debug output from the Asterisk console.
    – nd_
    Commented Oct 21, 2019 at 13:56
  • @nd_ This isn't related to your issue, but as far as people scanning IPs to brute force VoIP endpoints, you change your SIP bindport to take care of that. I changed my SIP bindport, and immediately the spamming stopped and has never resumed. Commented Oct 21, 2019 at 13:58
  • @InterLinked Thanks! I'll do that as soon as my simple setup is running once… Until that point I'd like to keep everything with standard settings, because that may make debugging more easy.
    – nd_
    Commented Oct 21, 2019 at 14:33

1 Answer 1

0

Now with the SIP debug, I see you have one way audio issue (RTP in your side sends your localhost IP). Try enabling nat=yes for this trunk sipconnect.sipgate.de. In the SIP debug, you should see your public IP being sent for RDP: c=IN IP4 127.0.1.1 should be: c=IN IP4 your.public.ip.address.

For your IP being attacked, instead of changing default port, I would recommend enabling the firewall and only allowing traffic to your SIP port only from sipconnect.sipgate.de (normally, providers give you a list or range of IPs).

3
  • When I add "net=yes" to the SIP trunk configuration in sip.conf, sending fax stop working at all :( But I think it shouldn't be required to set that option, since my Asterisk is connected to the Internet without a firewall router in between - as I understand that option is only required if Asterisk doesn't use a public IP and the internet gateway uses NAT routing!?
    – nd_
    Commented Oct 23, 2019 at 12:54
  • However - since the Asterisk is only used for outgoing fax, and no phone/fax device needs to be connected with SIP, I'll do as you recommended and configure the Firewall to open the required IP ranged only for the sipgate IP range. Thank you for the tip!
    – nd_
    Commented Oct 23, 2019 at 12:56
  • As you mention, Asterisk is binding to the public IP, so externhost=domain.tld:5060 and localnet=127.0.0.0/255.255.255.0 are not required as this is intended if you are NAT-ed. Try adding maybe directrtpsetup=no to the sipconnect.sipgate.de trunk for not sending the local IP address to sipgate. Always check with the SIP debug, your INVITE should send c=IN IP4 your.public.ip.address instead of c=IN IP4 127.0.1.1
    – Jerdguez
    Commented Oct 24, 2019 at 2:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .