Experimental VoIP Setup 1.10 2011-08-20
Changelog 1.9 -> 1.10:
Equipment: Phone: Firmware version 1.2.4.3 -> Firmware version 1.2.5.3
Router: Admin: Commands: Firewall: Line 3 ... Line 44: Lines added against nocturnal ringing attacks and more
Equipment:
ADSL Modem: D-Link DSL-320B, Annex A/L/M, Hardware version D1, Firmware version EU_1.21
Router: Linksys WRT54GL v1.1, Firmware version DD-WRT v24-presp2 (07/21/09) voip - build 12533
Bridge: Linksys WRT54GL v1.1, Firmware version DD-WRT v24-presp2 (10/10/09) mini - build 13064
Phone: Grandstream GXP2010, Hardware version 0.2B, Firmware version 1.2.5.3, Bootloader version 1.1.6.9
Radio: Terratec Noxon Internet Radio For Ipod, Firmware version 3.8.36.6921 (2009-05-08)
UPS: MGE Pulsar 1000 RT2U with Eaton NMC 66102, Card technical level 07, Firmware version GE
Configuration + Some Info:
Provider Web Page: Annex M: Enabled
Provider Web Page: Fastpath: Not enabled
ADSL: Mode: Bridge mode with 1483 bridged IP LLC as the connection type
ADSL: ATM Parameter: Virtual Path Identifier (VPI): 8
ADSL: ATM Parameter: Virtual Channel Identifier (VCI): 35
ADSL: ADSL Modem IP address: Fixed address 192.168.1.1 (a modem firmware bug does not allow to change that)
ADSL: ADSL Modem Subnet Mask: 255.255.255.0
ADSL: Advanced ADSL Settings: Modulation Type: Autosense
ADSL: Advanced ADSL Settings: Capability Bitswap Enable: Yes
ADSL: Advanced ADSL Settings: Capability SRA Enable: No
ADSL: Status Info: Downstream rate: 17757 Kbps (marginally varying)
ADSL: Status Info: Upstream rate: 2415 Kbps (marginally varying)
ADSL: Status Info: Downstream SNR: 9 dB (central office air-line distance 700 m)
ADSL: Status Info: Downstream Attenuation: 17 dB (central office air-line distance 700 m)
Router: WAN connection type: PPPoE
Router: WAN IP address type: Variable Public Class A Address
Router: WAN MTU: Manual 1492
Router: LAN IP address: Fixed address 10.xxx.yyy.15
Router: Running: Inadyn, DHCP, NTP, DNSMasq, SPI Firewall, QoS, HTTP, Cron
Router: DDNS: DDNS Service: DynDNS.org
Router: DDNS: User Name: <dyndnsUserName>
Router: DDNS: Password: <dyndnsPassWord>
Router: DDNS: Host Name: <dyndnsHostName>.dyndns.org
Router: DDNS: Type: Dynamic
Router: DDNS: Wildcard: <empty>
Router: DDNS: Force Update Interval: 10 days
Router: Setup: Advanced Routing: Operating Mode: Gateway
Router: Wireless: Basic Settings: Wireless Network Mode: Disabled
Router: Services: Services: DNSMasq: Enabled
Router: Services: Services: Local DNS: Disabled
Router: Milkfish: Main Switch: Disabled
Router: Security: Firewall: SPI Firewall: Enabled
Router: NAT/QoS: Port Forwarding: Line 1: PortFrom 5004 Proto UDP To 10.xxx.yyy.71 PortTo 5004
Router: NAT/QoS: Port Forwarding: Line 2: PortFrom 5060 Proto UDP To 10.xxx.yyy.71 PortTo 5060
Router: NAT/QoS: Port Forwarding: Line 3: PortFrom 5062 Proto UDP To 10.xxx.yyy.71 PortTo 5062
Router: NAT/QoS: Port Forwarding: Line 4: PortFrom 5064 Proto UDP To 10.xxx.yyy.71 PortTo 5064
Router: NAT/QoS: Port Forwarding: Line 5: PortFrom 5066 Proto UDP To 10.xxx.yyy.71 PortTo 5066
Router: NAT/QoS: Port Forwarding: Line 6: PortFrom 3478 Proto Both To 10.xxx.yyy.71 PortTo 3478
Router: NAT/QoS: UPnP: Off
Router: NAT/QoS: QoS: Start QoS: Enabled
Router: NAT/QoS: QoS: Port: WAN
Router: NAT/QoS: QoS: Packet Scheduler: HTB
Router: NAT/QoS: QoS: Uplink: 2000 kbps (in fact, this value does not reduce the upload rate)
Router: NAT/QoS: QoS: Downlink: 15000 kbps (in fact, this value does not reduce the download rate)
Router: NAT/QoS: QoS: Optimize for Gaming: Yes
Router: NAT/QoS: QoS: Service Priority ntp: Premium (currently important)
Router: NAT/QoS: QoS: Service Priority rtp: Premium (talks are possible, even under load)
Router: NAT/QoS: QoS: Service Priority sip: Express (phone remains registered, even under load)
Router: NAT/QoS: QoS: MAC Priority Grandstream GXP2010 Phone: Premium
Router: NAT/QoS: QoS: MAC Priority Terratec Noxon Internet Radio: Express
Router: NAT/QoS: QoS: Ethernet Port Priority Port1 ... Port4: Exempt, 100M
Router: Admin: Management: Router Management: Cron: Enabled
Router: Admin: Management: Router Management: Additional Cron Jobs: <empty>
Router: Admin: Management: Router Management: JFFS2: Disabled
Router: Admin: Management: Router Management: Overclocking: 216 MHz
Router: Admin: Keep Alive: Schedule Reboot: At a set Time: 03:17 Everyday
Router: Admin: Commands: Startup: <empty>
Router: Admin: Commands: Firewall: Line 1: ifconfig vlan1:0 192.168.1.15 netmask 255.255.255.0
Router: Admin: Commands: Firewall: Line 2: iptables -t nat -I POSTROUTING -o vlan1 -d 192.168.1.15/24 -j MASQUERADE
Router: Admin: Commands: Firewall: Line 3: iptables -t filter -I FORWARD -p tcp --dport 3478 -j DROP
Router: Admin: Commands: Firewall: Line 4: iptables -t filter -I FORWARD -p udp --dport 3478 -j DROP
Router: Admin: Commands: Firewall: Line 5: iptables -t filter -I FORWARD -p udp --dport 5066 -j DROP
Router: Admin: Commands: Firewall: Line 6: iptables -t filter -I FORWARD -p udp --dport 5064 -j DROP
Router: Admin: Commands: Firewall: Line 7: iptables -t filter -I FORWARD -p udp --dport 5062 -j DROP
Router: Admin: Commands: Firewall: Line 8: iptables -t filter -I FORWARD -p udp --dport 5060 -j DROP
Router: Admin: Commands: Firewall: Line 9: iptables -t filter -I FORWARD -p udp --dport 5004 -j DROP
Router: Admin: Commands: Firewall: Line 10: iptables -t filter -I FORWARD -p tcp --dport 3478 -j ACCEPT -s 193.47.84.0/24
Router: Admin: Commands: Firewall: Line 11: iptables -t filter -I FORWARD -p udp --dport 3478 -j ACCEPT -s 193.47.84.0/24
Router: Admin: Commands: Firewall: Line 12: iptables -t filter -I FORWARD -p udp --dport 5066 -j ACCEPT -s 193.47.84.0/24
Router: Admin: Commands: Firewall: Line 13: iptables -t filter -I FORWARD -p udp --dport 5064 -j ACCEPT -s 193.47.84.0/24
Router: Admin: Commands: Firewall: Line 14: iptables -t filter -I FORWARD -p udp --dport 5062 -j ACCEPT -s 193.47.84.0/24
Router: Admin: Commands: Firewall: Line 15: iptables -t filter -I FORWARD -p udp --dport 5060 -j ACCEPT -s 193.47.84.0/24
Router: Admin: Commands: Firewall: Line 16: iptables -t filter -I FORWARD -p udp --dport 5004 -j ACCEPT -s 193.47.84.0/24
Router: Admin: Commands: Firewall: Line 17: iptables -t filter -I FORWARD -p tcp --dport 3478 -j ACCEPT -s 217.74.179.0/24
Router: Admin: Commands: Firewall: Line 18: iptables -t filter -I FORWARD -p udp --dport 3478 -j ACCEPT -s 217.74.179.0/24
Router: Admin: Commands: Firewall: Line 19: iptables -t filter -I FORWARD -p udp --dport 5066 -j ACCEPT -s 217.74.179.0/24
Router: Admin: Commands: Firewall: Line 20: iptables -t filter -I FORWARD -p udp --dport 5064 -j ACCEPT -s 217.74.179.0/24
Router: Admin: Commands: Firewall: Line 21: iptables -t filter -I FORWARD -p udp --dport 5062 -j ACCEPT -s 217.74.179.0/24
Router: Admin: Commands: Firewall: Line 22: iptables -t filter -I FORWARD -p udp --dport 5060 -j ACCEPT -s 217.74.179.0/24
Router: Admin: Commands: Firewall: Line 23: iptables -t filter -I FORWARD -p udp --dport 5004 -j ACCEPT -s 217.74.179.0/24
Router: Admin: Commands: Firewall: Line 24: iptables -t filter -I FORWARD -p tcp --dport 3478 -j ACCEPT -s 217.10.79.0/24
Router: Admin: Commands: Firewall: Line 25: iptables -t filter -I FORWARD -p udp --dport 3478 -j ACCEPT -s 217.10.79.0/24
Router: Admin: Commands: Firewall: Line 26: iptables -t filter -I FORWARD -p udp --dport 5066 -j ACCEPT -s 217.10.79.0/24
Router: Admin: Commands: Firewall: Line 27: iptables -t filter -I FORWARD -p udp --dport 5064 -j ACCEPT -s 217.10.79.0/24
Router: Admin: Commands: Firewall: Line 28: iptables -t filter -I FORWARD -p udp --dport 5062 -j ACCEPT -s 217.10.79.0/24
Router: Admin: Commands: Firewall: Line 29: iptables -t filter -I FORWARD -p udp --dport 5060 -j ACCEPT -s 217.10.79.0/24
Router: Admin: Commands: Firewall: Line 30: iptables -t filter -I FORWARD -p udp --dport 5004 -j ACCEPT -s 217.10.79.0/24
Router: Admin: Commands: Firewall: Line 31: iptables -t filter -I FORWARD -p tcp --dport 3478 -j ACCEPT -s 217.10.68.0/24
Router: Admin: Commands: Firewall: Line 32: iptables -t filter -I FORWARD -p udp --dport 3478 -j ACCEPT -s 217.10.68.0/24
Router: Admin: Commands: Firewall: Line 33: iptables -t filter -I FORWARD -p udp --dport 5066 -j ACCEPT -s 217.10.68.0/24
Router: Admin: Commands: Firewall: Line 34: iptables -t filter -I FORWARD -p udp --dport 5064 -j ACCEPT -s 217.10.68.0/24
Router: Admin: Commands: Firewall: Line 35: iptables -t filter -I FORWARD -p udp --dport 5062 -j ACCEPT -s 217.10.68.0/24
Router: Admin: Commands: Firewall: Line 36: iptables -t filter -I FORWARD -p udp --dport 5060 -j ACCEPT -s 217.10.68.0/24
Router: Admin: Commands: Firewall: Line 37: iptables -t filter -I FORWARD -p udp --dport 5004 -j ACCEPT -s 217.10.68.0/24
Router: Admin: Commands: Firewall: Line 38: iptables -t filter -I FORWARD -p tcp --dport 3478 -j ACCEPT -s 10.xxx.yyy.0/24
Router: Admin: Commands: Firewall: Line 39: iptables -t filter -I FORWARD -p udp --dport 3478 -j ACCEPT -s 10.xxx.yyy.0/24
Router: Admin: Commands: Firewall: Line 40: iptables -t filter -I FORWARD -p udp --dport 5066 -j ACCEPT -s 10.xxx.yyy.0/24
Router: Admin: Commands: Firewall: Line 41: iptables -t filter -I FORWARD -p udp --dport 5064 -j ACCEPT -s 10.xxx.yyy.0/24
Router: Admin: Commands: Firewall: Line 42: iptables -t filter -I FORWARD -p udp --dport 5062 -j ACCEPT -s 10.xxx.yyy.0/24
Router: Admin: Commands: Firewall: Line 43: iptables -t filter -I FORWARD -p udp --dport 5060 -j ACCEPT -s 10.xxx.yyy.0/24
Router: Admin: Commands: Firewall: Line 44: iptables -t filter -I FORWARD -p udp --dport 5004 -j ACCEPT -s 10.xxx.yyy.0/24
Bridge: WAN connection type: Disabled
Bridge: LAN IP address: Fixed address 10.xxx.yyy.151
Bridge: Running: NTP, WLAN, QoS, HTTP, Cron
Bridge: DDNS: DDNS Service: Disabled
Bridge: Setup: Advanced Routing: Operating Mode: Router
Bridge: Setup: Advanced Routing: Dynamic Routing: Disabled
Bridge: Wireless: Basic Settings: Wireless Mode: AP
Bridge: Wireless: Basic Settings: Wireless Network Mode: G-Only
Bridge: Wireless: Basic Settings: Network Configuration: Bridged
Bridge: Wireless: Wireless Security: Security Mode: WPA2 Personal
Bridge: Wireless: Wireless Security: WPA Algorithms: AES
Bridge: Services: Services: DNSMasq: Disabled
Bridge: Milkfish: Main Switch: Disabled
Bridge: Security: Firewall: SPI Firewall: Disabled
Bridge: NAT/QoS: Static Port Forwarding: None
Bridge: NAT/QoS: UPnP: Off
Bridge: NAT/QoS: QoS: Start QoS: Enabled
Bridge: NAT/QoS: QoS: Port: LAN & WLAN
Bridge: NAT/QoS: QoS: Packet Scheduler: HTB
Bridge: NAT/QoS: QoS: Uplink: 11000 kbps
Bridge: NAT/QoS: QoS: Downlink: 11000 kbps
Bridge: NAT/QoS: QoS: Optimize for Gaming: Yes
Bridge: NAT/QoS: QoS: Service Priority ntp: Premium
Bridge: NAT/QoS: QoS: Service Priority rtp: Premium
Bridge: NAT/QoS: QoS: Service Priority sip: Express
Bridge: NAT/QoS: QoS: MAC Priority Grandstream GXP2010 Phone: Premium
Bridge: NAT/QoS: QoS: MAC Priority Terratec Noxon Internet Radio: Express
Bridge: NAT/QoS: QoS: Ethernet Port Priority Port1 ... Port4: Exempt, 100M
Bridge: Admin: Management: Router Management: Cron: Enabled
Bridge: Admin: Management: Router Management: Additional Cron Jobs: Line 1: 12 3 * * * root /jffs/usr/bin/DlinkDsl320bReboot
Bridge: Admin: Management: Router Management: Additional Cron Jobs: Line 2: 27 3 * * * root /jffs/usr/bin/GrandstreamGxp2010Reboot
Bridge: Admin: Management: Router Management: Additional Cron Jobs: Line 3: 32 3 * * * root /jffs/usr/bin/EatonNmc66102Reboot
Bridge: Admin: Management: Router Management: JFFS2: Enabled
Bridge: Admin: Management: Router Management: Clean JFFS2: Disabled
Bridge: Admin: Management: Router Management: Overclocking: 216 MHz
Bridge: Admin: Keep Alive: Schedule Reboot: At a set Time: 03:22 Everyday
Bridge: Admin: Commands: Startup: mount -o ro,remount /jffs
Bridge: Admin: Commands: Firewall: <empty>
Phone: Settings: IP address: Fixed address 10.xxx.yyy.71 (but via DHCP)
Phone: Settings: Time Zone: GMT+1:00
Phone: Settings: Daylight Savings Time Rule: 3,-1,7,2,0;10,-1,7,2,0;60 (proved)
Phone: Settings: Local RTP port: 5004
Phone: Settings: Keep-alive interval: 20 seconds
Phone: Settings: Use NAT IP: <empty>
Phone: Settings: STUN server: stun.bluesip.net:3478
Phone: Account 1: Account Active: Yes
Phone: Account 1: SIP Server: bluesip.net
Phone: Account 1: Outbound Proxy: <empty>
Phone: Account 1: SIP User ID: <nonnumericBluesipIdent>
Phone: Account 1: Authenticate ID: bluesip/<nonnumericBluesipIdent>
Phone: Account 1: Authenticate Password: <bluesipPassWord>
Phone: Account 1: Name: <givenNameSurName>
Phone: Account 1: Use DNS SRV: Yes
Phone: Account 1: SIP Registration: Yes
Phone: Account 1: Unregister On Reboot: Yes
Phone: Account 1: Register Expiration: 60 minutes
Phone: Account 1: Local SIP port: 5060
Phone: Account 1: SIP Registration Failure Retry Wait Time: 120 seconds (router reboot needs 70 seconds)
Phone: Account 1: NAT Traversal (STUN): Yes (detected NAT type is full cone)
Phone: Account 1: Send DTMF: via RTP (RFC2833)
Phone: Account 1: SRTP Mode: Disabled
Phone: Account 2: Account Active: Yes
Phone: Account 2: SIP Server: terrasip.net
Phone: Account 2: Outbound Proxy: <empty>
Phone: Account 2: SIP User ID: <numericTerrasipIdent>
Phone: Account 2: Authenticate ID: <numericTerrasipIdent>
Phone: Account 2: Authenticate Password: <terrasipPassWord>
Phone: Account 2: Name: <givenNameSurName>
Phone: Account 2: Use DNS SRV: Yes
Phone: Account 2: SIP Registration: Yes
Phone: Account 2: Unregister On Reboot: Yes
Phone: Account 2: Register Expiration: 60 minutes
Phone: Account 2: Local SIP port: 5062
Phone: Account 2: SIP Registration Failure Retry Wait Time: 120 seconds (router reboot needs 70 seconds)
Phone: Account 2: NAT Traversal (STUN): Yes (detected NAT type is full cone)
Phone: Account 2: Send DTMF: via RTP (RFC2833)
Phone: Account 2: SRTP Mode: Disabled
Phone: Account 3: Account Active: No
Phone: Account 4: Account Active: No
Timetable:
At 0312 hours: ADSL modem is rebooted by the bridge via cron script DlinkDsl320bReboot
At 0317 hours: Router reboots itself via Administration KeepAlive entry
At 0322 hours: Bridge reboots itself via Administration KeepAlive entry
At 0327 hours: Phone is rebooted by the bridge via cron script GrandstreamGxp2010Reboot
At 0332 hours: UPS NMC is conditionally rebooted by the bridge via cron script EatonNmc66102Reboot
For the scripts see also DdwrtControl and ResetAllMySmallSystems.
Observations:
1. The system behaves as expected at all times,
exhibiting outstanding reliability and performance.
Many thanks for the great work of all the parties concerned.
2. The WAN interface traffic shaping seems to work fine.
With more than 2000 kbps upstream rate via Annex M, the bandwidth is much higher
than the one required by the Premium/Express services running here such that the
traffic shaping algorithms are able to work perfectly.
With adequate values for the uplink and downlink rates of the WLAN bridge
the WLAN interface traffic shaping works fine, too.
With respect to this point, it seems to be very wise to have two separated systems for
WAN and WLAN when running Linux because there are two interfaces exhibiting bottleneck
behavior while the scheduler is obviously prepared to handle only one of that kind.
Two different systems with the right entries ensure that a radio representing
a streaming device is no longer interfered by activities whatsoever of WLAN-connected
notebooks. Here it should be noted that the radio is somewhat handicapped because of
its reception conditions. The power consumption of the two Linksys WRT54GL v1.1 devices
together is less than 5 watt, measured at the 12 volt line.
This is not a lot, but too much for a closed space. Hence, some cooling is performed.
3. With respect to the audio quality, the Grandstream GXP2010 is very good.
4. The problem of bad audio quality or malfunction from high router load by traffic of any
kind seems to be definitively solved. Up to the present, there is no practice-oriented
traffic scenario, significantly interfering the audible communication. Unscheduled router
or WLAN bridge reboots have never been seen again. The current structure of the experimental
setup looks as follows.
LAN
|||||||
+---------+ +---------+ +-+++++++-+ +---------+
| | | | | | | |
Line---| Modem +---+ Router +---+ Switch +---+ Bridge +---WLAN
| | | | | | | |
+---------+ +---------+ +----+----+ +---------+
|
+---------+ +----+----+
| | | |---
| Phone +---+ Switch |---LAN
| | | |---
+---------+ +---------+
WLAN WLAN WLAN WLAN
| | | |
+----+----+ +----+----+ +----+----+ +----+----+
| | | | | | | |
| PC | | PC | | PC | | Radio |
| | | | | | | |
+---------+ +---------+ +---------+ +---------+
5. If the communication partner runs Linphone on a notebook connected via UMTS 3G,
the overall communication quality varies between good and unserviceable, whereat
one gains the impression that the codecs PCMU and PCMA give better results then all
the others being available, when the packet loss rate is very high.
6. From the compatibility point of view, Terrasip represents an excellent SIP provider.
The Grandstream phone in debug mode yields strings as "TerraSIP Advanced Router 1.0.8"
and "X-Asterisk-HangupCauseCode" (2009-11-12). Terrasip takes the freedom to perform
maintenance periods of several hours, occasionally.
7. It is known that Bluesip is a reliable but somewhat delicate provider. In debug mode,
the Grandstream phone shows the string "Sip EXpress router (0.9.7 (i386/linux))" in
Bluesip-related SIP traffic (2009-11-22). Bluesip was so kind to perform some traces.
Next is a frame as it has been sent from the Milkfish proxy to Bluesip at a particular
time while the traffic has been recorded by Bluesip.
INVITE sip:{somePhoneNumber}@bluesip.net SIP/2.0
Record-Route: <sip:{routrWanAdr};r2=on;ftag={tag1};lr=on>
Record-Route: <sip:10.xxx.yyy.15;r2=on;ftag={tag1};lr=on>
Via: SIP/2.0/UDP {routrWanAdr};branch={branch1}
Via: SIP/2.0/UDP 10.xxx.yyy.71:{localSipPort};branch={branch2}
From: "Stephan Seidl" <sip:<nonnumericBluesipIdent>@bluesip.net>;tag={tag1}
To: <sip:{somePhoneNumber}@bluesip.net>
Contact: <sip:<nonnumericBluesipIdent>@{routrWanAdr}:5060;transport=udp>
...
v=0
o=<nonnumericBluesipIdent> 8000 8001 IN IP4 10.xxx.yyy.71
s=SIP Call
c=IN IP4 10.xxx.yyy.71
t=0 0
m=audio 5086 RTP/AVP 0 8 4 18 2 97 9 3 101
a=sendrecv
a=rtpmap:0 PCMU/8000
...
So, using STUN instead of Milkfish has three advantages.
a) Protocol violations as seen above, "IN IP4 10.xxx.yyy.71"
being the internal Grandstream IP address, are avoided
b) Milkfish blabs out details of the internal network structure as seen above
c) A Milkfish-based setup needs much more CPU power than a STUN-based setup
8. Some providers have problems to resolve ENUM entries, some not. Deutsche Telekom resolves,
for example, Bluesip ENUM entries of the form +4989... without any problem. In Germany, one
has to dial 089..., as usual. Vodafone, Arcor, and Bluesip behave similarly. Performing a
call to such an ENUM entry from Spain, operated by Telefónica de España, also works well
where one will, of course, always dial 004989... In this case the question is who manages
the call for Telefónica in Germany, i.e., who does its job par excellence with respect to
that topic. 1&1, O2 et cetera also resolve the Bluesip ENUM entries +4989... without
difficulty, whereat some providers need 004989... while others content themselves with 089...
On the other hand, Sipgate was a candidate which often failed to resolve the above ENUM
entries. In many cases, the first try was unsuccessful while a second or third one worked.
Sipgate seems to accept both, the 089... and the 004989... dial-in variants (2009-11-12).
The operator in Germany, working for the operator belonging to www.espantel.com, does not
perform queries at all to resolve an ENUM entry +4989... in Germany. And the current
operator in Germany, working for the operator Jazztel in Spain, exhibits some strange cache
behavior. Dialling a number belonging to an ENUM entry +4989... for the first time, or
dialling that number after some months again, the number appears to be busy. From the next
working day on, all works fine. After some weeks/month of inactivity the operator again needs
one night to make the service available, i.e., if one needs to have a talk from Spain to
somebody with an ENUM entry +4989..., it is a good idea dial the number already some days
before to be sure to have all in cache at the right time. So, it is seen that ENUM is still
a point, at least, if it is called from foreign countries.
TODO:
1. Currently nothing.
Sat, 20 Aug 2011 02:40:52 +0200
Stephan K.H. Seidl