[Resolved: Host name verification now required]404 registration failure while not using full server name for ProxyServer

[vostro]

freephoneline down again?

[Liptonbrisk]

I'm talking to someone using Freephoneline from a Freephoneline line right now (FPL to FPL call).

I am also looking at multiple registered Freephoneline accounts, and I just tested all three proxy servers for registration problems: voip.freephoneline.ca, voip2.freephoneline.ca, and voip4.freephoneline.ca:6060. I am able to register using all servers on multiple Freephoneline accounts.

If you require help, please provide the requested information from viewtopic.php?t=20199.

That is,

1) What brand and model modem are you using?

2) What brand and model router are you using?

3) What brand and model ATA are you using?

4) What proxy server is your ATA using (for example, voip.freephoneline.ca, voip2.freephoneline.ca, or voip4.freephoneline.ca:6060)?

5) What is the registration status in your ATA and also "SIP status" after logging in at https://www.freephoneline.ca/showSipSettings ?

a) Dial ***1. Enter the IP address you hear into a web browser. Login. Default username and password are “admin” without the quotation marks. Navigate to Status-->System Status-->SP used for FPL Service Status-->Status. What does registration status indicate?

b) Login at https://www.freephoneline.ca/showSipSettings

Please note that if "SIP User Agent" reflects a different device than the one you're using, someone else is likely using your Freephoneline VoIP unlock key. Only one registration is permitted at any time per Freephoneline VoIP unlock key. Registration is a requirement for incoming calls but not for outgoing calls.

6) If applicable, please also login at https://www.freephoneline.ca/callLogs and provide the date and time of the failed call and, especially, the "Disconnect reason". Check and confirm that the "To" and "From" fields represent numbers you expect.

7) Similarly (with respect to #6), if your ATA or IP Phone has call logs, please check your call log history to see whether any useful information, such as a 3 digit SIP error code is listed. If so, please provide that information. Dial ***1. Enter the IP address you hear into a web browser. Login. Default username and password are “admin” without the quotation marks. Navigate to Status-->Call History

8) If you hear an error message on outbound calls, especially a 3 digit SIP error code, please provide it.

9) This is always proper device reboot order:

A.Turn off modem, router and ATA (or IP Phone or close SIP App).

B. Turn on modem. Wait for modem to be fully up and running.

C.Turn on router.
Wait for modem to be fully up and transmitting data before turning on router.

D. Turn on ATA (or IP Phone or open SIP app) only after the router is fully up and running.

The SIP device (ATA, IP Phone, or SIP app) should be the last device powered on in the device chain.


Also, if you're experiencing incoming call problems refer to viewtopic.php?t=20534 for your Obihai ATA. Follow the steps, step by step, down the list.

[vostro]

thanks a lot for the info, i noticed one line from FPL could dial out but can't receive call, the other FPL line can't dial out and dial in with 404 error. can't figure out the reason.

[Liptonbrisk]

If you require help, please provide the requested information from viewtopic.php?t=20199.

That is,
(I don't necessarily trust user profiles to have updated information anymore)

1) What brand and model modem are you using?

2) What brand and model router are you using?

3) What brand and model ATA are you using?

4) What proxy server is your ATA using (for example, voip.freephoneline.ca, voip2.freephoneline.ca, or voip4.freephoneline.ca:6060)?

5) What is the registration status in your ATA and also "SIP status" after logging in at https://www.freephoneline.ca/showSipSettings ?

a) Dial ***1. Enter the IP address you hear into a web browser. Login. Default username and password are “admin” without the quotation marks. Navigate to Status-->System Status-->SP used for FPL Service Status-->Status. What does registration status indicate?

b) Login at https://www.freephoneline.ca/showSipSettings

Please note that if "SIP User Agent" reflects a different device than the one you're using, someone else is likely using your Freephoneline VoIP unlock key. Only one registration is permitted at any time per Freephoneline VoIP unlock key. Registration is a requirement for incoming calls but not for outgoing calls.

6) If applicable, please also login at https://www.freephoneline.ca/callLogs and provide the date and time of the failed call and, especially, the "Disconnect reason". Check and confirm that the "To" and "From" fields represent numbers you expect.

7) Similarly (with respect to #6), if your ATA or IP Phone has call logs, please check your call log history to see whether any useful information, such as a 3 digit SIP error code is listed. If so, please provide that information. Dial ***1. Enter the IP address you hear into a web browser. Login. Default username and password are “admin” without the quotation marks. Navigate to Status-->Call History

8) If you hear an error message on outbound calls, especially a 3 digit SIP error code, please provide it.

9) This is always proper device reboot order:

A.Turn off modem, router and ATA (or IP Phone or close SIP App).

B. Turn on modem. Wait for modem to be fully up and running.

C.Turn on router.
Wait for modem to be fully up and transmitting data before turning on router.

D. Turn on ATA (or IP Phone or open SIP app) only after the router is fully up and running.

The SIP device (ATA, IP Phone, or SIP app) should be the last device powered on in the device chain.


Also, if you're experiencing incoming call problems refer to viewtopic.php?t=20534 for your Obihai ATA. Follow the steps, step by step, down the list.

[Liptonbrisk]

thanks a lot for the info, i noticed one line from FPL could dial out but can't receive call

Then use one of the three stickied threads that applies to the respective SIP device being used.
If you're using an Obihai ATA or IP phone, for example, use viewtopic.php?t=20534 (follow the steps, step by step, down the list).

the other FPL line can't dial out and dial in with 404 error. can't figure out the reason.

I need the requested information, especially registration status after logging in at https://www.freephoneline.ca/showSipSettings. If the ATA isn't registered, again use one of the respective stickied threads. Also check to ensure the account isn't blocked (and that the 911 monthly fee has been paid): viewtopic.php?t=20537.

I've checked four Freephoneline accounts, and they're all registering and working normally. Testing more accounts doesn't seem worthwhile.

[vostro]

thanks a million for the help. i use two obi202 for two lines of FPL which i paid 911 fees every month and never skip. one of line got cut off this morning while in chat and the other line can dial out but after power off and on both can't dial out and dial in. i use following DNS proxy settings separately and works fine for past years.

freephoneline.ca={voip2.freephoneline.ca:5060,1},{voip4.freephoneline.ca:6060,2}

freephoneline.ca={voip.freephoneline.ca:5060,1},{voip2.freephoneline.ca:5060,2},{voip4.freephoneline.ca:6060,3}

nothing has changed recently in my side both for router and cable model(rogers 2G download speed for condo package). i connect these 202 directly to rogers cable model with router function enabled. now both get 404 in modem error message and as i just cancelled my VDSL service so i can't try in VDSL modem.ping to voip1, voip2, voip4.freephoneline.ca is all normal.

one of modem status is as follows (deleted user name and password):
SIP Status: disconnected
SIP User Agent:
Your SIP Settings
SIP Username:
SIP Password:
Inbound/Outbound Proxy: voip.freephoneline.ca
Local SIP Port: RANDOM
Local RTP Port: RANDOM
Registration Expires: 3600
Enabled Codecs: G711u/PCMU and G729a ONLY
Use Preferred Codec: G711u/PCMU or G729a
Use Preferred Codec Only: No
RTP Packet Size: 0.020
Ring Tone Frequency: 52
Ring Tone Voltage: 90
Recommended Linksys Dial String: (911|[2-9]xxxxxxxxx|1xxxxxxxxxx|011xxxxxxxxxxxx.|*98|[6-7]x*xxxxxxxxxxx.)
(please note that this is a Linksys dial string we use for our devices and may not work with third party, non-Linksys/Sipura devices)

in FPL website my setting page is as follows:

VoIP Service
checked Registered
My freephoneline number is: (416) xxx-xxxx
Visit Online Store
Update Payment Information

i can't think any other reason except FPL server side or third party user data server failure like last time two weeks ago. what else missing here? many thanks indeed.

[Liptonbrisk]

freephoneline.ca={voip2.freephoneline.ca:5060,1},{voip4.freephoneline.ca:6060,2}

i. Steps 7 and 24 are important. NAT corruption can develop between a router and ATA without the user doing anything: refer to point D from viewtopic.php?p=78976#p78976.

ii. You can also be temporarily IP banned for making too many registration attempts within a short interval, in which case changing the proxy server used will work.

iii. Account bans may occur, but you wouldn't be able to make outbound calls. I would expect a 403 error instead of 404.

iv. ATAs that bootup using the failover config you're using may fail if the ATA boots up before the router. The ATA will then attempt to register on freephoneline.ca, which won't work.

Dial ***1. Enter the IP address you hear into a web browser. Login. Default username and password are “admin” without the quotation marks.

1. Change this to voip2.freephoneline.ca={voip2.freephoneline.ca:5060,1},{voip4.freephoneline.ca:6060,2},{voip.freephoneline.ca:5060,3}
2. Click "Submit"
3. Navigate to Service Providers-->ITSP Profile (used for Freephoneline)-->SIP
4. Change ProxyServer to voip2.freephoneline.ca

Do steps 1 to 4 to ensure that even if the ata boots up before the modem and router, it will attempt to register on voip2.freephoneline.ca:5060 and not with freephoneline.ca (I've seen that happen before), which obviously won't work.

5. Change ProxyServerPort to 5060
6. Submit settings
7. Navigate to Voice Services-->SP used for FPL Service-->X_UserAgentPort

a) X_UserAgentPort should be a random UDP port number between 30000 and 60000. Just pick a port number in that range.
If you already have a random number in that range, simply enter a new one in that range.
By using a high random port you help to thwart SIP scanners/hackers.

Do not use the same X_UserAgentPort for any other SP. Pick a different X_UserAgentPort in the same range for other SPs.

Never use UDP 5060 for X_UserAgentPort.

Also, this step can help to resolve a corrupted NAT association that may have developed between the router and the ATA.

8. Navigate to Service Providers-->ITSP Profile used for FPL-->SIP->

Ensure RegistrationPeriod is 3600 seconds.

9. Ensure RegisterRetryInterval is 120 seconds.

10. Ensure X_DiscoverPublicAddress is enabled (it is by default)

11. Enable/check X_ProxyServerRedundancy

12 . Enable X_UsePublicAddressInVia (you will have to uncheck default box).

This sends your public IP address (as determined by your Obihai device) in the VIA header that’s sent to Freephoneline’s server. This helps to ensure data is sent back to your public IP address as opposed to
your LAN IP address (192.100.1.x, for example). If Freephoneline were to send data to 192.100.1.x, it would never reach you. It needs to be sent to your WAN or public IP address first before your router can
send or route the data to the local IP address of your Obihai device.

Enabling this setting helps to ensure one-way audio issues don't occur.

13. Set X_CheckPrimaryFallbackInterval to 7200 seconds (you will have to uncheck the default box)

"Interval in seconds at which the device should check the primary fallback list of candidate servers."

This setting makes your Obihai device check every 2 hours to see whether the primary server can be used to register successfully.
If you've been temporarily IP banned by a specific proxy server, then 7200 seconds should be enough time for the ban to clear. In the past, Fongo Support instructed to turn off devices for 2 hours when that happened.

14. Click "Submit"

15. Navigate to Voice Services-->SP used for FPL

i) X_KeepAliveEnable should be Checked/enabled
ii) X_KeepAliveExpires should be 20 seconds
iii) X_KeepAliveMsgType should be "notify" (OBi1xx series doesn't have the option to set a custom message here, I think)

submit/save settings

16. A.Turn off modem, router and ATA (or IP Phone or close SIP App).

B. Turn on modem. Wait for modem to be fully up and running.

C.Turn on router.
Wait for modem to be fully up and transmitting data before turning on router.

D. Turn on ATA (or IP Phone or open SIP app) only after the router is fully up and running.

The SIP device (ATA, IP Phone, or SIP app) should be the last device powered on in the device chain.

17. Login to the ATA. Navigate to Status-->System Status-->SP used for FPL Service Status-->Status.
a. What does System status show?

freephoneline.ca={voip.freephoneline.ca:5060,2},{voip2.freephoneline.ca:5060,3},{voip4.freephoneline.ca:6060,1}

Okay, do you own 2 VoIP unlock keys? If not, then you can expect problems, especially when attempting to register using the same proxy server on both ATAs using the same Freephoneline credentials.

18. Change this to voip4.freephoneline.ca={voip.freephoneline.ca:5060,2},{voip2.freephoneline.ca:5060,3},{voip4.freephoneline.ca:6060,1}
19. Click "Submit"
20. Navigate to Service Providers-->ITSP Profile (used for Freephoneline)-->SIP
21. Change ProxyServer to voip4.freephoneline.ca

Do steps 11 to 14 to ensure that even if the ata boots up before the modem and router, it will attempt to register on voip4.freephoneline.ca:6060 and not with freephoneline.ca (I've seen that happen before), which obviously won't work.

I also want to use voip4.freephoneline.ca:6060 to help avoid potential SIP ALG issues.

22. Change ProxyServerPort to 6060
23. Submit settings
24. Navigate to Voice Services-->SP used for FPL Service-->_UserAgentPort

a) X_UserAgentPort should be a random UDP port number between 30000 and 60000. Just pick a port number in that range.
If you already have a random number in that range, simply enter a new one in that range. Use a different number than the one you chose in step 7a.

By using a high random port you help to thwart SIP scanners/hackers.

Also, this step can help to resolve a corrupted NAT association that may have developed between the router and the ATA.

Do not use the same X_UserAgentPort for any other SP. Pick a different X_UserAgentPort in the same range for other SPs.

Never use UDP 5060 for X_UserAgentPort.

25. Navigate to Service Providers-->ITSP Profile used for FPL-->SIP->

Ensure RegistrationPeriod is 3600 seconds.

26. Ensure RegisterRetryInterval is 120 seconds.

27. Ensure X_DiscoverPublicAddress is enabled (it is by default)

28. Enable/check X_ProxyServerRedundancy

29 . Enable X_UsePublicAddressInVia

This sends your public IP address (as determined by your Obihai device) in the VIA header that’s sent to Freephoneline’s server. This helps to ensure data is sent back to your public IP address as opposed to
your LAN IP address (192.100.1.x, for example). If Freephoneline were to send data to 192.100.1.x, it would never reach you. It needs to be sent to your WAN or public IP address first before your router can send or route the data to the local IP address of your Obihai device.

Enabling this setting helps to ensure one-way audio issues don't occur.

30. Set X_CheckPrimaryFallbackInterval to 7200 seconds (you will have to uncheck the default box)

"Interval in seconds at which the device should check the primary fallback list of candidate servers."

This setting makes your Obihai device check every 2 hours to see whether the primary server can be used to register successfully. If you've been temporarily IP banned by a specific proxy server, then 7200 seconds should be enough time for the ban to clear. In the past, Fongo Support instructed to turn off devices for 2 hours when that happened.

31. Click "Submit"

32. Navigate to Voice Services-->SP used for FPL

i) X_KeepAliveEnable should be Checked/enabled
ii) X_KeepAliveExpires should be 20 seconds
iii) X_KeepAliveMsgType should be "notify" (OBi1xx series doesn't have the option to set a custom message here, I think)

submit/save settings



33. Click "Submit"

34. A.Turn off modem, router and ATA (or IP Phone or close SIP App).

B. Turn on modem. Wait for modem to be fully up and running.

C.Turn on router.
Wait for modem to be fully up and transmitting data before turning on router.

D. Turn on ATA (or IP Phone or open SIP app) only after the router is fully up and running.

The SIP device (ATA, IP Phone, or SIP app) should be the last device powered on in the device chain.

35. Login to the ATA. Navigate to Status-->System Status-->SP used for FPL Service Status-->Status.
a. What does System status indicate? I want to know if you see an error message here. If so, what is it?

rogers 2G download speed for condo package

Contact Rogers to see if it's possible to disable SIP ALG in your modem/router combo.

one of modem status is as follows (deleted user name and password):
SIP Status: disconnected
SIP User Agent:

You're not registered. Login to the ATA. Navigate to Status-->System Status-->SP used for FPL Service Status-->Status.
What does System status show?

Your SIP Settings

Inbound/Outbound Proxy: voip.freephoneline.ca
Local SIP Port: RANDOM
Local RTP Port: RANDOM
Registration Expires: 3600
Enabled Codecs: G711u/PCMU and G729a ONLY
Use Preferred Codec: G711u/PCMU or G729a
Use Preferred Codec Only: No
RTP Packet Size: 0.020
Ring Tone Frequency: 52
Ring Tone Voltage: 90
Recommended Linksys Dial String: (911|[2-9]xxxxxxxxx|1xxxxxxxxxx|011xxxxxxxxxxxx.|*98|[6-7]x*xxxxxxxxxxx.)
(please note that this is a Linksys dial string we use for our devices and may not work with third party, non-Linksys/Sipura devices)

Click viewtopic.php?t=20549. Those aren't settings in your ATA.

in FPL website my setting page is as follows:

VoIP Service
checked Registered
My freephoneline number is: (416) xxx-xxxx
Visit Online Store
Update Payment Information

That also doesn't matter, but if you're able to log in without seeing any error message, I doubt it's an unpaid 911 fee problem.

[Liptonbrisk]

If, after following those steps carefully (especially steps 7 and 24 from viewtopic.php?p=82318#p82318), you still have problems, I really need to see the system statuses in the ATAs (steps 17 and 35). Copy and paste them.

I may also need to see a syslog capture from the time you turn on the ATA, when it attempts to register, and when you try to make a call.
See here: viewtopic.php?p=80667#p80667


You can be temporarily IP banned due to attempting to register too many times withing a short interval.

"As May 2013, our servers will rate limit REGISTER requests to a maximum of 10 requests per 5 minutes. Each authentication round usually consumes 2 requests (digest auth), so it is a fair number given our guidelines."
https://community.freepbx.org/t/trunk-s ... ca/22479/8

If that rate limit has changed since then, I'm not aware. I've encountered being temporarily IP banned before by a server a long time ago. It's annoying, and I'm not going to try to reproduce it by testing.

Being temporarily banned can occur when using registration timers with short intervals with Freephoneline.

3600 Expiry is enforced. I doubt that's the problem. Using less than a 120 second failed retry interval can cause problems. Constantly rebooting the ATA (register attempts over and over and over again) can cause problems.


If you're unwilling to provide that information or follow the steps listed, you can submit a ticket to see whether your Freephoneline has been blocked for some reason: https://support.fongo.com/hc/requests/new.
Choose "My Account Inquiry" for the final issue type.
If you hear, "My Account is Blocked" on outbound calls, then choose "Freephoneline-->My Account is Blocked" for the final issue type.

You can check your ticket status by logging in at https://support.fongo.com/hc/requests. That's an account for tickets (zendesk) only and is completely separate from your Freephoneline account. Use the same email address that you use to submit tickets. Do not use the same password as your Freephoneline account. Again, Zendesk support accounts and Freephoneline accounts are separate.

Support staff does not respond to tickets on weekends or holidays. Support hours are 9 a.m. until 4 p.m. EST.

[vostro]

here is SP status from obhi202:

Parameter Name Value
Status Register Failed: 404 Not Found (server=162.213.111.25:5060; retry in 29s) help
PrimaryProxyServer [0]Retry 162.213.111.25:5060 in 29s
SecondaryProxyServer Secondary Registration Not Enabled
CallState 0 Active Calls

[Liptonbrisk]

Status Register Failed: 404 Not Found (server=162.213.111.25:5060; retry in 29s)

162.213.111.25:5060 is voip.freephoneline.ca:5060, which if you followed my instructions from viewtopic.php?p=82318#p82318, your ATA shouldn't be attempting to register on.

Please follow the instructions I provided carefully. If the same 404 error occurs afterwards, submit a ticket because it appears that the server has checked and determined your specific SIP user ID (AuthUsername) provided by your ATA does not exist in Freephoneline's records.

Ensure AuthUsername (especially) and AuthPassword are entered correctly in your ATA (not filled out by some password form filler). Make sure not to copy and paste blank spaces, accidentally, or make typos (ex. i vs Ice, 0 vs O, i vs like), Login to the ATA. Navigate to Voice Services-->SP Service used for FPL-->SIP Credentials, Then login at https://www.freephoneline.ca/showSipSettings to find SIP Username and SIP Password. SIP Username is AuthUsername. SIP Password is AuthPassword.

Submit a ticket: https://support.fongo.com/hc/requests/new.
Choose "My Account Inquiry" for the final issue type. Tell them you're getting 404 when trying to register, provide the server IP address (or the proxy server name), and provide your Freephoneline number in the ticket.

You can check your ticket status by logging in at https://support.fongo.com/hc/requests. That's an account for tickets (zendesk) only and is completely separate from your Freephoneline account. Use the same email address that you use to submit tickets. Do not use the same password as your Freephoneline account. Again, Zendesk support accounts and Freephoneline accounts are separate.

Afterwards, let me know what the ticket number is via private message: click ucp.php?i=pm&mode=compose&u=1229

[vostro]

now i made the changes according to your rules, status change to this:
Parameter Name Value
Status Register Failed: 404 Not Found (server=162.213.111.22:5060; retry in 45s) help
PrimaryProxyServer [0]Retry 162.213.111.22:5060 in 45s
SecondaryProxyServer Secondary Registration Not Enabled
CallState 0 Active Calls

[Liptonbrisk]

Status Register Failed: 404 Not Found (server=162.213.111.22:5060; retry in 45s)

Uh oh. That's voip2.freephoneline.ca. It appears that the server has checked and determined your specific SIP user ID (AuthUsername) provided by your ATA does not exist in Freephoneline/Fongo's records. I would submit a ticket after making sure AuthUsername is entered correctly in the ATA.

Ensure AuthUsername (especially) and AuthPassword are entered correctly in your ATA (not automatically filled out by some password manager). Make sure not to copy and paste blank spaces, accidentally, or make typos (ex. i vs Ice, 0 vs O, i vs like), Login to the ATA. Navigate to Voice Services-->SP Service used for FPL-->SIP Credentials, Then login at https://www.freephoneline.ca/showSipSettings to find SIP Username and SIP Password. SIP Username is AuthUsername. SIP Password is AuthPassword.

Submit a ticket: https://support.fongo.com/hc/requests/new.
Choose "My Account Inquiry" for the final issue type. Tell them you're getting 404 when trying to register, and provide your Freephoneline number in the ticket.

You can check your ticket status by logging in at https://support.fongo.com/hc/requests. That's an account for tickets (zendesk) only and is completely separate from your Freephoneline account. Use the same email address that you use to submit tickets. Do not use the same password as your Freephoneline account. Again, Zendesk support accounts and Freephoneline accounts are separate. If you don't have an Zendesk account, click "sign up" after visiting the link.

Afterwards, let me know what the ticket number is via private message: click ucp.php?i=pm&mode=compose&u=1229.

[Liptonbrisk]

Okay, I got the ticket number. I'll try to contact someone. I can't promise that my trying to contact anyone will help though.

[Liptonbrisk]

While we're waiting for a response, please do the following, step by step, down the list:

1. Absolutely double check to ensure the AuthUsername in the ATA is entered properly. Do not copy and paste extra empty spaces before 1 and after the last digit.

2. You appear to have another ATA on your local network (LAN). Unplug it for the moment.

3. Login to OBi202 ATA with the 404 registration error. Navigate to System Management–>WAN Settings-->Local DNS Records

a) Use voip4.freephoneline.ca={voip.freephoneline.ca:5060,2},{voip2.freephoneline.ca:5060,3},{voip4.freephoneline.ca:6060,1}

4. Click "Submit" button

5. Navigate to Service Providers-->ITSP Profile (used for Freephoneline)-->SIP

6. Change ProxyServer to voip4.freephoneline.ca

Do steps 3 to 8 to ensure that even if the ATA boots up before the Rogers modem/router combo, the ATA will attempt to register on voip4.freephoneline.ca:6060 and not with freephoneline.ca (I've seen that happen before), which obviously won't work.

I also want to test using voip4.freephoneline.ca:6060 to help avoid potential SIP ALG issues.

7. Change ProxyServerPort to 6060

8. Click "submit" button.

9. Navigate to Voice Services-->SP used for FPL Service-->X_UserAgentPort

a) X_UserAgentPort should be a random UDP port number between 30000 and 60000. Example: 33331. Just pick a port number in that range.
If you already have a random number in that range, simply enter a new one in that range.
By using a high random port you help to thwart SIP scanners/hackers.

Do not use the same X_UserAgentPort for any other SP. Pick a different X_UserAgentPort in the same range for other SPs.

Never use UDP 5060 for X_UserAgentPort.

Also, this step can help to resolve a corrupted NAT association that may have developed between the router and the ATA.

10. Click "submit" button.

11. Navigate to Service Providers-->ITSP Profile used for FPL-->SIP->

Enable X_UsePublicAddressInVia (you will have to uncheck default box).

12. Click the "submit button".

13. A.Turn off Rogers modem/router combo and all ATAs.

B. Turn on Rogers modem/router combo. Wait for it to be fully up and running.

C. Turn on ATA (or IP Phone or open SIP app) only after the router is fully up and running.

The ATA should be the last device powered on in the device chain.

14. Now check registration/system status in the ATA again. Copy and paste it here.

15. You can plug in the other ATA again.

[Liptonbrisk]

Well, I heard back. The good news is I don't believe your SIP account was deleted.

1. The bad news is that I need a syslog capturing the registration attempt: visit viewtopic.php?p=80667#p80667 for instructions. After you have that up and running, reboot the ATA and capture a registration attempt. If you need help with the instructions, let me know. "I would have the customer check that their from and to during the registration has the host name and not the IP address." So, I need a syslog.

"Porta [the switch/server vendor] recommended to Fibernetics [CLEC/network used by Fongo/Freephoneline] to enable Host Name Verification on Sip Registrations. This was enabled. Marketing sent an email out last month to notify anyone who was IP registered to change to host name on their sip registration."

So you can't use 162.213.111.21:6060 in the registration attempt. It needs to be voip4.freephoneline.ca for ProxyServer, with ProxyServerPort being 6060 in this example. I'm pretty sure you are doing that, but I need to verify with a syslog. For proxyserver, do not enter an IP address.

Host name is voip4.freephoneline.ca. IP is 162.213.111.21. Don't enter IP addresses in the ATA.

Navigate to Service Providers-->ITSP Profile used for FPL-->SIP->Enable X_UsePublicAddressInVia

I'm told, "There are currently approximately 2500 OBIHAI devices successfully registered through the proxies to Porta on FPL."


This is an example of a problem where guidelines aren't followed:

"From: “Name REDACTED" <sip:1450XXXXXXX@192.168.0.124>

To: <sip:1450XXXXXXX@192.168.0.124>"

That might be a SIP ALG problem. Someone's private LAN IP is replacing the proxy server name.

2. Contact Rogers. Get them to disable SIP ALG in your modem/router combo if possible. Otherwise, provide me with both the brand and model number, and I can take a look. However, Rogers should be to the one to pursue this.

3. Login to OBi202 ATA with the 404 registration error. Navigate to System Management–>WAN Settings-->Local DNS Records

a) Use voip4.freephoneline.ca={voip.freephoneline.ca:5060,2},{voip2.freephoneline.ca:5060,3},{voip4.freephoneline.ca:6060,1}

4. Click "Submit" button

5. Navigate to Service Providers-->ITSP Profile (used for Freephoneline)-->SIP

6. Change ProxyServer to voip4.freephoneline.ca

7. Change ProxyServerPort to 6060

8. Click "submit" button.

9. Navigate to Voice Services-->SP used for FPL Service-->X_UserAgentPort

a) X_UserAgentPort should be a random UDP port number between 30000 and 60000. Example: 33331. Just pick a port number in that range.
If you already have a random number in that range, simply enter a new one in that range.
By using a high random port you help to thwart SIP scanners/hackers.

Do not use the same X_UserAgentPort for any other SP. Pick a different X_UserAgentPort in the same range for other SPs.

Never use UDP 5060 for X_UserAgentPort.

Also, this step can help to resolve a corrupted NAT association that may have developed between the router and the ATA.

10. Click "submit" button.

11. Navigate to Service Providers-->ITSP Profile used for FPL-->SIP->

Enable X_UsePublicAddressInVia (you will have to uncheck default box).

12. Click the "submit button".

13. A.Turn off Rogers modem/router combo and all ATAs.

B. Turn on Rogers modem/router combo. Wait for it to be fully up and running.

C. Turn on ATA (or IP Phone or open SIP app) only after the router is fully up and running.

The ATA should be the last device powered on in the device chain.

14. Now check registration/system status in the ATA again. Copy and paste it here.

Please follow these steps. If you're not willing to try them, that's your choice, but then I can't assist further.

[Liptonbrisk]

15. Also, to absolutely ensure the Rogers modem/router combo isn't the culprit, enable bridge mode: https://www.rogers.com/support/internet ... -fi-router

Attach the OBi device directly to the ISP's (gateway or hub in bridge mode) modem via ethernet cable. If the ATA registers, test briefly for incoming calls. If incoming calls suddenly start working properly, you've narrowed down the problem to something involving Roger's modem/router combo. Keep in mind your Obihai device will not be protected by your (Rogers) router's firewall during this step. After testing, revert back; that is, ensure your Obihai device is protected by a firewall again. Contact Rogers if you need help enabling or disabling bridge mode.

Test quickly because bridge mode is a security risk if you're not also using your own separate router.

[Liptonbrisk]

hi, thank a trillion for the detailed guide especially for the port setting. now it’s working again even without reboot rogers cable modem. it’s indeed strange that i never change any parameters in past years but it’s working quite well. i called in rogers tech support earlier to ask if they block any port for third party voip and was told they never block any port. i did remember when i have both VDSL and rogers cable, if voip got any issue in rogers modem, when i change voip modem directly connect to VDSL modem, the problem solved. it seems to indicate some time in rogers modem only port 6060 is working.

Hi,

Okay, that's progress. Rogers doesn't block SIP ports, but some of their modem/router combos (Rogers calls them gateways) sometimes have SIP ALG turned on with no way for the user to disable it. SIP ALG can cause horrible problems: see point B from viewtopic.php?p=78976#p78976.

If you can't disable SIP ALG and have registration issues, then you're supposed to try voip4.freephoneline.ca:6060.

now, how to change setting on second obi202? same as this one except 33331 port into 33332 for instance?

Since you're using Rogers, I would do the exact same steps as before--except use a different X_UserAgentPort. That is, use voip4.freephoneline.ca:6060, and, yes, X_UserAgentPort should be a random UDP port number between 30000 and 60000 that is not the same one that you used in the other ATA. 33332 works as does 53212 (or whatever you want, so long as it's not 33331, if that's what you used in the other ATA).

You need to own 2 VoIP unlock keys.

1. Login to the other OBi202 ATA.

2.Navigate to System Management–>WAN Settings-->Local DNS Records

a) Use voip4.freephoneline.ca={voip.freephoneline.ca:5060,2},{voip2.freephoneline.ca:5060,3},{voip4.freephoneline.ca:6060,1}

3. Click "Submit" button

4. Navigate to Service Providers-->ITSP Profile (used for Freephoneline)-->SIP

5. Change ProxyServer to voip4.freephoneline.ca

6. Change ProxyServerPort to 6060

7. Click "submit" button.

8. Navigate to Voice Services-->SP used for FPL Service-->X_UserAgentPort

a) X_UserAgentPort should be a random UDP port number between 30000 and 60000. Example: 33332. Just pick a port number in that range.
If you already have a random number in that range, simply enter a new one in that range.
By using a high random port you help to thwart SIP scanners/hackers.

Do not use the same X_UserAgentPort for any other SP. Pick a different X_UserAgentPort in the same range for other SPs.

Never use UDP 5060 for X_UserAgentPort.

Also, this step can help to resolve a corrupted NAT association that may have developed between the router and the ATA.

9. Click "submit" button.

10. Navigate to Service Providers-->ITSP Profile used for FPL-->SIP->

Enable X_UsePublicAddressInVia (you will have to uncheck default box).

11. Click the "submit button".

12. A.Turn off Rogers modem/router combo and the ATA.

B. Turn on Rogers modem/router combo. Wait for it to be fully up and running.

C. Turn on ATA (or IP Phone or open SIP app) only after the router is fully up and running.

The ATA should be the last device powered on in the device chain.

[Liptonbrisk]

i’m using sonicwall tz500 as core router and netgear rs500 as wifi access point. so i could fine tune parameters you mentioned on tz500 when i have to readjust those UDP related stuff if things go weird again.

Ohhh, there's no need for you to worry about SIP ALG at all since you have your own router. Follow these steps, step by step, down the list:

Bridge mode disables Rogers' SIP ALG. You still need to disable SIP ALG on your own main router (the SonicWall) and in anything that's connected to the Obihai ATAs.

1. Put Rogers modem/router combo in bridge mode: click https://www.rogers.com/support/internet ... -fi-router for instructions. It's very easy to do. If you need help enabling bridge mode, contact Rogers.

Using bridge mode disables all router features in the Rogers modem/router combo--including SIP ALG! When bridge mode is enabled the Rogers modem/router combo will be acting as a pure modem only.

The only reason not to use bridge mode is if you don't have your own router. Bridge mode drops all router features, including the firewall in the Rogers modem/router combo. So without your own router's firewall, you'll be left unprotected.

a. Disable SIP ALG in Sonicwall TZ500: click viewtopic.php?p=82330#p82330. I've also included this in step 11 below.

b. Disable SIP ALG in Netgear RS500: click https://kb.netgear.com/30796/How-do-I-d ... -interface. This step only matters if Obihai ATAs are connected to the Netgear RS500, which I hope they're not.

2. Attach SonicWall TZ500 to Rogers modem/router combo, which is now running in bridge mode.

3. Attach Obihai ATAs to SonicWall TZ500. I need to know what these OBi202s are connected to. They should be connected to the SonicWall TZ500 if you want this guide to work properly.

4. As discussed in point D from viewtopic.php?p=78976#p78976, adjust UDP timeouts in SonicWall TZ500. The following steps outline how to do this, when continuing this guide.

Thanks to Mango, many of us now understand that in order for ATAs to remain registered and working properly with a VoIP SIP provider like Freephoneline, in particular after power failures, the following conditions must be met:

UDP Unreplied Timeout (in your router) < NAT Keep-alive Interval (in your ATA; for Obihai ATAs this is X_KeepAliveExpires; for Grandstream, the setting is SIP Notify Keep Alive Interval) < UDP Assured Timeout or UDP Stream (in your router) < SIP Registration Failure Retry Wait Time (or RegisterRetryInterval in Obihai ATAs)

“<“ means less than.

For SonicWall TZ500,

a) Unreplied UDP Timeout (Target: 15s)

The setting can be adjusted from the default UDP Connection Timeout (seconds) (under Manage -> Firewall Settings -> Advanced). This global setting in SonicOS specifically controls the timeout for UDP connection states where no return packet has been seen or before a specific rule's timeout takes over. This directly maps to the concept of the "Unreplied" state timeout. Setting it to 15 correctly addresses this requirement.

b) Assured UDP Timeout (Target: 115s)

The setting that needs to be adjusted is UDP Connection Timeout (seconds) found in the Advanced tab of the specific Firewall Access Rule created for FPL traffic (LAN -> WAN, Source=All_Obihai_ATAs, Dest=FPL_Servers_Group, Service=FPL_UDP_Services). This setting within a rule overrides the global default and applies specifically to traffic matching that rule. Since the rule matches the intended SIP and RTP flows (which become "assured" once two-way communication happens), this timeout governs how long those specific connection states are kept alive. This correctly maps to the concept of the "Assured" state timeout for FPL traffic. Setting it to 115 correctly addresses this requirement in a targeted way.


5. You need the current management IP address of your SonicWall TZ500's LAN interface. The factory default IP address is 192.168.168.168 (usually assigned to the X0 port). If this was changed during setup, you'll need to use the IP address it was changed to.

6. You need the username and password. The factory defaults are admin / password, but these should have been changed for security. Use the current credentials.

7. You need to know the internal IP addresses of your Obihai ATAs on your network (LAN). Make sure these IP addresses are static or reserved in the SonicWall's DHCP settings so that your Obihai ATAs' LAN IP addresses never change. Let's use 192.168.168.50 and 192,168.168.51 as examples. Replace these with your actual ATAs' LAN IP addresses where needed.

Step-by-Step Instructions for DHCP Reservations on SonicWall TZ500

A) Before You Begin, check Obi ATA Web Interface. Log into the specific Obi202's web interface using its current LAN IP address. Dial ***1 to get it. Navigate to the Status page. Then click on System Status in the sub-menu. Look for the field labelled MACAddress in the Product Information section. Repeat this for the second ATA.

Or

Check Router DHCP Leases. If the ATAs are already connected and have received any IP address from the SonicWall, you might find their MAC addresses listed in the SonicWall's current DHCP Leases table (Manage -> Network -> DHCP Server, look under "Current DHCP Leases"). You would need to identify the ATAs in the list. Note down the unique MAC address found for ATA #1 and the different unique MAC address for ATA #2.


B) Choose IP Addresses. Decide on the specific IP addresses you want to assign permanently. We'll use our examples.
ATA #1: 192.168.168.50
ATA #2: 192.168.168.51 (Ensure these are within your LAN's subnet and suitable for static assignment).

Have your SonicWall login details ready.

C) Access your SonicWall's web management interface, and log in.

D) Navigate to DHCP Server. Navigate to Manage -> Network -> DHCP Server.

E) Locate DHCP Scope. Find the scope for your LAN (likely bound to X0, covering 192.168.168.x).

F) Access Static Entries: Click the "Configure" or "Edit" icon (pencil) for that scope. Look for and click the "Add Static Entry" button (or similar).

G) Add Reservation for ATA #1.

MAC Address: Enter ATA #1's MAC address.
IP Address: Enter 192.168.168.50 (Use the actual IP you chose).
Hostname / Name / Comment (Optional): Obihai_ATA_1.
Ensure it's Enabled.
Click OK.

H) Add Reservation for ATA #2:

Click "Add Static Entry" again.
MAC Address: Enter ATA #2's MAC address.
IP Address: Enter 192.168.168.51 (Use the actual IP you chose).
Hostname / Name / Comment (Optional): Obihai_ATA_2.
Ensure it's Enabled.
Click OK.

I) Save Scope Changes: click OK or Accept on the DHCP scope configuration window.

J) Save Overall DHCP Settings: click Accept at the bottom of the main DHCP Server page.

K) Reboot the Obi202 ATAs: power cycle both ATAs to force them to request new IP addresses.

L) Verify: check the ATAs' web interfaces or the SonicWall's "Current DHCP Leases" table to confirm they received the reserved IPs (ex. 192.168.168.50 and 192.168.168.51).



8. If possible, back up your SonicWall configuration before making changes. Look for options such as Manage -> Updates -> Firmware & Backups, and then find the Export Configuration option.


* Now at this point I'm somewhat guessing by reading Sonicwall documentation online and also confirming with AI (which is probably useless, since I don't think it's familiar with Sonicwall that much), but this is my best guess since I don't have your router.

9. Setting the Global (Default) UDP Timeout to 15 Seconds

This step shortens the time the firewall waits for a reply to general UDP traffic, helping clear stale connections faster.

a) Open your web browser and go to your SonicWall's current management IP address. Log in with your username and password.
b) Click the Manage tab/section (usually near the top).
c) Find Advanced Settings. Under Manage, click Firewall Settings, and then click Advanced.
d) Locate UDP Timeout. Scroll down to the "Timeouts" section. Find Default UDP Connection Timeout (seconds). It's likely set to 30.
e) Change the Value. Change to 15 seconds.
f) Save the Change. Scroll to the bottom, and click "Accept".

10. Ensure Consistent NAT is Enabled

a) Navigate to Manage -> VoIP -> Settings.
b) Check Box: Locate Enable Consistent NAT.
c) Ensure this box is CHECKED. This is important for SIP communication with Freephoneline.

If the SonicWall assigns a random external port (Public_IP:Port_A) during registration, FPL records that address. If later, your ATA sends a keep-alive packet and the SonicWall assigns a different external port (Public_IP:Port_B), the mapping for Port_A might disappear or time out. Now, FPL still thinks it should contact you at Port_A. When someone calls you, FPL sends the incoming call signal (an INVITE message) to Your_Public_IP:Port_A. Since that mapping may no longer be active in the SonicWall's state table, the SonicWall doesn't know where to send it internally and drops the packet. As a result, your phone doesn't ring. By enabling Consistent NAT, the SonicWall ensures that traffic from Your_ATA_IP:Internal_Port always gets mapped to the same Your_Public_IP:Some_Specific_External_Port. This stable mapping is used for registration, keep-alives, and call signalling. When FPL sends an incoming call to that consistent external address/port, the SonicWall knows exactly which internal ATA to forward it to because the mapping is stable and kept alive (helped by your keep-alives and the UDP timeouts).


11. Ensure SIP Transformations are Disabled **

a) Navigate to the Manage -> VoIP -> Settings page.
b) Check Box: Locate Enable SIP Transformations.
c) Action: Ensure this box is UNCHECKED. (Disables problematic SIP ALG).

12. Save VoIP Settings

Save: Click Accept at the bottom of the VoIP -> Settings page to save changes.



13. Define Network Addresses (Address Objects)

(Give easy-to-remember names to the important IP addresses)


a. Go to the Address Objects Page:

i) Click the Manage tab at the top of the SonicWall interface.
ii) In the menu on the left, under Objects, click on Address Objects.

b. Define Your First ATA (ATA #1):

i) Click the Add button near the top of the page. A new window will pop up.
ii) Fill in the details:
iii) Name: Obihai_ATA_1 (You can choose a name, this is just an example)
iv) Zone Assignment: Select LAN from the dropdown menu (because the ATA is on your Local Area Network).
v) Type: Select Host (because it's a single device).
vi) IP Address: Enter the static/reserved IP address you assigned to your first ATA (e.g., 192.168.168.50). Use your ATA #1's actual IP here.
vii) Click the OK button at the bottom.

c. Define Your Second ATA (ATA #2). Requires 2nd VoIP unlock key

i) Click the Add button again.
ii) Fill in the details:
iii) Name: Obihai_ATA_2
iv) Zone Assignment: LAN
v) Type: Host
vi) IP Address: Enter the static/reserved IP address you assigned to your second ATA (e.g., 192.168.168.51). Use your ATA #2's actual IP here.
vii) Click OK.

d. Define FPL SIP Server 1:
i) Click Add. Fill in: Name: FPL_voip_IP, Zone: WAN (Internet side), Type: Host, IP: 162.213.111.25. Click OK.

e. Define FPL SIP Server 2:
i) Click Add. Fill in: Name: FPL_voip2_IP, Zone: WAN, Type: Host, IP: 162.213.111.22. Click OK.

f Define FPL SIP Server 3:
i) Click Add. Fill in: Name: FPL_voip4_IP, Zone: WAN, Type: Host, IP: 162.213.111.21. Click OK.

g. Define FPL RTP (Audio) Server 1: **(Needed for audio)**
i) Click Add. Fill in: Name: FPL_RTP_IP_1, Zone: WAN, Type: Host, IP: 208.85.218.149. Click OK.

h. Define FPL RTP (Audio) Server 2: **(Needed for audio)**
i) Click Add. Fill in: Name: FPL_RTP_IP_2, Zone: WAN, Type: Host, IP: 208.85.218.150. Click OK.

i. Check: You should now see all eight of these named objects listed on the Address Objects page.

14. Group Network Addresses (Address Groups)
(Combine related addresses into simple groups to use in the firewall rule)

a. Go to the Address Groups Page:
i) Click the Manage tab (top).
ii) In the left menu, under Objects, click on Address Groups.

b. Group Your ATAs: **(To easily refer to both your phones)**
i) Click the Add button.
ii) Name: All_Obihai_ATAs
iii) Look in the list on the left side. Find Obihai_ATA_1, click on it to highlight it, and then click the right arrow button (->) in the middle to move it to the box on the right.
iv) Now find Obihai_ATA_2 in the left list, click it, and then click the right arrow (->).
v) (Both Obihai_ATA_1 and Obihai_ATA_2 should now appear in the box on the right).
vi) Click OK.

c. Group ALL FPL Servers (SIP & RTP): **(To easily refer to all FPL servers)**
i) Click the Add button again.
ii) Name: FPL_Servers_Group
iii) Move all five FPL server objects from the left list to the right box using the -> button:
iv) * FPL_voip_IP
* FPL_voip2_IP
* FPL_voip4_IP
* FPL_RTP_IP_1
* FPL_RTP_IP_2
* (All five objects should be in the right-hand box).
v) Click OK.

d. Check: you should see these two group names (All_Obihai_ATAs, FPL_Servers_Group) listed on the Address Groups page.

15. Define Network Services (Service Objects)
(Specify the communication "channels" or ports needed for FPL)

a. Go to the Service Objects Page:
i) Click the Manage tab (top).
ii) In the left menu, under Objects, click on Service Objects.

b. Define SIP Port 5060:
i) Click Add.
ii) Fill in the details:
iii) Name: SIP_UDP_5060
iv) Protocol: Select UDP (17) from the dropdown list.
v) Port Range: Enter 5060 in both the "Start Port" (or "Port / Range Start") box AND the "End Port" (or "Port / Range End") box.
vi) Click OK.

c. Define SIP Port 6060:
i) Click Add.
ii) Fill in: Name: SIP_UDP_6060, Protocol: UDP (17), Port Range: 6060 to 6060.
iii) Click OK.

d. Define RTP (Audio) Port Range:
i) Click Add.
ii) Fill in: Name: Obihai_RTP_UDP, Protocol: UDP (17), Port Range: 16600 to 16798. (Double-check this range matches your ATA config - see Note 18b below).
iii) Click OK.
iv) Check. You should now see these three service names listed on the Service Objects page.

16. Group Network Services (Service Group)
(Combine the required ports/protocols into one group)

a. Go to the Service Groups Page:
i) Click the Manage tab (top).
ii) In the left menu, under Objects, click on Service Groups.

b. Group FPL Services:
i) Click Add.
ii) Name: FPL_UDP_Services
iii) Move the three service objects from the left list to the right box using the -> button:
iv) SIP_UDP_5060
v) SIP_UDP_6060
vi) Obihai_RTP_UDP

(All three service objects should be in the right box).

vii) Click OK.
viii) Check. You should see the FPL_UDP_Services group listed.



17. Create the FPL Firewall Rule

(This rule uses the names and groups we just created to allow traffic for your phone lines and apply the special long timeout needed for stability).

a. Go to the Firewall Rules Page:
i) Click the Manage tab (top).
ii) In the left menu, under Rules, click on Access Rules.

b. Set the View: look near the top of the rules list. You might see a grid or dropdown menus for viewing rules between different network zones. Make sure you are viewing rules going From: LAN to To: WAN.

c. Add the Rule: Click the Add button (usually found at the bottom of the rules list). A new configuration window will pop up.

d. Configure the "General" Tab: (This tells the firewall basic permissions: WHO can talk WHERE using WHICH service)
i) Action: Select Allow from the dropdown.
ii) From Zone: Select LAN.
iii) To Zone: Select WAN.
iv) Service: Click the dropdown or selection button. Choose the Group named FPL_UDP_Services.
v) Source: Click the dropdown or selection button. Choose the Group named All_Obihai_ATAs. **(This applies the rule to both your ATAs)**
vi) Destination: Click the dropdown or selection button. Choose the Group named FPL_Servers_Group. **(This allows traffic to FPL's SIP and Audio servers)**

(Leave other settings like "Users Allowed" and "Schedule" at their defaults - usually "All" and "Always on").

e. Configure the "Advanced" Tab: (This applies the new timeout)
i) Click on the Advanced tab near the top of this rule configuration window.
ii) Find the setting UDP Connection Timeout (seconds).
iii) Click in the box and type 115.

f. Save the Rule:
i) Double-check that the Enable Rule box is checked (it usually is by default, often on the General tab or near the bottom).
ii) Click the OK button at the bottom of the rule window.
iii) Your new rule should now appear in the list of LAN to WAN rules.


18. Important Notes

a. Finding Server IPs May Be Needed Later

i) The FPL server IP addresses (162.x.x.x and 208.x.x.x) you defined might change someday. If your phones stop working, you might need to find the new IPs and update the Address Objects back in Step 13.

ii) Checking SIP IPs

Use the ping command on your computer (search how to open Command Prompt or Terminal and type ping voip.freephoneline.ca).

ping voip.freephoneline.ca
ping voip2.freephoneline.ca
ping voip4.freephoneline.ca


b. Checking RTP IPs

i) During a call, log into your Obi ATA's web page, go to Status -> Call Status and look for "Peer RTP Address". You will have to make multiple test calls to find all RTP IP addresses.

ii) Checking Your ATA's Audio Ports: We used the standard port range 16600-16798 for audio (RTP) in Step 15d. If you ever change this on your Obi ATA, you need to update the Obihai_RTP_UDP Service Object too. How to Check from Obihai ATAs? Log into Obi web page -> Service Providers -> ITSP Profile X (your FPL profile) -> RTP. Check LocalPortMin and LocalPortMax. That's the UDP port range.



Okay, so now we need to make sure the Obihai ATAs are configured properly.


19. Dial ***1 from a phone connected to your Obi202s. Open a web browser, and enter respective IP address(es) you heard for your Obi202s. Log in using the username (usually admin) and your admin password (admin is default).

20. Navigate to Service Provider Profile. In the left-hand menu, find the section for Freephoneline. Navigate to Service Providers -> ITSP Profile X (where X is the profile you configured for Freephoneline, e.g., A, B, C, or D). Click on the specific profile used for FPL.

21. Navigate to Service Providers-->ITSP Profile (used for FPL)--->SIP-->

a. Set RegisterRetryInterval (Scroll down the page within the ITSP Profile X -> SIP settings).
Locate the parameter named RegisterRetryInterval.
By default, the check boxes to the right ("Default" and/or "Device Default") might be checked. Uncheck both of these boxes for the RegisterRetryInterval parameter.

b. In the value field for RegisterRetryInterval, enter 120 seconds.

c. (Navigate to Service Providers-->ITSP Profile used for FPL-->SIP->) Enable X_UsePublicAddressInVia (you will have to uncheck default box first). Check the enable box.

I want to ensure your WAN IP is being sent in via headers so that packets from FPL aren't sent to your private LAN IP instead over the internet.

d. Submit/save settings

e. Navigate to Voice Services-->SP Service used for FPL

i) X_KeepAliveEnable should be Checked/enabled
ii) X_KeepAliveExpires should be 20 seconds
iii) X_KeepAliveMsgType should be "notify"

f. submit/save settings


22. Click the "submit button".

23. Reboot the ATAs.

24. If you want, you can test outbound calls by calling the 416 and 250 numbers here: https://thetestcall.blogspot.com/.



After the Obi202s reboot, they will use the 20-second keep-alive interval and the 120-second registration retry interval, which should work correctly with the SonicWall UDP timeouts you've already configured (15s unreplied < 20s keep-alive < 115s assured < 120s retry).

[Liptonbrisk]

I asked an AI about disabling SIP ALG in your Sonicwall router since it saves me from looking up instructions myself. Ensure SIP ALG is also disabled in your router:


“Okay, disabling SIP ALG (Application Layer Gateway) is often a recommended step when troubleshooting VoIP issues or ensuring maximum compatibility, especially when you're manually configuring firewall rules and timeouts as we have been. The ALG feature tries to "help" by modifying SIP packets to work through NAT, but it can sometimes interfere with the process and cause unexpected problems like one-way audio, registration failures, or dropped calls.

On a SonicWall TZ500 running SonicOS 6.x, this feature is usually referred to as "SIP Transformations". Here’s how to disable it:
Step-by-Step Instructions to Disable SIP ALG (Transformations):

* Log In: Access your SonicWall TZ500's web management interface using its IP address and your login credentials.

* Navigate to VoIP Settings:
* Click on the Manage tab in the top menu.
* In the left-hand navigation pane, find and click on VoIP.
* From the options that appear under VoIP, click on Settings.

* Locate SIP Transformations Option:
* On the VoIP > Settings page, look for the main SIP settings, usually near the top.

* You should see a checkbox labeled Enable SIP Transformations.

This is the SIP ALG setting.
* Disable SIP Transformations:
* Uncheck the box next to Enable SIP Transformations.
* Save the Change:
* Scroll to the bottom of the VoIP > Settings page.
* Click the Accept button to apply and save the change.

By unchecking "Enable SIP Transformations," you have disabled the SonicWall's built-in SIP ALG functionality. This prevents the firewall from automatically modifying SIP signaling packets, allowing your Obihai ATAs and the firewall rules you've created to handle the communication directly. This often leads to more stable and predictable VoIP behavior.”

[Liptonbrisk]

AI instructions for disabling SIP ALG in Netgear RS500 are as follows:

"The Netgear Tri-Band WiFi Router (RS500) typically uses Netgear's standard firmware interface (often called Netgear Genie interface).

Disabling SIP ALG on the Netgear RS500 is generally recommended for improving VoIP stability. Here are the step-by-step instructions for that model:

Step-by-Step Instructions to Disable SIP ALG on Netgear RS500:

Log In to the Router:
Open a web browser on a computer or device connected to the RS500's network (WiFi or Ethernet).
In the address bar, type www.routerlogin.net or the router's default IP address, which is usually 192.168.1.1. Press Enter.

You will be prompted for a username and password.
Default username: admin
Default password: password (or the custom password you set up).
Click Log In or Sign In.

Navigate to Advanced WAN Setup:
Once logged in, you'll see the main router interface. Click on the Advanced tab, usually located at the top.
In the left-hand navigation menu, under the Setup category, click on WAN Setup.

Locate the SIP ALG Setting:
Scroll down the WAN Setup page.
Look for a section, often under "NAT Filtering", containing options for Application Layer Gateways.
You should find a checkbox labeled Disable SIP ALG.

Disable SIP ALG:
Check the box next to Disable SIP ALG.
Important Note: On most Netgear routers, you check this box to turn OFF the SIP ALG feature.

Apply the Changes:
Find the Apply button, usually located at the top or bottom of the WAN Setup page.
Click Apply to save this setting change. The router will process the request.

Reboot Router (Recommended):
While the change might take effect after clicking Apply, rebooting the router ensures all services are using the new setting.
You can find a reboot option in the router's interface (often under Advanced -> Administration -> Router Status or Advanced -> Administration -> Backup Settings) or simply unplug the router's power cord, wait about 15-30 seconds, and plug it back in.

After the router reboots, the SIP ALG feature on your Netgear RS500 will be disabled, which should help prevent potential conflicts with your VoIP service."

[Liptonbrisk]

Actually, I did search too: https://kb.netgear.com/30796/How-do-I-d ... -interface.

AI instructions for disabling SIP ALG in Netgear RS500 are as follows:

"The Netgear Tri-Band WiFi Router (RS500) typically uses Netgear's standard firmware interface (often called Netgear Genie interface).

Disabling SIP ALG on the Netgear RS500 is generally recommended for improving VoIP stability. Here are the step-by-step instructions for that model:

Step-by-Step Instructions to Disable SIP ALG on Netgear RS500:

Log In to the Router:
Open a web browser on a computer or device connected to the RS500's network (WiFi or Ethernet).
In the address bar, type www.routerlogin.net or the router's default IP address, which is usually 192.168.1.1. Press Enter.

You will be prompted for a username and password.
Default username: admin
Default password: password (or the custom password you set up).
Click Log In or Sign In.

Navigate to Advanced WAN Setup:
Once logged in, you'll see the main router interface. Click on the Advanced tab, usually located at the top.
In the left-hand navigation menu, under the Setup category, click on WAN Setup.

Locate the SIP ALG Setting:
Scroll down the WAN Setup page.
Look for a section, often under "NAT Filtering", containing options for Application Layer Gateways.
You should find a checkbox labeled Disable SIP ALG.

Disable SIP ALG:
Check the box next to Disable SIP ALG.
Important Note: On most Netgear routers, you check this box to turn OFF the SIP ALG feature.

Apply the Changes:
Find the Apply button, usually located at the top or bottom of the WAN Setup page.
Click Apply to save this setting change. The router will process the request.

Reboot Router (Recommended):
While the change might take effect after clicking Apply, rebooting the router ensures all services are using the new setting.
You can find a reboot option in the router's interface (often under Advanced -> Administration -> Router Status or Advanced -> Administration -> Backup Settings) or simply unplug the router's power cord, wait about 15-30 seconds, and plug it back in.

After the router reboots, the SIP ALG feature on your Netgear RS500 will be disabled, which should help prevent potential conflicts with your VoIP service."

[Liptonbrisk]

i really appreciate your detailed instructions and recommendations. currently i’m a bIt hesitant to change my local network structure due to several reason. i have over fourty devices over local network but past netgear routers i used (from 3700, 4000, 4500, 6900, 7000) never could handle well, so i have to change to commercial grade router sonicwall from 100M bandwidth model to current 1G bandwidth model tz500, even my current WAN bandwidth could reach 2G. i’m not willing to upgrade sonicwall new model as those later model requires subscription service for activation which is too expensive in a long run. even my current model tz500 has numerous variation while i bought a cheapest variation which i’m not quite sure if its firewall function is fully activated. the latest netgear rs500 has much better firmware which seems to be more reliable than past model(from my personal experience with netgear routers and reviews from amazon, those router would have difficulty to maintain connection or add new devices after a few days, due to buggy firmware which has been hopeless and unsolveable issue for netgear-although hardware reliability is better than other brands). so i have to use rogers modem/router combination (gateway) firewall as first protection (as such. i can’t set it as bridge mode). netgear rs500 has about 40 devices limitation for handling so i only use it as wifi access point(router and firewall disabled in this mode). tz500’s questionable firewall functionality in my variation renders it unreliable for my local network, therefore i’m hesitated to sacrifice security to facilitate voip modem by changing my local network structure. thanks again for your help and i have saved these instructions for future if i have to upgrade core router that has 2G bandwidth and handle more devices.

(For full disclosure, I used AI to double check my assertions here because I wanted to make sure that your Sonicwall firewall is, indeed, superior to what Rogers offers).

Hi,

Regarding the firewall used, I understand your hesitation stems from uncertainty concerning your TZ500's protection. However, it's worth considering that from a technical standpoint, commercial-grade firewalls, such as those used in SonicWall TZ500s, generally provide significantly more robust, configurable, and reliable core firewall capabilities (stateful inspection, granular access rules, for example) than the all-in-one gateways (or modem/router combos) supplied by ISPs. While advanced security subscription services might be inactive on your TZ500, its fundamental firewall should still be very solid, likely surpassing whatever Rogers gave you in terms of control and performance under load. Of course, you can choose to keep the firewall in Rogers' device active, but you're implementing a double NAT scenario--which may cause problems--and relying on something that's typically inferior to what you already have in your Sonicewall router.

Your previous experiences with Netgear routers are relevant. As one sticky thread here emphasizes, a key requirement for stable Freephoneline service is the ability to adjust both the UDP Unreplied and UDP Assured timeouts independently, allowing for the recommended 15s < 20s < 115s < 120s timing. Official, standard Netgear firmware lacks this crucial feature, which might have contributed to the issues you saw.

This capability is why routers running firmware, such as Asuswrt-Merlin (on compatible Asus models), Tomato, pfSense, OpenWRT, or hardware from Ubiquiti or Mikrotik, are recommended in this community for reliable service with Freephoneline. They offer necessary features and settings. Your SonicWall TZ500 also has this capability, as shown in the steps I provided earlier (viewtopic.php?p=82329#p82329)–-representing a significant advantage over Netgear firmware-–but unfortunately, these steps lose their benefit in your current double NAT configuration behind your Rogers gateway router.

So, while using voip4.freephoneline.ca for ProxyServer resolved the immediate registration issue, the underlying double NAT setup and the inability to properly adjust UDP timeouts mean your current configuration isn't optimized, and you might still encounter intermittent issues with Freephoneline down the line.

Ultimately, I respect your concern with router feature subscription fees and the cost of potential future upgrades. As a small, low-risk step within your current setup, you should still ensure Enable SIP Transformations is UNCHECKED on the SonicWall (Manage -> VoIP -> Settings) router to disable its specific SIP ALG function, potentially reducing one source of interference. I also recommend disabling SIP ALG in all of your routers, including Netgear: https://kb.netgear.com/30796/How-do-I-d ... -interface. I remain uncertain what router your Obihai ATAs are connected to.

Should you decide to change your core router or network configuration in the future, focusing on options known to provide necessary VoIP (or SIP, specifically) customization features (particularly, being able to adjust unreplied and assured UDP timeouts) for Freephoneline would be beneficial: viewtopic.php?p=78976#p78976.

Take care.

[Liptonbrisk]

sorry i forget to mention that i actually directly connect two obi202 to rogers ‘gateway” which avoided double NAT. this means those two voip modem has one firewall protection while the rest devices have two firewall protection. hopefully this 6060 solution is sufficient for FPL as long as that 6060 server is alive.

Arris XB6 modem/router combo from Rogers does allow users to disable SIP ALG, by the way:

Open your web browser, and login at 10.0.0.1
Navigate to Advanced-->Options.
Uncheck the SIP box.
Click "Apply".

But that's for Arris XB6, and I don't know what brand and model modem/router combo Rogers gave you.

To find out,

1) "Enter https://10.0.0.1 and hit Enter.

Your browser may give you a warning about the SSL certificate. To bypass the message:
Chrome: Click Advanced and then Proceed to 10.0.0.1 (unsafe)
Edge: Click Advanced then Proceed to 10.0.0.1 (unsafe)
Firefox: Click Advanced then Accept the Risk and Continue
Safari: Click Show details and then visit this website."

https://www.rogers.com/support/internet ... n-password

2) Navigate to Gateway > Hardware > System Hardware

If you have an Arris brand modem/router combo it may be possible to disable SIP ALG using the steps in this post. If you have a Technicolor brand modem/router combo, you're probably out of luck.

[Liptonbrisk]

thanks a lot for the info, mine seems not to be XR6 which rogers just upgraded last month, not sure if it’s XR8 as no such info in firmware log in page, i can’t find related similar page as XR6

Chances are it's a Technicolor model and that you can't disable SIP ALG in it.

I would need the hardware information you see at Gateway > Hardware > System Hardware to determine what brand and model you have.

btw, as obi202 has no more firmware updates

Officially, there are no more firmware updates. However, many are switching to naf modded firmware (myself included). You can search for Obifirmware. Discussions concerning it are located at at this forum over here. I will not be providing support for that firmware, so it's better to ask questions over there where the firmware developer is active.

what will be solution if its internal SSL license expires in future

That doesn't matter for Freephoneline.

OBi202 doesn't have an SSL license that expires in the same manner software does. The concerns related to SSL/TLS and the lack of firmware updates are primarily about outdated trust store. The device might eventually not trust newer SSL certificates presented by servers that require TLS connections (because its list of trusted Certificate Authorities isn't updated).

Specific services, notably the Google Voice integration, rely on a client certificate embedded in the device, which does have an expiration date.

Standard SIP authentication, such as the digest authentication used by Freephoneline, relies on a challenge-response mechanism using your SIP username and SIP password (hashed with a nonce). This process happens within the SIP protocol messages (SIP signalling).

Where SSL/TLS would matter is If a service provider required SIP over TLS (Transport Layer Security), the TLS connection would need to be established first. This TLS handshake does involve validating the server's SSL certificate. If the Obi202 couldn't validate the server's certificate (due to an outdated trust store), the TLS connection would fail, and it wouldn't even get to the point of sending the SIP authentication messages.

But that doesn't matter for Freephoneline because Freephoneline does not use or support SIP over TLS for its BYOD (Bring Your Own Device) service. It uses unencrypted SIP over UDP ports 5060 and 6060.

The expired client certificate concern is specific to the now-defunct Google Voice integration via OBiTALK's website and not relevant for standard SIP registration with FPL. In other words, you're probably not affected unless you're using Google Voice, which I am also not supporting here.

However, using modded naf firmware from Obifirmware's website still allows users to provision Google Voice, to SSH into Obihai devices, and to potentially update certificates manually. Consumer Google Voice can still be provisioned on OBi202's using naf modded firmware. Perhaps this may be of interest. Again, I'm not supporting anything regarding modded firmware here, until it's absolutely required for Freephoneline to continue working.

which might affect user/pass authentication?

It won't for Freephoneline unless Freephoneline suddenly introduces TLS support, and, even then, I'm not sure they're going to require you to use it.

if obi202 has to retire

I'm extremely skeptical that it needs to be.

which modem you would recommend for best reliability?

OBi202 is not a modem. It's an ATA. If someone were forcing me to buy an ATA right now, I would probably buy a Poly ATA 402, https://www.hp.com/lk-en/products/acces ... 2101854850, which is basically an OBi202 except

- Poly 402 lacks consumer Google Voice support
- Poly 402 removed the firewall and router features from previous Obihai 2-phone port ATA models
- Poly 402 adds G.722 audio codec support, which Freephoneline doesn't support anyway

[vostro]

thanks for all above comprehensive answers.