Hola All, We have two home offices for a small start up. My house internet runs both my home network as well as the business PBX running on a R610. The other guys are at another house, if I want to have them be able to use desk phones on the same pbx, i was going to use a vpn gateway at their house to connect to mine. my issue is that I want the vpn to only allow sip traffic not web browsing. is this possible?
Posted Jul 27, 2019, 9:06 PM UTC
Do you have a public IP? Port forward the appropriate ports to your pbx.
Dynamic IPs on both ends, thats why i dont want to open all those parts
By default, your all traffic from / to the vpn will be routed by the USG. If you want to only route SIP & RTP traffic for the phones, you need to set up firewall rules to drop everything except traffic on those ports.
Would that be a firewall rule on the USG for the vpn network or would it be on the remote users firewall?
On the USG. If you do it at the remote users end, you have no control of it if they choose to say, turn off the firewall rules, or connect to the VPN with a different device. Technically both would work I guess.
When you create the VPN, you're going to assign it a subnet (like 10.0.0.1/24) so whichever devices connect by VPN, they're going to get an IP from that subnet.
In your firewall settings, you can set up "groups" of IP's or ports. So you're going to create one group covering your VPN clients (10.0.0.0/24) and another for your VoIP Server, say 192.168.1.20
Then, create a group for the SIP and RTP ports. Probably SIP is 5060, and your RTP ports are whatever is configured in your VoIP server.
On the USG, create firewall two rules. They go in the LAN OUT section. The first rule is going to allow traffic with a source of the VPN group to the VoIP phone group on the Ports group you created above.
The second is going to drop all traffic from the VPN group.
Make sure the first rule is above the second in the list, as the first rule that matches will be used.
You might say why would I put this on the LAN OUT group, and not LAN IN or WAN IN? I am not sure of the technical reasons, but my testing has shown rules trying to impact the VPN group in WAN IN don't work at all, which makes a lot of sense, and if you block all traffic in from the VPN on the LAN IN firewall, your client can't authenticate, which I guess is because it can't get through to the USG's RADIUS server to authenticate the username & password.
I'm an amateur with an interest, so others may have more for you here and I could be wrong. But what I said does seem to work in my setup.
Sure it's possible. You just need to make sure you only add routes to forward traffic across the vpn that are related to sip. All other traffic can use a default route to the ISP gateway.
So its client side not my USG side.