ICMP Destination unreachable with Siproxd after 60 seconds


my network setup is as follows:
Speedport router (used only as Modem and PBX) → Mox (routing, NAT) → internal networks

In the internal network I have a Fritzbox on which my DECT phones are connected. The Fritzbox connects to the PBX on the Speedport via siproxd, which is running on the Mox.

This setup was working for some months. But since some time (weeks?) sometimes the phones do not ring on an incoming call. I don’t remember having changed something apart from updating the Mox and the Speedport.

What I found out so far is that every 260 sec the Fritzbox sends a SIP REGISTER packet. If the incoming call arrives in the next 60 seconds, everything is fine. If it arrives later (before the next REGISTER), the Mox sends an ICMP packet Destination unreachable.

I thought it might be a problem with the firewall, but allowing port 5060 does not change anything:

Any help is greatly appreciated.

Not a solution, but why use the speedport at all for telephony? IIUC you could simply configure the internal fritzbox to do full duty as SIP/VoIP base station? Feel free to ignore as not really related to your question, but I am simply curious…

Myself I operate a fritzbox vdsl modem, as bridged modem only, behind that a turris omnis as primary router and inside my home network an old gigaset c610aip base station, which works quite well (the isp is telefonica/o2).

Absolute valid question, @moeller0 . Sometimes one needs somebody who asks what one really wants to accomplish.

I used to use directly the PBX of the telephone company using the Speedport only as modem.
But this stopped working when I moved from DSL to Hybrid (DSL + LTE). I assumed that the switching between DSL and LTE which might happen in the middle of a call caused the problems but did not dig deeper.

Not 100% but I believe the Telekom* hybrid solution uses DSCPs to steer latency critical flows exclusively over the DSL link, but I do not remember which dscps are used for that purpose…

*) The combination speedport and hybrid hints strongly at a Deutsche Telekom link…

1 Like

Yes, it is a Deutsche Telekom link.
I could make a tracedump on Router side to find out the DSCP value.
But in the Fritzbox I cannot manually enter those. Can the Mox rewrite these packages with the new DSCP value?

Yes, changing DSCP values is something the OpenWrt firewall allows…

As the siproxd runs on the Mox, the firewall rule should be set from WAN to This device

The Speedport did get some updates since my last try.
So if nobody has an answer why the port is blocked after 60 seconds, I will take the time on the weekend to check whether the direct SIP connection without the Speedport will work now.

I tried this, too. No change.

Are you sure you need Siproxd to begin with? Maybe let the FritzBox-as-VoIP-base-station handle everything?

I just note my gigaset base station does this every 180 seconds, but it also sends keep alive packets every 20 seconds, the trick in your case would be to fing a keep alive period that is shorter than the time the speedport and mox maintain the connection as active…

Yes, without siproxd the access is denied. The sip client has to be in the same subnet as the Speedport. See Gelöst: PBX auf dem Speedport aus einem anderen Subnet nut... | Telekom hilft Community

I moved the firewall rule for SIP up in the chain. It is now working and I cannot reproduce the error even if I move the rule down again.
Sorry for wasting your time.

1 Like

This smells abit like they play silly games with TTL=1 or similar, but my question is, why not ignore the speedport PBXZ completely and let the FritzBox directly deal with the Telekom SIP servers? I am sure there is a reason, but never having used telekom hybrid I am just too naive to see it :slight_smile: