vlan и SIP

[sergey15g]

Здравствуйте!
Есть mikrotik 951. Интернет и телефонию берет от провайдера по выделенке, причем телефония приходит по vlan. Так вот какая проблема : есть два vlan`а тегированых (один на порт 5060, второй на RTP 10000-20000), регистрация номера проходит если выставить vlan с 5060 выше правила RTP, но в этом случае перестает проходить голос. Если выставить сначала 5060, дождаться регистрации телефонов, а затем опустить правило ниже правила с RTP то все работает. Но если mikrotik не дай бог перезагрузить и правило с 5060 стоит ниже правила RTP то все, телефоны не регистрируются. Подскажите как с этим можно побороться?

[vqd]

эм. Конфиг покажите

[sergey15g]

Да, конечно! Под спойлером.

 конфиг

# aug/14/2014 10:37:48 by RouterOS 6.18
# software id = 6ABQ-WXJ8
#
/interface bridge
add l2mtu=1598 name=bridge2
/interface wireless
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode \
band=2ghz-b/g/n channel-width=20/40mhz-ht-above country=russia disabled=\
no frequency=2437 l2mtu=2290 mode=ap-bridge periodic-calibration=enabled \
tx-power=19 tx-power-mode=all-rates-fixed wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether2 ] arp=proxy-arp
set [ find default-name=ether3 ] arp=proxy-arp
set [ find default-name=ether4 ] arp=proxy-arp
/interface vlan
add interface=ether4 l2mtu=1594 name=vlan1 vlan-id=1
add interface=ether1 l2mtu=1594 name=vlan1501 use-service-tag=yes vlan-id=\
1501
add interface=ether1 l2mtu=1594 name=vlan1540 vlan-id=1540
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \
mode=dynamic-keys wpa-pre-shared-key=xxxxxx wpa2-pre-shared-key=\
xxxxxxx
/ip pool
add name=dhcp ranges=123.0.1.10-123.0.1.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge2 name=dhcp1
/ppp profile
set 0 dns-server=123.0.1.1
/interface pppoe-client
add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 \
default-route-distance=1 dial-on-demand=no disabled=no interface=ether1 \
keepalive-timeout=60 max-mru=1480 max-mtu=1480 mrru=1600 name=Telecom \
password=xxxxxxx profile=default service-name=telecom use-peer-dns=yes \
user=xxxxxxx
add ac-name="" add-default-route=yes allow=pap,chap default-route-distance=1 \
dial-on-demand=no disabled=yes interface=ether5 keepalive-timeout=60 \
max-mru=1480 max-mtu=1480 mrru=1600 name=pppoe-out1 password=xxxxxx \
profile=default service-name=rostele use-peer-dns=yes user=xxxxxxx
/interface bridge port
add bridge=bridge2 interface=ether2
add bridge=bridge2 interface=ether3
add bridge=bridge2 interface=ether4
add bridge=bridge2 interface=wlan1
/interface pppoe-server server
add interface=ether1 mrru=1600 service-name=service1
/ip address
add address=123.0.1.1/24 interface=ether2 network=123.0.1.0
add address=123.0.2.2/32 interface=ether5 network=123.0.2.0
add address=172.20.40.9/24 interface=vlan1540 network=172.20.40.0
/ip dhcp-client
add dhcp-options=hostname,clientid interface=ether4
/ip dhcp-server lease
add address=123.0.1.2 client-id=1:ac:22:b:cd:74:63 mac-address=\
AC:22:0B:CD:74:63 server=dhcp1
add address=123.0.1.3 mac-address=90:2B:34:2B:9C:66 server=dhcp1
add address=123.0.1.4 client-id=1:1c:6f:65:42:1c:33 mac-address=\
1C:6F:65:42:1C:33 server=dhcp1
add address=123.0.1.8 client-id=00:0B:74:85:54:46 comment=DVR mac-address=\
00:0B:74:85:54:46
add address=123.0.1.24 client-id=1:0:1b:a9:e2:1:f8 mac-address=\
00:1B:A9:E2:01:F8 server=dhcp1
add address=123.0.1.28 client-id=1:0:15:99:b2:b9:20 mac-address=\
00:15:99:B2:B9:20 server=dhcp1
/ip dhcp-server network
add address=123.0.1.0/24 boot-file-name=pxelinux.0 dns-server=123.0.1.1 \
gateway=123.0.1.1 netmask=24 next-server=123.0.1.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=123.0.1.1 name=router
/ip firewall filter
add chain=input dst-address=176.100.216.xxx dst-port=25001 protocol=tcp
add action=drop chain=input in-interface=Telecom protocol=icmp
add chain=input disabled=yes protocol=icmp
add chain=input connection-state=established disabled=yes in-interface=\
Telecom
add chain=input connection-state=related in-interface=Telecom
add action=drop chain=input disabled=yes in-interface=Telecom
add action=jump chain=forward disabled=yes in-interface=Telecom jump-target=\
customer
add chain=customer connection-state=established
add chain=customer connection-state=related disabled=yes
add action=drop chain=customer disabled=yes
add action=drop chain=input dst-port=5060 in-interface=Telecom protocol=udp
add action=drop chain=input dst-port=5061 in-interface=Telecom protocol=udp
add action=drop chain=input disabled=yes in-interface=Telecom
add action=drop chain=input dst-address=176.100.216.xxx dst-port=53 \
in-interface=Telecom protocol=udp
add action=drop chain=input dst-port=21 in-interface=Telecom protocol=tcp
add chain=input connection-state=established in-interface=pppoe-out1
/ip firewall mangle
add chain=prerouting dst-address=10.100.33.3 packet-mark=voip protocol=udp \
src-address=123.0.1.3
add action=mark-packet chain=prerouting dst-address=123.0.1.2 dst-port=25000 \
in-interface=ether4 new-packet-mark=rezerv packet-mark=rezerv protocol=\
tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface=vlan1540
add action=masquerade chain=srcnat out-interface=Telecom to-addresses=0.0.0.0
add action=dst-nat chain=dstnat disabled=yes dst-address=123.0.1.2 dst-port=\
25000 in-interface=ether4 protocol=tcp to-addresses=123.0.1.2 to-ports=\
25000
add action=masquerade chain=srcnat out-interface=vlan1
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=25000 \
protocol=tcp to-addresses=123.0.1.2 to-ports=25000
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=9000 \
protocol=tcp to-addresses=123.0.1.8 to-ports=9000
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=25001 \
protocol=tcp to-addresses=123.0.1.2 to-ports=25001
add action=dst-nat chain=dstnat in-interface=vlan1540 protocol=udp \
to-addresses=123.0.1.3 to-ports=10000-20000
add action=dst-nat chain=dstnat in-interface=vlan1540 protocol=udp \
to-addresses=123.0.1.3 to-ports=5060
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=60022 \
protocol=tcp to-addresses=123.0.1.25 to-ports=3389
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=60021 \
protocol=tcp to-addresses=123.0.1.25 to-ports=2211
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=60020 \
protocol=tcp to-addresses=123.0.1.8 to-ports=80
add action=dst-nat chain=dstnat disabled=yes dst-port=25000 protocol=tcp \
to-addresses=123.0.1.2 to-ports=25000
add action=src-nat chain=srcnat comment="NAT access to adsl modem" \
dst-address=123.0.2.1 out-interface=ether5 to-addresses=123.0.2.2
add action=masquerade chain=srcnat out-interface=pppoe-out1
add action=dst-nat chain=dstnat dst-address=77.51.xxx.xxx dst-port=25000 \
protocol=tcp to-addresses=123.0.1.2 to-ports=25000
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=60050 \
protocol=tcp to-addresses=123.0.1.2 to-ports=8888
add action=dst-nat chain=dstnat dst-address=77.51.xxx.xxx dst-port=25001 \
protocol=tcp to-addresses=123.0.1.2 to-ports=25001
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=60025 \
protocol=tcp to-addresses=123.0.1.4 to-ports=3389
add action=dst-nat chain=dstnat dst-address=77.51.xxx.xxx dst-port=60025 \
protocol=tcp to-addresses=123.0.1.4 to-ports=3389
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=25003 \
protocol=tcp to-addresses=123.0.1.2 to-ports=25003
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=25004 \
protocol=tcp to-addresses=123.0.1.2 to-ports=25004
add action=dst-nat chain=dstnat dst-address=77.51.xxx.xxx dst-port=25003 \
protocol=tcp to-addresses=123.0.1.2 to-ports=25003
add action=dst-nat chain=dstnat dst-address=77.51.xxx.xxx dst-port=25004 \
protocol=tcp to-addresses=123.0.1.2 to-ports=25004
add action=dst-nat chain=dstnat dst-address=176.100.216.xxx dst-port=60026 \
protocol=tcp to-addresses=123.0.1.4 to-ports=3389
add action=dst-nat chain=dstnat disabled=yes dst-address=176.100.216.xxx \
dst-port=6999 port="" protocol=tcp to-addresses=123.0.1.3 to-ports=6999
/ip firewall service-port
set sip disabled=yes
/ip route
add distance=1 gateway=Telecom
add check-gateway=ping disabled=yes distance=10 gateway=123.0.1.40
add distance=1 dst-address=10.100.33.0/24 gateway=vlan1540
add distance=10 dst-address=123.0.2.1/32 gateway=ether5
/ip service
set telnet disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip tftp
add real-filename=usb1/pxe/pxelinux.0 req-filename=pxelinux.0
add real-filename=usb1/pxe/initrd req-filename=initrd
add real-filename=usb1/pxe/image.md5 req-filename=image.md5
add real-filename=usb1/pxe/vmlinuz req-filename=vmlinuz
add real-filename=usb1/pxe/thinstation.conf.network req-filename=\
thinstation.conf.network
add real-filename=usb1/pxe/thinstation.hosts req-filename=thinstation.hosts
add real-filename=usb1/pxe/pxelinux.cfg/default req-filename=\
pxelinux.cfg/default
add real-filename=usb1/pxe/pxelinux.cfg/default.tpl req-filename=\
pxelinux.cfg/default.tpl
add real-filename=usb1/pxe/thinstation.conf-buh req-filename=\
thinstation.conf-buh
add real-filename=usb1/pxe/thinstation.conf-seif req-filename=\
thinstation.conf-seif
add real-filename=usb1/pxe/thinstation.conf-kassir req-filename=\
thinstation.conf-kassir
add real-filename=usb1/pxe/thinstation.conf-auto_1 req-filename=\
thinstation.conf-auto_1
add real-filename=usb1/pxe/thinstation.conf-vipusk req-filename=\
thinstation.conf-vipusk
add real-filename=usb1/pxe/thinstation.conf-zam req-filename=\
thinstation.conf-zam
/ip upnp
set allow-disable-external-interface=no
/ip upnp interfaces
add interface=ether1 type=external
add interface=ether2 type=internal
add interface=ether3 type=internal
add interface=ether4 type=internal
add interface=ether5 type=internal
add interface=bridge2 type=internal
/ppp secret
add disabled=yes local-address=123.0.1.1 name=xxxxx password=xxxxxx \
remote-address=123.0.1.5
/system clock
set time-zone-name=Europe/Moscow
/system leds
set 0 interface=wlan1
/system ntp client
set enabled=yes primary-ntp=109.87.105.6 secondary-ntp=195.191.13.80

[sergey15g]

Никто не сталкивался с таким?

[Vladimir22]

а у вас получается что регистрация и голос ходят в разных Vlan ?!

[sergey15g]

Отнюдь. Регистрация и голос по одним vlan. Тут все норм.