On Thu, 10 Jan 2008 08:07:14 -0800, Alister wrote:
[color=blue]
> On Jan 10, 2:00Â*pm, alexd <troffa...@hotmail.com> wrote:[/color]
[color=blue]
> You are quite correct, and I have investigated the router further with
> the manufacturer and this is the case. The only firewall control this
> router offers is port forwarding in the manner you describe, or to
> assign a single external IP (which is the same as the router's) to a DMZ
> which has no firewall on it at all.[/color]

Perhaps it's worth replacing the BT router, as you may run into a similar
problem again in the future with other applications.
[color=blue]
> It looks like I will do this and have another router / firewall in the
> DMZ with one interface as the external IP and the other on an internal
> IP and then connect the phones via a switch. I can then set up
> access-lists to only allow Voip traffic through the second router. Bit
> of a pain though![/color]

If I read you right, the plan is:

(Net)--(BT router)--(Another router)--(switch)--(handsets)
[color=blue]
> If you have any better suggestions I'd love to hear them![/color]

I think before you throw any more hardware at the problem, you should
validate that what you're planning is going to work. I can't see how
adding another link in the chain is going to fix a firewalling problem on
the BT router. If you just use the one handset, and modify the rules to
allow it out, does it work? How does internet browsing work if you have
to add an explicit permit rule to allow a host out, but can only add rule
at a time?

Do you have any sites where audio does work?

Have you tried using a handset [or softphone] from home to test it?

Does Asterisk have a public IP? If not, have you told it what it's public
address is? [[url]http://www.voip-info.org/wiki/index.php?page=Asterisk+SIP[/url]
+externip]

Are the handsets SIP or IAX?

Have you tried disabling/enabling SIP fixup on the PIX?

If you have to add another router, you'd probably be best off adding
something that can terminate a VPN from the PIX, and run the calls over
the VPN. This would bring all the usual benefits of VPNs with it.

--
<http://ale.cx/> (AIM:troffasky) (UnSoEsNpEaTm@ale.cx)
16:29:56 up 5 days, 6:54, 2 users, load average: 1.32, 1.23, 1.17
2x Broadband/IT/Telecoms support positions in Newcastle city centre.
For more info call 0191 229 8870 and ask for Steve. No agencies.