Building a Personal VoIP System
sacredheartsc.com
sacredheartsc.com
I did put six Cisco VoIP phones and all was working fine as long as no more than four phones were used simultaneously (which never happened). It worked for years like that and wife ended up selling her SME with these VoIP phones still hooked to the RPi 1. We warned them that that thing was kinda a hack ; )
For anyone hesitating: it's not hard to set up. Find a provider to get a SIP trunk, configure the thing, backup the config (I just imaged the entire drive), and you're good to go for a very long time.
It's simple, reliable, stuff that usually won't move under your feet.
You can get a modem that will do SMS (eg a Sierra Wireless card), but I don't know if/how they do voice.
Also, I'd shy away from the RPi based on the unreliability of SD cards. It would/will be pretty annoying for your host to go down and you have to travel back to fix it. I suppose if your friend is halfway handy you could keep an image of the machine as installed. Or even take new images remotely (rsync from the raw device a few times in a row?). If the root filesytem goes wonky, have your friend pull the SD card and reimage it.
I'm sure specific services are hit or miss - there really shouldn't be a problem sending SMS to whatever number a user enters, but paternalistic snake oil salesmen gonna be paternalistic.
I've had the least difficulty with Google Voice (I believe it's impossible to tell "Google Voice" usage from bona fide Fi usage where it's really the users' only phone number). Voip.ms has worked very little for me, to the point of that I don't even try it. Heck I even used a voip.ms number for some online classifieds, and another person using Comcast/Xfinity mobile couldn't text me. I'm not saying this as a slight against Voip.ms itself, from what I've gathered most voip providers will be treated similarly.
One of these days when I get around to it I plan on setting up a wireless modem on a $3/mo paygo plan for my SMS nag needs. With a script that automatically brings the number as close to my paste buffer as possible.
What single use SMS service do you use? I haven't really investigated those.
These are definitely distinguishable, and some auth service treat them differently. Google Voice numbers come from a different carrier (the one named Bandwidth) than most Fi numbers.
This is called a "2FA Mule":
https://kozubik.com/items/2famule/
"A 2FA Mule is a mobile phone configured to forward SMS 2FA codes via email."
I turn it on when needed, which is almost never. When not job searching, the voicemail plays the classic "this line has been disconnected" tones and message on repeat for two minutes. WiFi calling means I can use it anywhere I have WiFi.
I get incredibly few spam calls using this strategy.
The first is for sending a verification code during signup to prevent spammy/abusive signups. In my experience, this is the least likely to work with VoIP numbers because companies often intentionally block VoIP numbers.
The second is for sending 2FA codes during login. My experience with this has been much better. AFAICT, companies do not intentionally block VoIP numbers for this use case. When SMS does fail, there is almost always an option to send the code by voice call, and this is always 100% reliable.
I also have some experience with using a modem with a SIM card to receive SMS. I've used two different models of modem (not Sierra Wireless) and both have been very flaky, often locking up and requiring a power cycle, or having hours-long delays when receiving SMS. I would not call this approach a panacea.
Regardless, your overall impression is correct: Twilio is no longer a hacker/hobbyist/enthusiast option as you cannot (by the letter of the law, at least) send SMS without registering your business entity:
https://twitter.com/rsyncnet/status/1593384850073214976?lang...
This is very troublesome to me because I have built my own personal telco out of twilio functions and twiml bins, etc., and am heavily reliant on all manner of SMS workflows.
As of this writing (2023-05-27) everything - even SMS delivery to T-Mobile numbers - continues to "just work" but it sounds like I will just wake up one morning to have it all broken ...
> • Effective July 5, 2023, all 10DLC phone numbers used to send SMS and MMS messages to U.S. phone numbers must be fully registered to an approved campaign under your brand. Messages sent using unregistered phone numbers will be subject to a gradual increase of message blocking by Twilio, beginning on July 5, 2023, ultimately leading to a full block of all unregistered U.S.-bound messages sent after August 31, 2023.
Source: https://support.twilio.com/hc/en-us/articles/1260800720410-W...
This needs investigation, but - Over the top of my head, I think you could probably have some kind of a 4G/5G modem hooked on to an SBC (Pi, APU, etc.) and then forwarded to your SIP line which you can pick over IP (Internet), this should work.
One of the child comments mentioned DID (Direct Inward Dialling). I am no expert, but if your Australian provider supports something similar, you will get the number (friend) who is dialling in, instead of your own Australian number dialling in to your receiver phone. This is useful for caller ID, otherwise it's just like a forwarded call.
Hope this helps.
Most of the integrated FOSS solutions come with fail2ban already configured, it is essential. If you want more peace of mind, a prepaid trunk helps. That means you charge up your sip trunk account, and if someone drains it, it just stops working instead of continuing to drain your bank account.
You can also limit international calling on your trunks, which effectively nullifies the financial drain of this kind of attack (though it's still obviously bad if an attacker can access your system in any way)
I'm a software dev, not a sysadmin, but I can find my way around configure Linux machines.
I don't remember it as being particularly complicated. What I do remember for sure though is that once it worked, it worked flawlessly for years.
[0] https://nerdvittles.com/ [1] https://wiki.incrediblepbx.com/
It's set up so that all incoming calls hit a voice prompt saying which 1-digit extension you should enter to get who (this stops 99% of phone spam) - everyone gets a voicemail on their extension which rings in their bedroom and rolls over to the common spaces - and everyone gets a unique ring cadence, my daughter who at one point got 80% of the phone calls got the 2 short rings.
The kids have gone, we've moved to a smaller house, only 2 extensions, but that same hardware soldiers on (and still stops 99% of the spam - I've had 1 call in the past year)
Personal experience:
I spent about 15 months working for a local telecom company, supporting their asterisk servers and developing interactive voice response applications. I was given the opportunity to build their residential voip service (in 2010?) from scratch and despite asterisk being so dominant I prototyped and eventually completed the project using freeSWITCH. I found it to be so much more developer friendly to configure and extend. Being able to build dial plans and implement logic with JavaScript or Lua rather than asterisk's config files was worth it. I suspect this system is still running.
Yes, these hacky ALG features also allowed internet users to access internal IPs on arbitrary services (!); named “remote arbitrary firewall pinhole control”. The attack was published in 2020 and named NAT slipstreaming [1].
When was this approximately? I’m wondering how widespread this (still) is.
It wouldn't have mattered much because the router/modem combos in use didn't have a switch for SIP ALG anyway, bit it's good router finally know what could've caused the phantom phone ringing.
The only thing I have to add: if you need to make telephone calls, the call quality using a SIP phone is much better than using a softphone.
One issue with voip on mobile (iOS in my case) is that I would often miss calls due to late push notifications and timing out. So recently I set up a calling queue that rings/pushes my phone a few times instead of just once (queue timeout to 30 seconds before hitting voicemail).
Basically, if you want the control FreeSwitch and Asterisk offer but don't want to self-host, voip.ms is the best way to go.
The PCI slot let me plug in a Digium TDM800P and add eight POTS lines, either FSX or FXO, for pretty cheap.
I’m wondering how necessary POTS lines actually are these days (and how many connect to VoIP on the telco side). Should depend on the country.
In general the days of having direct electrical connections between two distant telephones are long gone. The telco companies scrapped it when they realized that they could trunk the phone calls from a local branch to the central office using PCM streams over a single cable.
90% of the traffic was handled over SIP or IAX to desk sets or ATAs.
It was supposed to make things more convenient. Supposed to, because we just kept yelling to convey messages. When I’ve moved out I’ve dismantled the system since I wouldn’t be there to keep it maintained.
AFAIK, most residential and commercial ISPs these days do assign customers both a dynamically-DHCP-leased IPv4 address, and a static, globally-routable IPv6 prefix — usually a /64, though some are nicer than that. If you put your ISP's gateway router into bridge mode, and then plugged your computer directly into it — then your device would acquire both an IPv4 and an IPv6 address.
But routers — including ISP gateway routers — insist on doing NAT not only for IPv4, but also for IPv6 (using the fe80:: prefix.) So on any regular home or office network, devices are going to acquire private-use IPv4 and IPv6 addresses.
Is there some reason that modern routers don't do NAT for IPv4, while just further splitting+assigning the received prefix for IPv6, such that every device on the network receives a private IPv4 addr, but a public IPv6 prefix, e.g. a /72?
I know that Internet-backbone network switches ignore the last 64 bits of IPv6 in their routing tables; but those bits are still being carried in the IPv6 packets, and once they reach your home router, it can make use of them to route to the final destination (i.e. one of the devices behind it.) Wasn't this supposed to be the idea?
Maybe I'm misunderstanding your comment, but fe80:: is a link-local address and used by devices to talk to each other on the network. It's there by default when IPv6 is enabled.
Most ISPs that support IPv6 will provide a /56 to the router, and then the router will assign a /64 to wifi. Then the clients get an IPv6 address using DHCPv6 or a route announcement.
Unfortunately most VoIP providers do not support IPv6. voip.ms, which I use, for example, does not.
In my Asterisk pjsip configuration, I use:
external_media_address = dyn.example.org external_signaling_address = dyn.example.org
where dyn.example.org is a dyndns that I use that points to my home Asterisk server, on a dynamic IPv4 address. My ISP does change my IPv4 address rather often, and sometimes I have to restart asterisk for the change to be effective.
Now in theory most devices should be safe to connect to the internet. But how many Internet of Shit devices are there in the average household that probably shouldn't be trusted? Crappy security cameras with 10 year old firmware written by the lowest bidder as well as "smart" thermostats that probably aren't much better.
So maybe keeping the stateful firewall by default is the best option.
...why? Routers have (stateful) firewalls, entirely separate from their NAT-ing abilities. You can still have the firewall without the NAT. (And the protocols that IoT devices rely on, like UPnP, are technically protocols for manipulating firewall rules, not NAT port-forwarding rules; so they still work fine without NAT in place.)
> But how many Internet of Shit devices are there in the average household that probably shouldn't be trusted?
I'm not sure about IPv4, but in IPv6 a given single logical interface can acquire multiple IPv6 addresses — meaning that your laptop or phone will have both a public global IPv6 address, and a link-local fe80:: IPv6 address. And things like multicast, DHCP discovery, etc. will only be attempted or accepted through that link-local address.
Now imagine a router that combines that firewall rule, with a bit of logic to automatically assign devices that join the AP, to separate VLANs, depending on their MAC address vendor part. So laptops and phones go on the "home" VLAN, while IoT devices go on the "sandboxed" VLAN. Where these VLANs are peered, but with stateful firewall rules between them: "sandboxed" devices don't get to speak to "home" devices, unless the "home" device speaks to them first; and multicast packets from "home" devices won't reach "sandboxed" devices.
In other words, a home-network gateway-router should have all the same defaults that an IaaS-tenant VPC does: nodes on the network have public-routable IPs; but all inbound ports to them are closed unless a device asks; and traffic flowing between those devices can only be seen by other devices intentionally put into that same VLAN, not by other "tenants" who happen to be sharing the same pipes.
Totally! That's why that's the default setting for almost every router out there.
> Applying the same NAT system that is used for IPv4 to IPv6 is probably the best way to get this layer of security.
No? The default firewall rules will work just fine.
> So maybe keeping the stateful firewall by default is the best option.
Agreed. That's why routers ship with fully-closed firewalls for both IPv4 and IPv6. Incoming connections need firewall exceptions, either manually or through UPnP depending on how you've configured your network.
In fact, because of NAT issues like NAT slipstreaming, an IPv6 firewall is even more closed off than any IPv4 firewall that needs to let through FTP(S), SIP, and many other protocols depending on both sides of the connection using IPv4 as designed.
If you want a week-ish long project, go for the full mid-2000s, boingboing and slashdot experience: buy the dead tree version of the O'Reilly Asterisk book, which has been kept up to date and is still an wonderful resource. Follow it until you have the Enterprise-grade phone system of your dreams.
I even hired Allison "The Voice of Asterisk" [0] to do our phone tree voice prompts. Her prices were very reasonable for a small batch of prompts, and it’s surreal hearing the same lady that does the IVR for your bank and cable company do your own voice prompts.
I use Twilio for my SIP trunking, and it has nice fallback features in case the Asterisk system needs to go down for maintenance or the like. Costs about $20/month for a dozen or so users and fairly frequent calls/SMS.
Let's say that I have a LDAP server where I manage user accounts, and I want people to be able to call each other with any SIP-enabled phone. I am not interested in voicemail/IVRs/any type of "voice application" on top of that. Do I really need Asterisk/FreeSWITCH or can I just go buy by setting up something like Kamailio?
Right, but what I am saying is that I don't want any of those features. At least not yet.
I just want to give my customers a sip address (username@communick.com) where they can call other SIP addresses. In that case, is that a PBX still needed?
You don't need to run any of the advanced features in Asterisk (and can completely unload the modules if you want).
I looked at some intercoms on amazon/ebay, they are all RF and a bit shit. I saw some wifi ones, but nothing cheap enough to take a punt on. I did think about trying to make something with an ESP32, but that would be too hard for me in the time.
So I bought 6 cisco 7962 sip phones for £35 in total, and installed freepbx.
It took a bit of effort to bring the tftp server online, and make sure all the dhcp info was being passed on correctly. Once that was complete, freepbx makes most things pretty simple.
Now, I have ethernet is most rooms, and a switch that can do PoE, so this solution is for a niche of a niche
Except even third-choice solution is not always feasible. Reserving fixed RTP/UDP port range is not possible with carrier-grade NAT, which is quite common with residential ISPs and nearly-universal with cell ISPs.
Fourth-choice would be to reserve port range on a personal server (which would run B2BUA, asterisk in OP's case; or an RTP proxy), and force calls, including media, from/to SIP handsets to go via that.
Also, this is just uptime related tip not NAT, you must explicitly set registration/max_retries to a huge number otherwise Asterisk just gives up permanently at some point. It’s a really weird default.
The idea is if you send UDP packets to destination so arranged by middleman(STUN) or to a proxy so arranged by middleman(TURN) as an outgoing traffic, your Wi-Fi should be smart enough to set up a temporary NAT entry to allow responses to reach your $LOCAL_IP:$PORT. In reality, the Wi-Fi may have short memory or may be dying behind a refrigerator covered in dust and not able to handle all necessary combinations and ranges of addresses and ports, resulting in various partial failures such as one-way audio or missing participant in a group call.
Fifth-choice option is to just encapsulate everything into a VPN, preferably L2 VPN over HTTPS to a server on a global IP. If it isn't working, there must be no Internet.
Sometimes people don't see a point at first in UDP because you eventually have to implement sequence numbers, CRCs, time-outs, retries, etc. that are similar to what TCP does. One can finds the reasons why one wants to do this anyway in [1]. In a nutshell, reliability is often insured by the application layer anyway so you don't need the transport protocol to do extra stuff you have no control over and might even get in the way (see the numerous esoteric ioctl and sysctl settings under Linux).
It is an obvious choice because, as I said again, a router dropping a packet does not necessary triggers a resend, e.g. RTP or syslog (over UDP). In TCP, this is guaranteed. If you are overloaded, you'd rather take the action you can get away with than probably just buy time.
[1] https://web.mit.edu/Saltzer/www/publications/endtoend/endtoe...
Indeed TCP depends on packets getting dropped as the feedback mechanism for knowing when to slow down.
It's important that packets are dropped fairly, as otherwise on a loaded network only the preferred protocol(s) would keep working and the others would get starved. You don't want DNS to stop working when a HTTP flow is running at capacity on your link for example.
For those stuck behind CGNAT, there are guides online for how to set up a VPN to a cheap VPS and forward all network traffic to your network so you can have almost-real connectivity at home. If you're content with 50mbps, you can even use Oracle's Always Free tier.
I am looking at a modular set of protocols built mainly for IPv6.
The base: the "telephone number" would be ipv6:port. "Ringing" and video/audio streams setup would be done here. End to end encrytion right from the start (only manual key exchange, zero automatic, even before ringing).
On top, a "comfort protocol"(one level of indirection) for those changing ipv6, but not "accutely roaming", namely changing ipv6 while in a video/audio call: a "DynDNS" but simpler, more a "current IPv6:port of 'name' kind of thing", "address book with a drop of dynamic", "name@server" and you get the current ipv6:port. Unfortunately, it means "accounts" and real time updates. Of course, "server" could be a local/dns/ipv6. I am thinking zero password, only a public key.
For video/audio streams, I may not bother and go TCP. The main constraint would be the timing information shared among video/audio streams. No "internet weather" dynamic reconfiguration.
I even consider going "horribly horrible" for internet: idiotic binary based instead of text based protocols.
One thing that is making me REALLY MAD is that there are NO IPV6 TRUNK PROVIDERS in the US. Not a single one. At least none where I can just enter my credit card and get a phone line.
Somehow, the protocol designed to restore the end-to-end connectivity is not used for the poster child of end-to-end connectivity.
I'm curious why not sipgate, which I currently use, or Twilio which I half-use (it mostly forwarded to my own Asterisk server, which needs some attention).
[0] https://help.sipgate.de/hc/de/articles/4407798852113-sipgate...
We offer a virtual PBX based on Asterisk, Kamailio and Matrix/Element in Germany.
I use WebRTC with Asterisk, and Browser Phone for the client (https://github.com/InnovateAsterisk/Browser-Phone). I don't use it much, but good enough for the rare times I have to use the phone.
You can get a bunch of /64s and a /48 for free because HE really wants everyone to have IPv6 available already. Picking the right internet exchange to route from and making Netflix not throw a fit requires some minor experimentation but I've found it to work quite well.
As an added bonus, because of the way IPv6 route advertisements work, you don't have to have a router with tunneling support. You can set up advertisements from any Raspberry Pi or other computer as long as it has outbound connectivity.
None of the 4 VoIP providers I've worked with support IPv6 :-/
You mean send the advertisement and do the SIT tunneling on that machine?
You use one of the /64 tunnels provided for you to route the /48 tunnel to the rest of your network. You advertise a subnet from your /48 to your local network and if you've got SLAAC enabled on your hosts that's all there is to it.
You may need to mess with the default DNS server to get IPv6 results, though, that depends on whether or not your standard DNS server will respond to AAAA requests. It usually should, but some ISPs don't.
This only works for a flat network, of course. If you've got different routers, you'll need to set up a more complicated setup.
The only person that I did call using the landline is my father, but his VoIP system is unreliable.