SPI Firewall, Netgear WGT624

Posts: 2 · New Forum Member Joined: Jan 28, 2004 Posts: 2

THE QUICK: If you are having problems and have a Netgear or any other vendor’s broadband router with an SPI firewall, try disabling the SPI functionality and resetting everything including the vonage ATA.

I’ll start by saying, I don't envy any of you having problems with your Vonage service. After being a user of the service for over a year, I’ve luckily had very few problems – but know several other people who haven’t been so lucky.

So, when I replaced my Linksys broadband router with a Netgear WGT624 wireless broadband router it was wishful thinking there would be no problems. So of course, everything worked perfectly with the new wireless router – EXCEPT the Vonage service.

I emailed Vonage customer support. A week later the only response was the automated one with the faq. So I started calling. That was fun. A couple of times after navigating the selections for tech support, it just played a message saying to call back later. Frustrating, I’d have preferred to wait for an agent. So after a couple of days and finally someone picks up.

To make this shorter, lets just say that after a long conversation including hearing other people chip in over the guy’s shoulder, resetting everything a dozen times, they were baffled. As luck would have it, my cell phone died after they seemed to be running out of answers.

Before the call I had already tried:
- port forwarding
- putting ATA (Cisco 186) into DMZ
- disabling SPI (but had not rebooted the ATA – my fatal mistake)

So after the call I went at it again and finally figured out that if I disabled the SPI firewall and recycled the ATA it would function. Simple, right?

But I don’t want to keep the SPI disabled. It doesn’t stop all the other firewall capabilities of the router but it can protect against DOS and other automated network attacks so I’d like to get the functionality back.

I’ve got a note into Netgear tech support (we’ll see how long that takes). I’ll post their answers here if I can find out anything.

I wish all of you good luck.

Guest

This is exactly the same issue I have with my Netgear WGR614 Wireless Router and my Motorola VT1005. To go one step further with the DMZ configuration, my Vonage service would fire up for about 2 minutes and then cut out.

In order to keep the Vonage running I have to place it in front of the router, but it seems to require frequent rebooting. The annoying part is that this worked fine behind the Dell TrueMobile 2300 wireless, but the wifi signal range was garbage.

Any suggestions out there?

Clarke_Craft

Posts: 2 · New Forum Member Joined: Jan 28, 2004 Posts: 2

Unfortunately, I’ve got a Cisco 186 which doesn’t have a passthrough, so I’m forced to disable the SPI protection feature to use the service, which works fine but I’d like the extra protection for my network.

For those who haven’t had to deal with it, SPI is Stateful Packet Inspection, which looks at inbound network traffic and blocks packets that appear to be “attacks” like denial of service. The hard part with this technology is that there’s no standard way for vendors to implement this type of defense so it may only be that Netgear has a problem with the Vonage data streams.

So, at least with my Netgear, if you turn it off everything works. But I am working with Netgear tech support, who by the way got in touch with me within 24 hours, Vonage should learn from them!

I’ll post more information as I work through this with Netgear.

Guest

Thanks-

Please do post your reply from netgear. My Motorola is now living behind my WGT624. I couldn't even get mine to work using DHCP. With a static private IP on the ATA and the same IP reserved in the router pool everything is working, but given all its taken to get me this far I haven't dare mess with anything like switching SPI on.

As a side note:-
I have decided to hold off on dropping my POTS connection since the quality on the vonage calls isn't all it can be - can get significant cutting out during calls. I have been getting a lot of packet loss on the last hop to my ISP (wireless). They are supposed to be coming out take another look at my install - can't blame vonage for that. Sticking with vonage for now, and hoping that I will save enough on outgoing LD to pay for the service. Time will tell.

Posts: 21 · Vonage Forum Associate Joined: Feb 15, 2004 Posts: 21

This past Monday (Feb 9th) I purchased a WGT624 V2 and it was already loaded with the latest December firmware. Vonage worked fine for a couple days and then I experienced intermittent failures. I had to continually reboot the ATA to get it working again. Sometimes it would work for a few hours and sometimes it would quit during the first call.

When I read this thread, I tried disabling SPI. Despite rebooting my cable modem, my router and then my ATA, things didn't improve. In fact, with SPI disabled, my router would no longer support VPN to my corporate office. I found this strange but since the WTG624 does not have a separate "enable PPTP/L2TP" option, perhaps enabling SPI means more than just stateful packet inspection.

I think I have my problem fixed

Last night I reserved the IP address of my Cisco ATA 186 Vonage device and then per a Vonage tech support article, I forwarded the following ports:



PORT   PORT        FORWARDED TO


START  END   PROTO IP ADDRESS


====== ===== ===== =============


  5060  5061  UDP  172.25.25.100 


    53    53  UDP  172.25.25.100 


    69    69  UDP  172.25.25.100 


 10000 20000  UDP  172.25.25.100

Note:
I reserved 172.25.25.100 for my ATA -- my inside private IP subnet is 172.25.25.x IP address will vary depending on your network configuration...

So far (last night and all day today), Vonage has been working fine with no ATA reboots. In fact, Vonage is now more robust in that I don't have to cycle the power on the ATA when I reboot the router. (Unfortunately, the WGT624 reboots itself whenever you change most settings.)

Posts: 6 · New Forum Member Joined: Feb 15, 2004 Posts: 6

Well, getting the Motorola behind the Netgear WGR-614 seems to be hopeless.

I've taken the Netgear to the latest firmware. Tried all the Port forwarding tips from a Vonage support tech. I tried making the MTA a static box setup as a DMZ server in the Netgear. I tried turning of the SPI Firewall.

The Vonage tech also upgrade the MTA to a newer firmware. They also change the keep alive setting on the MTA so that the Netgear would not lose the box.

After all this, I could get dial tone when using the default settings on the netgear while using Port Forwarding. This dial tone would last about 30 - 120min and then would require a reboot. Also there was sever latency between the incoming call and ring of my phone. The tech tried calling it and it rang my phone when he hung up.

I've decided to leave the MTA in front for now untill I can get a dedicated router or Vonage finds way to get the WGR-614 to work reliably.

Let me know if any of you have any suggestions.
Clarke_Craft

Posts: 5 · New Forum Member Joined: Feb 16, 2004 Posts: 5

I have a Netgear FWAG114 firewall/router and have exactly the same problem. I've tried all the same configs you have, and get the same problem: connectivity drops out after about a half hour.

So I'm now using the MTA in front of the firewall. The problem with that is that it degrades download speed for my network. I'm still working with Vonage Tech Support to figure out the problem.

My next try will be putting them "side-by-side" behind the cable modem (I think my ISP will let me use one DHCP-assigned address plus the static one that I have now). But that means putting a switch, and I'm tired of adding pieces of equipment there. Groan.

It seems that there's definitely a problem between the VT1000 and Netgear firewalls though.

Posts: 21 · Vonage Forum Associate Joined: Feb 15, 2004 Posts: 21

Well I thought I had things fixed but even with the port forwarding, it's hit or miss. Sometimes it will quit after a few minutes and other times it will work for hours and hours. What's really odd is that sometimes I can't dial out but if I wait a while it will fix itself! Or, just after finishing a failed dial attempt, the phone will ring and an incoming call will work fine.

Today my wife said she couldn't dial out all day but INCOMING calls worked! This really is an odd one. What's odd is that all the while, web access from a second PC behind the WGT624 works just fine so I know my cable modem and the WGT624 are cooperating and that the WGT624 is not rebooting.

I sent an e-mail to NetGear asking them if they had any suggestions. I received an automated FAQ response that said if these things didn't solve my problem (and they were totally unrelated) reply to the FAQ an an engineer would read the problem and reply. Still waiting...

In the meantime I managed to find an old hub at work and I brought it home and I'm sniffing with Ethereal. I have had one failure where I couldn't dial out but I didn't have the packets that lead up to the failure. I unplugged the ATA and it reinitialized itself and I'm waiting for another failure. This is really an odd problem and it's amazing how often the ATA ARPs for its own IP Address (it seems that it feels the need to continually ensure that it is the only one with it's own IP address). Not only that but every few seconds, a Vonage server is "pinging" the ATA and the ATA responds. Here's a sample of the sniff:



TIME       SRC              DEST          PACKET INFO


140.002053 216.115.25.35 -> 172.25.25.101 SIP Request: NOTIFY sip:nouser@216.115.25.35


140.013085 172.25.25.101 -> 216.115.25.35 SIP Status: 200 OK


146.591215 172.25.25.101 -> Broadcast     ARP Who has 172.25.25.101?  Tell 172.25.25.101


150.028935 216.115.25.35 -> 172.25.25.101 SIP Request: NOTIFY sip:nouser@216.115.25.35


150.037770 172.25.25.101 -> 216.115.25.35 SIP Status: 200 OK


156.595584 172.25.25.101 -> Broadcast     ARP Who has 172.25.25.101?  Tell 172.25.25.101


160.012953 216.115.25.35 -> 172.25.25.101 SIP Request: NOTIFY sip:nouser@216.115.25.35


160.022347 172.25.25.101 -> 216.115.25.35 SIP Status: 200 OK


166.600455 172.25.25.101 -> Broadcast     ARP Who has 172.25.25.101?  Tell 172.25.25.101


168.024968 172.25.25.101 -> 216.115.25.35 SIP Request: REGISTER sip:preproxy4.vonage.net:5061


168.065607 216.115.25.35 -> 172.25.25.101 SIP Status: 200 OK    (1 bindings)


170.015400 216.115.25.35 -> 172.25.25.101 SIP Request: NOTIFY sip:nouser@216.115.25.35


170.027101 172.25.25.101 -> 216.115.25.35 SIP Status: 200 OK


176.604836 172.25.25.101 -> Broadcast     ARP Who has 172.25.25.101?  Tell 172.25.25.101


180.019190 216.115.25.35 -> 172.25.25.101 SIP Request: NOTIFY sip:nouser@216.115.25.35


180.031687 172.25.25.101 -> 216.115.25.35 SIP Status: 200 OK


186.609718 172.25.25.101 -> Broadcast     ARP Who has 172.25.25.101?  Tell 172.25.25.101


190.012935 216.115.25.35 -> 172.25.25.101 SIP Request: NOTIFY sip:nouser@216.115.25.35


190.026235 172.25.25.101 -> 216.115.25.35 SIP Status: 200 OK


191.802545 172.25.25.101 -> CDP/VTP       CDP Cisco Discovery Protocol

NOTES:
My inside network is 172.25.25.x 255.255.255.0
Router is 172.25.25.1
ATA is on DHCP-acquired IP of 172.25.25.101
Sniffing machine is 172.25.25.100
Time is seconds since the sniff was started

I'm hopeful that the sniffing will turn up something and I can make an adjustment. However, I think I'm only sniffing half the picture. If this doesn't give me any clues, I'm going to have to punch down my sniffing machine's second NIC in front of my router and watch both sides to determine exactly what's happening and hopefully why. Problem is, I need another HUB and it was tough finding a hub. I have a LinkSys 5-port workgroup hub but it's really a switch, not a hub. I can't get a damn thing out of it except packets bound for the sniffing machine.

If anyone sees anything in my sample sniff (above), please let me know. I'm beginning to wonder if it's normal for Vonage's servers to request notification this frequently. I'm wondering if my ATA's "I'm here" cries are even being heard through the router. If not, that could explain why the Vonage servers are requesting notification so frequently. If this is standard operating procedure, I can't imagine any router closing the socket due to inactivity. I don't think I've witnessed more than 30 seconds without some sort of request/response going on between Vonage adn the ATA. Of course that's what it looks like. I'm not sure if the response is actually making it out the other side of the ATA.

At first I thought it might be related to Vonage's 10Mbit/sec half-duplex operation and the WGT624 not handling it correctly and then shutting the port down or reinitializing the port because it wants to negotiate a faster rate. I don't know if the sniffer will show this but I thought it was odd that the ATA was 100Mbit/sec half-duplex.

Posts: 17 · Vonage Forum Associate Joined: Nov 29, 2003 Posts: 17

My Ethereal showed the same time frame between ARP's. I also have a Csco186 and netgear WGR614v2, Vonage has been working on an intermittent problem where by a call will not go through. I do not use Vonage for incoming calls at all. The outgoing problem I think is more related to Vonage network then anything else because it tends to affect locales-ie. Florida calls have trouble for a while and local calls are OK, then another time the opposite happens. Usually its in the daytime not at night. the frustrating problem is that its inconsistent. Vonage saw my issue on this forum and emailed me This is what started me on this. I have not pushed too hard but I think the Wife is getting more fed up.

Posts: 21 · Vonage Forum Associate Joined: Feb 15, 2004 Posts: 21

I posted a follow-up to this thread last night but it has now disappeared. I asked the forum moderator what happened to it. Perhaps I said something wrong.

Anyway, it's gone and I found a few things out last night. After what seems like a Random period of time, the WGT624 will just stop allowing the ATA to use port 5061 when the ATA issues an INVITE command. The ATA issues INVITE about six times in a row with no response from the Vonage servers. I have not established whether this is because the 624 has shut down the incoming 5061 port to the ATA or whether it's stopping the ATA from even sending the INVITE. I have to get a second hub and watch the conversation on the other side. I plan on doing that tonight.

What's intereseting is that after the INVITE fails, the ATA queries DNS to ensure that it has the right address for the Vonage SIP proxy server. Then it ARPs for the gateway MAC address, to which the router replies and provides the MAC address. All communication is not cut off, just the INVITE command. If I reboot the ATA, things work again. If I reboot the router, things work again.

I tried port triggering and I tried raising the timeout from the default 20 minutes to 600 minutes but that didn't seem to help matters.

What's odd is that in every other way the NetGear is a flawless router. I really like the signal strength -- much improved over my former D-Link 614+ router. It also works fine for web browsing, VPN (provided SPI is enabled) and all other functions I ask of it. It just really stinks when I try to use it with Vonage. I don't know if I'm getting anywhere with NetGear and I may have to return the router. I have until next Monday before my 14 day return grace period is over. (I was stupid and bought it at CompUSA and they'll charge me a "restocking" fee unless it's bad and they replace it with the exact same unit...)