pfSense or DD-WRT or a simple RV082?

If you want to avoid NAT completely add a second network card to your TB and use it to control your internet connection. For the firewall configuration I prefer shorewall which is a way of creating the required Iptables rules to set up a Linux firewall and their is even a webmin module for it so you can have a web interface just like an appliance box (most of which are embedded Linux anyway).

I've done this on several boxes some TB with remote extensions and some plain CentOS servers.

set up the second NIC so that the interface is up without an ip and run adsl-setup to configure you dsl connection to use the new interface. Select no firewall during the adsl-setup script as you need to set that up separately.

I can provide more instructions if you are interested.

To make the picture a bit more clear, we only have one main location and today we have 5 independant sales reps spread 1000 miles from the office that work mainly from their home offices or small offices fom wich we are not willing to purchase any hardware, all of them have DSL bandwidth inet connections and laptops. We are joining another 3 sales reps wich need to connect as well. None of this have a fixed IP, however it is one phone per connection. Adjustments to those connections can be reasonably done to make a fair QoS work for them. As to the http tunnels we are not getting into that, I´ll explain why. 9 out of 10 small business and home ISP is provided by Prodigy (Telmex) wich have announced that doing VPN for transporting VoIP or Video by IP are going to be banned, disconnected, fined and possibly sued, this is because Telmex is going into triple play within the next 60 days and of course they want their infraestructure unused to keep ripping off their clients, just picture this, in Spain you can get 30 mbps down / 6 mbps up for 35 euro. I guess in the States you can get quite similiar deals; well in Mexico we pay 35 usd for 1 mbps down / 256 kbps up and if you want a VPN you must get into a Service Level Agreement. I can do that for the main office, event change ISP, but just cant for every single remote user we hire, so VPN is a no no here.

As to the SonicWall, I have no experience with that brand, however I´ve read many opinions saying those make all in one, and none of those is well done so...

As to running the soft firewall in the same Trixbox unit, just as Scott says, that is a no-no too, specialy if you consider I am very Linux illetare (just learning).

What I see as a good way to go is just having the remote SIP peers to connect directly to the Trixbox box and rely on a small set of pinholes and MD5 digest security. Perhaps I am lost in space beleiving this is possible? Theorically it is but so far have no success achieving this.

Does anyone have any experience with a router flashed with DD-WRT for VoIP? or any router capable of effectivelly *not* messing RTP headers? Is this linksys RV-082 capable of that?

Thanks all for your advise!

As to

VOIP Newbie

Look online and get a cheap box (ebay, refurbished dell, etc).. They're usually a couple of hundred bucks.. Get 2 Intel Nics (about $30.00 a piece) and run pfsense.

Better performance, better throughput, less pain.

I'd also suggest pfSense. I really like running a PC based router/firewall because you get reliable and equivalent feature, for half the cost.

Look on CraigsList... I got myself a IBM ProLiant 2.8GHz 2GB ram for just $135, works like a champ. Not to mention local pickup means no waiting, haha.

www.pfsense.org

For what it's worth, sonicwall isn't exactly much easier than pfsense. As for a "VOIP" firewall, it's nothing more than a firewall with QoS and that is something pfsense supports out of the box.

As for installation, installing a CD isn't exactly rocket science. Stick the CD in a machine and it'll install it all for you (relatively easy).. or you could hire any one of us to do the installation for you. I could get a pfsense box up and running in about 10 min. configured for "VOIP" with QoS.

Just a sidenote.. Understanding how your network works is probably a good thing to learn for troubleshooting issues.

If you can install trixbox, you can install pfsense.

Cheers.

The processor, memory and hard disk requirements for a firewall largely depend on how many other things you want to do with it. For example, Smoothwall offers SIP call tracking on firewall level. It can also do a virus check on incoming mail as well. QOS is standard as well. PFSense is very similar, but more firewall focused. Both solutions are typically used as gateway firewalls to protect your entire landscape. In general they typically exceed appliance firewall solutions in flexibility and performance.

If you installed Trixbox I would think that you won't have any issues to install PFSense. The QOS part is pretty much self explaining and a simple setup with two network cards and one IP address should only take about an hour to install and configure.

For starters you should be fine with the default rules and then you can limit those over time. Configuration is being done through a relatively user friendly web portal.

In my opinion it isn't necessarily easier to configure a firewall appliance unless you use their typically expensive support packages. I previously used a WatchGuard firewall which was very easy to setup, but it lacked some customization options PFSense and Smoothwall offer.

Best regards,
Jens

What were causing a conflic, and I don´t know if this is already documented but, this causes trixbox not to work properly; I read a post here http://pbxinaflash.com/forum/archive/index.php?t-267.html
where what is described actually causes a conflict and when those changes are done the conflic is gone.

It consist of a confusion when we use the same host as the server host and the same host name is indicated in the hosts files where Trixbox adds yourpseudo.dyndns.org pointing to 127.0.0.1 and at the same time, the sip_nat.conf uses externhost=yourpseudo.dyndns.org and that makes the remote SIP peers not to have audio, or dropping calls at 20 secs. I simply changed that entry in /etc/hosts from yourpseudo.dyndns.org to generichost or any other name but not the externhost name.

Hope this brings in some light to someone experiencing the same issues in the future.

As of all of you who guided and advised me, thank you again! pfSense not for now, my Thomson Router is doing like a charm (so far)

Thanks again

VOIP Newbie