Converting a P.O.T.S line to VoIP and simultaneously ringing a extension over VPN

Question

Anyone with knowledge please help. I have analog phone service + internet at SITE 1.

I only have internet service at SITE 2.

When the phone rings at SITE 1 I would like the PC or an attached phone at SITE 2 to answer it. I also need the ability to call out from SITE 2, ultimately exiting from the SITE 1 analog service.

At both sites the PC is behind a dedicated pfSense firewall box then the respective internet modem.

I do not care if the forwarded call goes through a VPN or not. I need the cheapest and easiest way to accomplish this. But I do not want to use a third party cloud-based service or similar. I plan to set up OpenVPN-type VPN between the two sites. If it's easy to use this VPN for extending my analog line then fantastic. If it's better to avoid my VPN and just use two modem-connected devices that's fine too. I do not want 3rd party services or monthly fees. I want a closed system where all of the hardware and connections are under my direct control.

Please note, I am an absolute noob to all this. Should I use some kind voicemodem, ATA card, telephony card, or some other device(s) at one or both sites? Is there such a thing as call-forwarding to IP software that I can use, both ways?

Pretend you are explaining to a third grader. I need specific details of what connects where, using what software, if any. Thanks.

current setup

what I need

Answer 1

I am writing these instructions with VLANS, as thats what is recommended for VOIP when building this from the ground up. Dont fret if you dont have this equipment, you can use physical interfaces in any instruction that mentions VLANS, just replace it with your interface name. In my setup i used cisco SG-300 10p small business switches.

There are a couple of reasons you'd want to use a switch in the way I am about to describe.

1. It's a Gigabit POE switch, no need to deal with power bricks for the phones.
2. Switches have ASIC hardware (Application specific intergrated hardware) and deal with traffic more effciently than pfsense will.
3. Managed VLAN Capable switches allow you to fully utilize a single port on the Pfsense box (effective use of trunking allows you save on precious router ports for expansion later)

Let's get started. Assuming this is a fresh install of Pfsense 2.x (dont know if they ever brought the packages back to the newer versions) my installation is running 2.2.6

At this point you want to set up the interfaces, make sure its a Gigabit NIC

I used
"re0 vlan_10" for the WAN interface (setup for DHCP)

       "re0 vlan_20" for the VOICE interface = 10.10.20.1 /24

       "re0 vlan_30" for the LAN interface   = 10.10.10.1 /24 (DHCP pool)

       "re0 vlan_40" for the WLAN interface = 10.10.40.1 /24

       "re0 vlan_50" for the CAM interface    = 10.10.50.1 /24

On the switch create a 802.1q trunk port and tag it with vlans 10,20,30,40,50. connect the port you just configured to the port you just setup in pfsense. (if you are just using interfaces skip this step) Additionally, map a port to vlan 10 untagged and connect this to the ISP modem.

Map one of the switch ports to vlan 30 untagged. Connect it to a computer, you should receive DHCP from pfsense and be able to reach the web managment interface on 10.10.10.1. Follow the inital wizard to complete setup. (connect to LAN Port if just using interfaces)

set-up DHCP pools for the VLANS/Interfaces the require it under Services > DHCP Server

At the first location you are going to want to run the dynamic DNS service and connect it to something like "no-ip.com" this will give you a FQDN like (mydomain.noip.me). The reason you want to do this is because most ip numbers on the WAN side change. This service is a dameon that relinks yourdomain.noip.me to the new number when it changes. If you skip this step you will most likely have to travel to the client VPN location to put in whatever the new ip number is. (or make a WAN rule for remote management.)

Next install the asterisk package, its under System > Packages > Asterisk. It can then be configured under status > asterisk > edit configuration you need to bind it to your voice vlan/interface in gtalk.conf under the [general] section (dont leave it at 0.0.0.0 as it will listen for registrations on each interface by default including the wan connection) The full instructions for getting asterisks up and functional for this, would qualify as an additional question, follow the information below and feel free to submit any additional questions.

For phones, I used AASTRA 6739i's (I was given a box of them for free) they work extremely well, I have also used csipsimple on android and that works well. You can pretty much use any sip soft client you prefer, I would avoid used cisco phones. The prices are tempting for used ones but it's nearly impossible to get it working outside of their intended software (cisco call manager).

This should get you basic calling between two extensions http://go2linux.garron.me/asterisk-simple-configuration-how-to/

Here is a guide for using asterisk with FXO Cards. This would be good question to ask in the Pfsense section. I do not have experience in configuring fxo cards in Pfsense, as I'm basically using google voice as a digital trunk. (instructions will be dependant on the chosen card. Google is your friend.) ;) http://www.onlamp.com/pub/a/onlamp/2004/01/22/asterisk2.html

configure OPENvpn server (site-1) I used certificates in my setup, because I have roaming internet clients. So for my particular setup, I wanted to be able to revoke a devices certificate if it was lost or stolen. For a site to site you probably dont need to go crazy with the setup. Additionally the higher the encryption goes (in bit numbers) the more work the Pfsense box must process. https://doc.pfsense.org/index.php/OpenVPN_Remote_Access_Server

Now would be a good time to configure QOS (Quality of service). Its under firewall > traffic shaper I used HSFC in my setup, which happens to be the most complicated of all available traffic shapers in PFsense. It can be very effective for VoIP on links that degrade quickly, such as 3G/4G, but it can be complex to configure and tweak for proper operation. Depending on your specific requirements you can deviate from my recommendations. If you have multiple services running on your network this is an extremely important step. Ideally you want service priority in this order. For hfsc, the range is 0 to 7. The default is 1. Hfsc queues with a higher priority are preferred in the case of overload.

Network control / acknoledgments (highest)7

Voice-6

Video-5

Reserved-4

Web Traffic-3

Bulk Traffic-2 (FTP/TFTP etc)

P2P traffic-1 (lowest)

googling "Pfsense hfsc tutorial" is how I learned how to use it. This is also a nice reference, https://doc.pfsense.org/index.php/Traffic_Shaping_Guide

Once you have traffic shaping setup, its time to apply it to the network traffic. You can expect to traverse your network. In the firewall rules start allowing or denying traffic. The order of the rules is important, they are checked by the firewall top down, so if a rule doesnt match, it go's to the next one and so on untill it reaches the bottom. I put my default LAN rules at the bottom and put it in the lowest queue. Essentially this means if someone is using a service that wasn't deliniated, it won't disrupt important network traffic. You can think of it as a last ditch effort/catch all to put unwanted traffic in the p2p queue.

Example of a rule created and applied to a queue, you apply it under the advanced section when making the rule.

you can test your qos queues by going to status, then queues. Make a test call and make sure its in the right queue. This can be tested this way with each type of traffic.

At this point you should have a functional VPN, functioning asterisk server with a pots incomming call directed to both extentions.

You may need to enable the jitter buffer function, and its recommended on varying latency WANs. But you may not know if you need it until you set-up the second site. (simple function added to the extension)

@Gizzy, I will probably update this multiple times this next week, when i have time to dedicate to it.

Answer 2

Voice can be tough.

Look at a device call an ATA. They will take VoIP to Analog and Analog to VoIP depending on the various models.

The reason I say voice is tough is because you will likely have networking that needs to be considered and maybe limited functionality.

Would having the carrier do call forwarding work for you?