sync: auto-sync from GURU-5070 at 2026-06-09 16:18:12

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-06-09 16:18:12

session-logs/2026-06/2026-06-09-mike-dataforth-freepbx-safesite-forensics.md

@@ -71,3 +71,11 @@ Third thread: **Safesite (Safe Site Utility Services)** forensic review of a rec
 - **Coord:** todo `5766a59f-0ddf-43d8-b16b-1c60024a3c04`; broadcast `faaec0ce-ed5f-4e0f-8693-904a3d000c38`.
 - **Artifacts on GURU-5070:** `~/Downloads/safesite-recall-proof.json`, `~/Downloads/safesite-forensic-results.txt`.
 - **Forensic cmd ids (Safesite re-dispatch):** 86340d9b, 8d3e6530, 9aa25e67, 1cf8dfea, 3322e787, 16b2a2b1.
+
+## Update — Dataforth outbound no-audio (RTP forward removed)
+
+After the inbound fix, outbound calls connected but had **no audio** (FirstDigital confirmed they saw no audio sent from us). Packet capture: FD→PBX RTP flowing, **PBX→FD RTP = 0**. Root cause: the static **RTP port-forward** I'd added on the UDM (WAN UDP 10000-20000 → 192.168.100.2) created an inbound-initiated conntrack that **collided with the PBX's outbound RTP** to the same ports — inbound RTP arrived via the DNAT (one-way audio), outbound RTP was dropped.
+
+**Fix:** removed the RTP DNAT + forward-accept from the UDM; kept **only** the SIP 5060 forward. Media now flows both ways via **symmetric RTP pinholes** (standard FreePBX-behind-NAT). Verified: outbound call answered **59s with two-way audio**. `/data/on_boot.d/30-freepbx-sip-forward.sh` rewritten to SIP-only with a warning comment.
+
+**RULE: do NOT port-forward the RTP range for this trunk — it breaks outbound audio. SIP 5060 forward only.** (Supersedes the RTP-forward line in Configuration Changes above.) Logged on #32392.