I use an IPFire (linux) router as a VPN client. My voice-over-IP is working properly without the VPN active. However, when the VPN is up, my SIP client (Twinkle) can't register with my VoIP provider. Normally, my VPN is up all the time. So I need to make VoIP work with the VPN.uname -aLinux ipfire 3.14.65-ipfire #1 SMP Wed May 4 03:06:53 GMT 2016 x86_64 GNU/LinuxVPN is by privateinternetaccess.com.  I start my VPN client with:modprobe tunopenvpn --config /var/ipfire/ovpn/my_vpn.conf --daemonThe port forwarding settings I am using are:On  Proto   Src     Port        Destination    DescriptionOn  UDP     RED     5060        192.168.1.1     SIP_voipOn  TCP     RED     5060        192.168.1.1     SIP_voipOn  UDP     RED     8000        192.168.1.1     SIP_twinkle_RTPOn  UDP     RED     8001        192.168.1.1     SIP_twinkle_RTPOn  UDP     RED     8002        192.168.1.1     SIP_twinkle_RTPOn  UDP     RED     8003        192.168.1.1     SIP_twinkle_RTPOn  UDP     RED     8004        192.168.1.1     SIP_twinkle_RTPOn  UDP     RED     8005        192.168.1.1     SIP_twinkle_RTPHere are my openvpn client settings:clientdev tunproto udpremote example.comport 1194resolv-retry infinitenobindpersist-keypersist-tunca /var/ipfire/ovpn/ca.crttls-clientremote-cert-tls serverauth-user-passcomp-lzoverb 1reneg-sec 0crl-verify /var/ipfire/ovpn/crl.pemping 15ping-restart 45iptables rules ($ sudo iptables -S):-P INPUT DROP-P FORWARD DROP-P OUTPUT ACCEPT-N BADTCP-N CONNTRACK-N CUSTOMFORWARD-N CUSTOMINPUT-N CUSTOMOUTPUT-N DHCPBLUEINPUT-N DHCPBLUEOUTPUT-N DHCPGREENINPUT-N DHCPGREENOUTPUT-N DHCPINPUT-N DHCPOUTPUT-N FORWARDFW-N GEOIPBLOCK-N GUARDIAN-N GUIINPUT-N ICMPINPUT-N INPUTFW-N IPSECBLOCK-N IPSECFORWARD-N IPSECINPUT-N IPSECOUTPUT-N IPTVFORWARD-N IPTVINPUT-N LOG_DROP-N LOG_REJECT-N LOOPBACK-N NEWNOTSYN-N OUTGOINGFW-N OVPNBLOCK-N OVPNINPUT-N P2PBLOCK-N POLICYFWD-N POLICYIN-N POLICYOUT-N PSCAN-N REDFORWARD-N REDINPUT-N TOR_INPUT-N UPNPFW-N WIRELESSFORWARD-N WIRELESSINPUT-A INPUT -p tcp -j BADTCP-A INPUT -j CUSTOMINPUT-A INPUT -j P2PBLOCK-A INPUT -j GUARDIAN-A INPUT -i tun+ -j OVPNBLOCK-A INPUT -j IPTVINPUT-A INPUT -j ICMPINPUT-A INPUT -j LOOPBACK-A INPUT -j CONNTRACK-A INPUT -i green0 -j DHCPGREENINPUT-A INPUT -i blue0 -j DHCPBLUEINPUT-A INPUT -j GEOIPBLOCK-A INPUT -j IPSECINPUT-A INPUT -j GUIINPUT-A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT-A INPUT -j OVPNINPUT-A INPUT -j TOR_INPUT-A INPUT -j INPUTFW-A INPUT -j REDINPUT-A INPUT -j POLICYIN-A FORWARD -p tcp -j BADTCP-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu-A FORWARD -j CUSTOMFORWARD-A FORWARD -j P2PBLOCK-A FORWARD -j GUARDIAN-A FORWARD -m policy --dir out --pol none -j IPSECBLOCK-A FORWARD -i tun+ -j OVPNBLOCK-A FORWARD -o tun+ -j OVPNBLOCK-A FORWARD -j IPTVFORWARD-A FORWARD -j LOOPBACK-A FORWARD -j CONNTRACK-A FORWARD -j GEOIPBLOCK-A FORWARD -j IPSECFORWARD-A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD-A FORWARD -j FORWARDFW-A FORWARD -m conntrack --ctstate NEW -j UPNPFW-A FORWARD -j REDFORWARD-A FORWARD -j POLICYFWD-A OUTPUT -j CUSTOMOUTPUT-A OUTPUT -j P2PBLOCK-A OUTPUT -m policy --dir out --pol none -j IPSECBLOCK-A OUTPUT -j LOOPBACK-A OUTPUT -j CONNTRACK-A OUTPUT -o green0 -j DHCPGREENOUTPUT-A OUTPUT -o blue0 -j DHCPBLUEOUTPUT-A OUTPUT -j IPSECOUTPUT-A OUTPUT -j OUTGOINGFW-A OUTPUT -j POLICYOUT-A BADTCP -i lo -j RETURN-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j PSCAN-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j PSCAN-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j PSCAN-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j PSCAN-A BADTCP -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j PSCAN-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j PSCAN-A BADTCP -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j PSCAN-A BADTCP -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j NEWNOTSYN-A CONNTRACK -m conntrack --ctstate ESTABLISHED -j ACCEPT-A CONNTRACK -m conntrack --ctstate INVALID -j DROP-A CONNTRACK -p icmp -m conntrack --ctstate RELATED -j ACCEPT-A CONNTRACK -m conntrack --ctstate RELATED -m helper --helper sip -j ACCEPT-A CONNTRACK -m conntrack --ctstate RELATED -m helper --helper h323 -j ACCEPT-A CONNTRACK -p tcp -m conntrack --ctstate RELATED -m helper --helper ftp -m tcp --dport 1024:65535 -j ACCEPT-A CONNTRACK -m conntrack --ctstate RELATED -m helper --helper irc -j ACCEPT-A DHCPBLUEINPUT -i blue0 -j DHCPINPUT-A DHCPBLUEOUTPUT -o blue0 -j DHCPOUTPUT-A DHCPGREENINPUT -i green0 -j DHCPINPUT-A DHCPGREENOUTPUT -o green0 -j DHCPOUTPUT-A DHCPINPUT -p udp -m udp --sport 68 --dport 67 -j ACCEPT-A DHCPINPUT -p tcp -m tcp --sport 68 --dport 67 -j ACCEPT-A DHCPOUTPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT-A DHCPOUTPUT -p tcp -m tcp --sport 67 --dport 68 -j ACCEPT-A FORWARDFW -d 192.168.1.1/32 -i red0 -p udp -m udp --dport 5060 -j ACCEPT-A FORWARDFW -d 192.168.1.1/32 -i red0 -p tcp -m tcp --dport 5060 -j ACCEPT-A FORWARDFW -d 192.168.1.1/32 -i red0 -p udp -m udp --dport 8000 -j ACCEPT-A FORWARDFW -d 192.168.1.1/32 -i red0 -p udp -m udp --dport 8001 -j ACCEPT-A FORWARDFW -d 192.168.1.1/32 -i red0 -p udp -m udp --dport 8002 -j ACCEPT-A FORWARDFW -d 192.168.1.1/32 -i red0 -p udp -m udp --dport 8003 -j ACCEPT-A FORWARDFW -d 192.168.1.1/32 -i red0 -p udp -m udp --dport 8004 -j ACCEPT-A FORWARDFW -d 192.168.1.1/32 -i red0 -p udp -m udp --dport 8005 -j ACCEPT-A GUIINPUT -i green0 -p tcp -m tcp --dport 444 -j ACCEPT-A ICMPINPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT-A INPUTFW -s 192.168.1.0/24 -d 192.168.1.251/32 -i green0 -p tcp -m tcp --dport 53 -j ACCEPT-A INPUTFW -s 192.168.1.0/24 -d 192.168.1.251/32 -i green0 -p udp -m udp --dport 53 -j ACCEPT-A INPUTFW -s 192.168.2.0/24 -d 192.168.2.250/32 -i blue0 -p tcp -m tcp --dport 53 -j ACCEPT-A INPUTFW -s 192.168.2.0/24 -d 192.168.2.250/32 -i blue0 -p udp -m udp --dport 53 -j ACCEPT-A INPUTFW -d 10.0.0.114/32 -p tcp -m tcp --dport 22 -m limit --limit 10/min --limit-burst 20 -j LOG --log-prefix INPUTFW -A INPUTFW -d 10.0.0.114/32 -p tcp -m tcp --dport 22 -j DROP-A LOG_DROP -m limit --limit 10/min -j LOG-A LOG_DROP -j DROP-A LOG_REJECT -m limit --limit 10/min -j LOG-A LOG_REJECT -j REJECT --reject-with icmp-port-unreachable-A LOOPBACK -i lo -j ACCEPT-A LOOPBACK -o lo -j ACCEPT-A LOOPBACK -s 127.0.0.0/8 -j DROP-A LOOPBACK -d 127.0.0.0/8 -j DROP-A NEWNOTSYN -m comment --comment DROP_NEWNOTSYN -j DROP-A OVPNBLOCK -p icmp -m conntrack --ctstate RELATED -j RETURN-A POLICYFWD -s 192.168.1.0/24 -i green0 -j ACCEPT-A POLICYFWD -m policy --dir in --pol ipsec -j ACCEPT-A POLICYFWD -i tun+ -j ACCEPT-A POLICYFWD -s 192.168.2.0/24 -i blue0 -o red0 -j ACCEPT-A POLICYFWD -s 192.168.3.0/24 -i orange0 -o red0 -j ACCEPT-A POLICYFWD -m limit --limit 10/min -j LOG --log-prefix DROP_FORWARD -A POLICYFWD -m comment --comment DROP_FORWARD -j DROP-A POLICYIN -i green0 -j ACCEPT-A POLICYIN -i blue0 -j ACCEPT-A POLICYIN -m policy --dir in --pol ipsec -j ACCEPT-A POLICYIN -i tun+ -j ACCEPT-A POLICYIN -m limit --limit 10/min -j LOG --log-prefix DROP_INPUT -A POLICYIN -m comment --comment DROP_INPUT -j DROP-A POLICYOUT -j ACCEPT-A POLICYOUT -m comment --comment DROP_OUTPUT -j DROP-A PSCAN -p tcp -m limit --limit 10/min -m comment --comment DROP_TCP PScan -j LOG --log-prefix DROP_TCP Scan -A PSCAN -p udp -m limit --limit 10/min -m comment --comment DROP_UDP PScan -j LOG --log-prefix DROP_UDP Scan -A PSCAN -p icmp -m limit --limit 10/min -m comment --comment DROP_ICMP PScan -j LOG --log-prefix DROP_ICMP Scan -A PSCAN -f -m limit --limit 10/min -m comment --comment DROP_FRAG PScan -j LOG --log-prefix DROP_FRAG Scan -A PSCAN -m comment --comment DROP_PScan -j DROP-A REDFORWARD -i orange0 -o red0 -j ACCEPT-A REDINPUT -i red0 -p tcp -m tcp --sport 67 --dport 68 -j ACCEPT-A REDINPUT -i red0 -p udp -m udp --sport 67 --dport 68 -j ACCEPT-A WIRELESSFORWARD -s 192.168.2.1/32 -i blue0 -m mac --mac-source XX:XX:XX:XX:XX:XX -j RETURN-A WIRELESSFORWARD -i blue0 -j LOG --log-prefix DROP_Wirelessforward-A WIRELESSFORWARD -i blue0 -m comment --comment DROP_Wirelessforward -j DROP-A WIRELESSINPUT -s 192.168.2.1/32 -i blue0 -m mac --mac-source XX:XX:XX:XX:XX:XX -j RETURN-A WIRELESSINPUT -i blue0 -j LOG --log-prefix DROP_Wirelessinput-A WIRELESSINPUT -i blue0 -m comment --comment DROP_Wirelessinput -j DROP$ sudo route -n:Kernel IP routing tableDestination     Gateway         Genmask         Flags Metric Ref    Use Iface0.0.0.0         10.157.1.5      128.0.0.0       UG    0      0        0 tun00.0.0.0         10.0.0.1        0.0.0.0         UG    204    0        0 red010.0.0.0        0.0.0.0         255.255.255.0   U     204    0        0 red010.157.1.1      10.157.1.5      255.255.255.255 UGH   0      0        0 tun010.157.1.5      0.0.0.0         255.255.255.255 UH    0      0        0 tun0129.82.205.12   10.0.0.1        255.255.255.255 UGH   0      0        0 red0128.0.0.0       10.157.1.5      128.0.0.0       UG    0      0        0 tun0192.168.1.0      0.0.0.0         255.255.255.0   U     0      0        0 green0192.168.2.0      0.0.0.0         255.255.255.0   U     0      0        0 blue0
Voice-over-IP with a VPN
iptables;openvpn;vpn;voip;sip
Your rules don't make sense for the scenario you've described.I'll accept that the CONNTRACK chain handles the VPN inbound packets, so your VPN will work.However, if you want VoIP to run over the VPN then you don't need any rules at all on red0 that handle SIP traffic.It looks like you want to accepting unregistered SIP calls in to your public IP address, but your traffic flow is outbound via the VPN. That will confuse the caller because the outbound IP address won't match the called target address.Again, in the usual way of running a SIP client it would register to an endpoint/proxy and so you wouldn't need any rules other than a generic ACCEPT RELATED to permit the traffic to flow correctly. (You might need to declare the public IP address in Twinkle; that depends on how well it can use STUN or ICE to find it out.)At this point I would strongly urge you to turn off the firewall temporarily, reset the INPUT, OUTPUT, FORWARD chain policies to ACCEPT, and see if it works. Then you can start applying firewall rules.