Asterisk SIP NAT solutions

Asterisk SIP NAT solutions

Asterisk, SIP and NAT

Asterisk can both act as a ​​SIP​​ client and a SIP server. Asterisk as a SIP client is configured with type=peer (or type=friend) in one or more client sections of ​​sip.conf​​ and, optionally, one or more register=> lines in the [general] section of ​​sip.conf​​. Asterisk as a SIP server connects clients (SIP Phones) configured by specifying their own username, secret, etc. (and either type=peer or type=friend) in client sections of ​​sip.conf​​​. Asterisk SIP channels in a NATed network can be generalized like this:

Asterisk as a SIP client behind nat, connecting to outside SIP ProxiesAsterisk as a SIP client behind nat, connecting to inside SIP proxiesAsterisk as a SIP server behind nat, clients on the outside connecting to AsteriskAsterisk as a SIP server behind nat, clients on the outside behind a second NAT connecting to AsteriskAsterisk as a SIP server behind nat, clients on the inside connecting to AsteriskAsterisk as a SIP client outside nat, connecting to outside SIP proxiesAsterisk as a SIP client outside nat, connecting to inside SIP proxiesAsterisk as a SIP server outside nat, clients on the outside connecting to AsteriskAsterisk as a SIP server outside nat, clients on the inside connecting to Asterisk

Every setup works somewhere, but it depends on the client, the NAT, the server and many other factors. In most cases, 1 and 3 is broken. SIP is a peer-to-peer protocol and a NAT can be generalized and simplified as a solution that allows clients on the inside to connect to servers on the outside and _not_ allow clients on the outside to connect to any server on the inside.

#1 works with a NAT-supporting proxy as​​SIP Express router​​​ as the outside proxy. (Get an account at IPtel.org and try!). Fails with​​Free World Dialup​​.#2 Works- no NAT in between#3 Works with​​port forwarding​​​ and some header mangling magic​​tips​​#4 Works with​​port forwarding​​​,​​STUN​​ on the remote and some fine tuning of RTP port allocation#5 Works - no NAT in between#6 is no problem. No NAT in the middle#7 is a problem if no port forwarding is done, similar to 3 above.#8 is no problem. No NAT in the middle#9 is solved with​​nat​​​=yes and​​qualify​​​=xxx in​​sip.conf​​​ for the client in most cases. Some clients (X-lite) assist themselves by using​​STUN​​​ and sending UDP keep-alive packets.​​Qualify​​ sends keep-alive packets from Asterisk to the client on the inside.

Then we have even worse cases... 9. Asterisk inside a NAT, client inside ANOTHER NAT <---Isn't this the same as previous option 4??? In this case, we need a middle man to even find each other, an outbound SIP proxy that handles the SIP transaction and is reachable by all parties. To get media streams from point to point we need another middle man, a media server. Asterisk could be that media server, that could add media codec conversion. ​​​RTPProxy​​​ or AG Projects ​​MediaProxy​​​ works together with ​​SIP Express router​​​ as a media server in this situation. I would like to add that this option contains the largest amount of cow poop around it. I've been searching for some time to fix this problem, and I'm sure it's very fixable. Also, this does seem to be a very common thing to do, so, does anyone have a GOOD solution? I'm sure we can find case #10-xx as well.

For sample config files to setup Asterisk behind a NAT router to make and receive ​​Free World Dialup​​​ calls see: ​​Asterisk FWD NAT Config Example​​

Olles comments 2003-11-04: I'm afraid if I configure externalIP= in ​​​sip.conf​​​, 1 works, like with FWD, but 2 is broken. I don't know what happens with 4 if I at the same time use externalip= and have clients configured as 3. As I see it, externalip= is an ugly hack that causes problems. There are better solutions in the bug tracking system, being discussed and refined. STUN support, and the netmask/ip-network configuration helps asterisk to find out itself if there's a NAT in the middle and if something should be done.

Other solutions

​​SER module nathelper​​: SIP Express Router module NAThelper

IP Tunneling Solution

If you have an asterisk server, you are obvoiusly running linux (or something that can handle IPIP and GRE tunnels). In most cases when people have just 1 phone, I use an IAXy, and it is no setup required behind nat. In cases where multiple phones are required, IE setting up an client office w/ a virtual PBX, the only real hardphones out are SIP. Farfon.... been waiting a while... What I have done to fix this SIP NAT issue is install a small linux router at the client site, which has a public IP, and is the gateway for a private network. Using netfilter and NAT, you can do anything you want, and all you need to do is setup an IPIP tunnel back to your asterisk server to allow SIP phones to have a direct IP connection. Server

iptunnel add iptun0 mode ipip remote $CLIENTROUTERIP (tunnel)ifconfig iptun0 200.0.0.1 pointopoint 200.0.1.1 (tunnel endpoint)route add -net 200.0.1.0/24 dev iptun0 (tunnel network)route add -net 10.0.0.0/24 dev iptun0 (client network)route add -net 10.0.0.0/24 gw 200.0.1.1 (client gateway)

Client

iptunnel add iptun0 mode ipip remote $ASTERISKIP (tunnel)ifconfig iptun0 200.0.1.1 pointopoint 200.0.0.1 (tunnel endpoint)

From anywhere inside the client 10.0.0.0/24 network, you can access 200.0.0.1 (asterisk) and vice versa. This totally eliminates your SIP NAT issues. Yes this is insecure compared to IPSEC or the like, however, if you are wanting to run SIP over the net without IPSEC, this is the exact same thing, and a lot easier to setup then IPSEC.

You may want to use this script for multiple ipip tunnels

/!/bin/sh /#ON CLIENT /#iptunnel add iptun0 mode ipip remote 69.56.173.241 /#ifconfig iptun0 200.0.1.1 pointopoint 200.0.0.1 /#EACH TUNNEL ON NEWLINE /#FORMAT IS CLIENTIP:CLIENT NETWORK TUNNELS="0.0.0.0:10.0.0.0/24" start() { c=0 for tun in $TUNNELS do d1=`echo $tun | cut -d ":" -f 1` d2=`echo $tun | cut -d ":" -f 2` iptunnel add iptun$c mode ipip remote $d1 ifconfig iptun$c 200.$c.0.1 pointopoint 200.$c.1.1 route add -net 200.$c.1.0/24 dev iptun$c route add -net $d2 dev iptun$c route add -net $d2 gw 200.$c.1.1 c += 1 done } stop() { c=0 for tun in $TUNNELS do iptunnel del iptun$c c += 1 done } case "$1" in start) start ;; stop) stop ;; restart) stop start ;; esac

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。