As a preface, my setup is somewhat unique; if anyone has a working SER configuration for this scenario, or is willing to help come up with one, I would be willing to compensate you for your efforts. If you're interested, please contact me off list for details. At present, I'm using Asterisk to run a small VoIP network with great success. My focus is now to look at handling things such as NAT and scalability/reliability. This where I believe SER will be very beneficial as it handles NAT and scaling very well. My desired setup is as follows (the only thing behind a NAT are phones): Phone(s) --> [NAT] --> SER --> Asterisk(FS) --> Asterisk (PSTN) All phones behind the NAT have their outbound proxy set to SER and their regular proxy set to Asterisk(FS). SER then proxies outbound traffic from the phone to the Asterisk(FS) server acting as the "feature server" ie. VM, conferencing, etc. The feature server then routes traffic according to the dialplan in Asterisk. If the call is destined for the PSTN, the dialplan logic in Asterisk(FS) sends an INVITE to Asterisk(PSTN) which tells Asterisk(PSTN) to reINVITE the Phone at the public IP of the NAT and also tells the phone, via SER, to reINVITE Asterisk(PSTN) at its public IP. The media streams should then flow between the phone and Asterisk(PSTN) while both SER and Asterisk(FS) are out of the picture until the call ends and BYEs are processed. If a call is destined for another SIP device, the process is the same except that Asterisk(FS) forwards traffic back to the address of the phone, which is SER since SER is acting as the proxy for all SIP devices. SER then forwards the traffic back to the NATted phone as appropriate. Amazingly, I already have what I believe to be an SER config which correctly routes all of the SIP/SDP traffic as desired. My current issue is that during a call intitated by the NATted phone, the phone and Asterisk(PSTN) have reinvited and are sending RTP to each other but the phone behind the NAT cannot hear any of the audio being sent by Asterisk(PSTN) while the phone on the PSTN can hear audio being sent by the NATted phone; one way audio. What is really odd about this is that when the PSTN user first answers the call, approximately 1-2 seconds of audio is heard on the NATted phone from the PSTN user but then no more is heard for the remainder of the call. For me, I see this as some sort of RTP issue as the first second of voice RTP traffic is doing exactly what is expected between the phone and Asterisk(PTSN). I've verified the SRC and DST of the RTP traffic with Ethereal. I've also tried force_rtp_proxy and rtpproxy with no success. It is my understanding that my desired setup is very similar to that of others such as FWD (Free World Dialup), et al. My SER config follows. It is based on an Asterisk+SER configuration someone posted earlier so please point out anything you see which may not be correct. I'll also add that this configuration works flawlessly whenever there is only a phone and the 2 Asterisk servers; ie. no SER and no NAT. All reINVITES take place as they should and all media is heard as it should be. Thanks in advance! -Curt #alias=" mydomian.com " #Alias="192.168.10.100" #ser #Alias="192.168.10.120" #Asterisk check_via=no # (cmd. line: -v) dns=no # (cmd. line: -r) rev_dns=no # (cmd. line: -R) port=5060 children=4 fifo="/tmp/ser_fifo" fifo_mode=438 # ------------------ module loading ---------------------------------- # Uncomment this if you want to use SQL database loadmodule "/usr/lib/ser/modules/mysql.so" loadmodule "/usr/lib/ser/modules/sl.so" loadmodule "/usr/lib/ser/modules/tm.so" loadmodule "/usr/lib/ser/modules/rr.so" loadmodule "/usr/lib/ser/modules/maxfwd.so" loadmodule "/usr/lib/ser/modules/usrloc.so" loadmodule "/usr/lib/ser/modules/registrar.so" loadmodule "/usr/lib/ser/modules/textops.so" # Uncomment this if you want digest authentication # mysql.so must be loaded ! loadmodule "/usr/lib/ser/modules/auth.so" loadmodule "/usr/lib/ser/modules/auth_db.so" loadmodule "/usr/lib/ser/modules/acc.so" # !! Nathelper loadmodule "/usr/lib/ser/modules/nathelper.so" # ----------------- setting module-specific parameters --------------- # -- usrloc params -- #modparam("usrloc", "db_mode", 0) # Uncomment this if you want to use SQL database # for persistent storage and comment the previous line modparam("usrloc", "db_mode", 2) # -- auth params -- # Uncomment if you are using auth module # modparam("auth_db", "calculate_ha1", yes) # # If you set "calculate_ha1" parameter to yes (which true in this config), # uncomment also the following parameter) # modparam("auth_db", "password_column", "password") # -- rr params -- # add value to ;lr param to make some broken UAs happy modparam("rr", "enable_full_lr", 1) # -- acc params -- # set reporting log level modparam("acc", "db_url", "sql://ser:heslo@localhost/ser") modparam("acc", "db_flag", 1) # !! Nathelper modparam("registrar", "nat_flag", 6) modparam("nathelper", "natping_interval", 30) # Ping interval 30 s #modparam("nathelper", "ping_nated_only", 1) # Ping only clients behind NAT # ------------------------- request routing logic ------------------- # main routing logic route{ # initial sanity checks -- messages with # max_forwards==0, or excessively long requests if (!mf_process_maxfwd_header("10")) { sl_send_reply("483","Too Many Hops"); break; }; if (msg:len >= max_len ) { sl_send_reply("513", "Message too big"); break; }; # !! Nathelper # Special handling for NATed clients; first, NAT test is # executed: it looks for via!=received and RFC1918 addresses # in Contact (may fail if line-folding is used); also, # the received test should, if completed, should check all # vias for rpesence of received #if (nat_uac_test("3")) { if(search("^Contact:(.*)192\.168(.*)")) { log(1,"We're natted\n"); # Allow RR-ed requests, as these may indicate that # a NAT-enabled proxy takes care of it; unless it is # a REGISTER if (method == "REGISTER" || ! search("^Record-Route:")) { log("LOG: Someone trying to register from private IP, rewriting\n"); # This will work only for user agents that support symmetric # communication. We tested quite many of them and majority is # smart enough to be symmetric. In some phones it takes a configuration # option. With Cisco 7960, it is called NAT_Enable=Yes, with kphone it is # called "symmetric media" and "symmetric signalling". fix_nated_contact(); # Rewrite contact with source IP of signalling save_noreply("location"); if (method == "INVITE") { fix_nated_sdp("1"); # Add direction=active to SDP }; force_rport(); # Add rport parameter to topmost Via setflag(6); # Mark as NATed }; }; # we record-route all messages -- to make sure that # subsequent messages will go through our proxy; that's # particularly good if upstream and downstream entities if (!method=="REGISTER") record_route(); # subsequent messages withing a dialog should take the # path determined by record-routing if (loose_route()) { # mark routing logic in request append_hf("P-hint: rr-enforced\r\n"); route(1); break; }; if (!uri==myself) { # mark routing logic in request append_hf("P-hint: outbound\r\n"); route(1); break; }; # if the request is for other domain use UsrLoc # (in case, it does not work, use the following command # with proper names and addresses in it) if (uri==myself) { if (method=="REGISTER") { # Uncomment this if you want to use digest authentication # if (!www_authorize("iptel.org", "subscriber")) { # www_challenge("iptel.org", "0"); # break; # }; save_noreply("location"); break; }; # lookup("aliases"); if (!uri==myself) { append_hf("P-hint: outbound alias\r\n"); route(1); break; # native SIP destinations are handled using our USRLOC DB if (!lookup("location")) { sl_send_reply("404", "Not Found"); break; }; }; append_hf("P-hint: usrloc applied\r\n"); route(1); } } route[1] { # !! Nathelper if (uri=~"[@:](192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)" && !search("Route:")){ sl_send_reply("479", "We don't forward to private IP addresses"); break; }; # if client or server know to be behind a NAT, enable relay # record_route(); if (isflagset(6)) { fix_nated_sdp("1"); force_rtp_proxy(); t_on_reply("1"); } if (isflagset(6)) { force_rtp_proxy(); }; # NAT processing of replies; apply to all transactions (for example, # re-INVITEs from public to private UA are hard to identify as # NATed at the moment of request processing); look at replies t_on_reply("1"); # send it out now; use stateful forwarding as it works reliably # even for UDP2TCP if (!t_relay()) { sl_reply_error(); }; } # !! Nathelper onreply_route[1] { # NATed transaction ? if (isflagset(6) && status =~ "(183)|2[0-9][0-9]") { fix_nated_contact(); fix_nated_sdp("1"); force_rtp_proxy(); # otherwise, is it a transaction behind a NAT and we did not # know at time of request processing ? (RFC1918 contacts) # } else if (nat_uac_test("1")) { } else if (search("Contact:.*192\.168.*")) { fix_nated_contact(); }; }