[Serusers] config for NAT/STUN

Sun Jun 6 10:40:03 CEST 2004

I am having trouble with getting messaging between two SIP clients each
behind difference NATs, each making connection to SER using STUN.

The clients are reaching each other successfully for the INVITE, ACK,
REQUEST BYE messaging but during the call the clients are attempting to
reach each other on their private IPs ie IPs behind their NATs. Is there a
config alteration that I should make to fix ? Or am I looking in the wrong
place ?

My ser.cfg is below, thanks in advance 

Peter

# ----------- global configuration parameters ------------------------

debug=7         # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no	# (cmd line: -E)

# Uncomment these lines to enter debugging mode #fork=no #log_stderror=yes

check_via=no	# (cmd. line: -v)
dns=no           # (cmd. line: -r)
rev_dns=no      # (cmd. line: -R)
port=5060
children=4
fifo="/tmp/ser_fifo"

# ------------------ module loading ----------------------------------

# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"

loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/acc.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/vm.so"

# Uncomment this if you want digest authentication
# mysql.so must be loaded !
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"

# Transaction Module Params
modparam("tm", "fr_inv_timer", 90)

# Acounting Module Params

 # set the reporting log level
modparam("acc", "log_level", 1)
 # number of flag, which will be used for accounting; if a message is
labeled with this flag, its completion status will be reported
modparam("acc", "log_flag", 1)

modparam("acc", "log_missed_flag", 2)
modparam("acc", "db_url", "mysql://xxx:xxx@localhost/ser")
modparam("acc", "db_flag", 11)
modparam("acc", "db_missed_flag", 12)
modparam("acc", "failed_transactions", 1)

# !! Nathelper
loadmodule "/usr/local/lib/ser/modules/nathelper.so"

# ----------------- setting module-specific parameters ---------------

# -- usrloc params --

#modparam("usrloc", "db_mode",   0)

# Uncomment this if you want to use SQL database 
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)

# -- auth params --
# Uncomment if you are using auth module
#
modparam("auth_db", "calculate_ha1", yes)
#
# If you set "calculate_ha1" parameter to yes (which true in this config), 
# uncomment also the following parameter)
#
modparam("auth_db", "password_column", "password")

# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)

# !! Nathelper
modparam("registrar", "nat_flag", 6)
modparam("nathelper", "natping_interval", 30) # Ping interval 30 s
modparam("nathelper", "ping_nated_only", 1)   # Ping only clients behind NAT

# -------------------------  request routing logic -------------------

# main routing logic

route{
	/* ********* ROUTINE CHECKS  ********************************** */
	# initial sanity checks -- messages with
	# max_forwards==0, or excessively long requests
	if (!mf_process_maxfwd_header("10")) {
		sl_send_reply("483","Too Many Hops");
		break;
	};
	if (msg:len >=  max_len ) {
		sl_send_reply("513", "Message too big");
		break;
	};

    	#  Process record-routing
	#if (loose_route()) { t_relay(); break; };

	# labeled all transaction for accounting
	setflag(11);

	# record-route INVITES to make sure BYEs will visit our server too
	if (method=="INVITE") record_route();

	# forward the request statefuly now; (we need *stateful* forwarding,
	# because the stateful mode correlates requests with replies and
	# drops retranmissions; otherwise, we would have to report on
	# every single message received)
/*	if (!t_relay()) {
		sl_reply_error(); 
		break; 
	};
*/

        # !! Nathelper
	# Special handling for NATed clients; first, NAT test is
	# executed: it looks for via!=received and RFC1918 addresses
	# in Contact (may fail if line-folding is used); also,
	# the received test should, if completed, should check all
	# vias for rpesence of received
	if (nat_uac_test("3")) {
		# Allow RR-ed requests, as these may indicate that
		# a NAT-enabled proxy takes care of it; unless it is
		# a REGISTER

		if (method == "REGISTER" || ! search("^Record-Route:")) {
		    log("LOG: Someone trying to register from private IP,
rewriting\n");

		    # This will work only for user agents that support
symmetric
		    # communication. We tested quite many of them and
majority is
		    # smart enough to be symmetric. In some phones it takes
a configuration
		    # option. With Cisco 7960, it is called NAT_Enable=Yes,
with kphone it is
		    # called "symmetric media" and "symmetric signalling".

		    fix_nated_contact(); # Rewrite contact with source IP of
signalling
		    if (method == "INVITE") {
		        fix_nated_sdp("1"); # Add direction=active to SDP
		    };
		    force_rport(); # Add rport parameter to topmost Via
		    setflag(11);    # Mark as NATed
		};
	};

	# we record-route all messages -- to make sure that
	# subsequent messages will go through our proxy; that's
	# particularly good if upstream and downstream entities
	# use different transport protocol
	if (!method=="REGISTER") record_route();	

	# subsequent messages withing a dialog should take the
	# path determined by record-routing
	if (loose_route()) {
		# mark routing logic in request
		append_hf("P-hint: rr-enforced\r\n"); 
		route(1);
		break;
	};

	if (!uri=~"xxx.com.au") {
		# mark routing logic in request
		append_hf("P-hint: outbound\r\n"); 
		route(1);
		break;
	};

	# if the request is for other domain use UsrLoc
	# (in case, it does not work, use the following command
	# with proper names and addresses in it)
	if (uri=~"xxx.com.au") {

		if (method=="REGISTER") {

# Uncomment this if you want to use digest authentication
			if (!www_authorize("xxx.com.au", "subscriber")) {
				www_challenge("xxx.com.au", "0");
				break;
			};

			save("location");
			break;
		};

		lookup("aliases");
		if (!uri=~"xxx.com.au") {
			append_hf("P-hint: outbound alias\r\n"); 
			route(1);
			break;
		};

		# attempt handoff to PSTN
		##  This assumes that the caller is registered in our realm
		if (uri=~"^sip:[0-9]*@sip.xxx.com.au") {  
		    log("Forwarding to PSTN\n");      
		    t_relay_to_udp( "xxx.xxx.xxx.xxx", "xxx");  ##  Our
Cisco router
		    break;
		};

		# native SIP destinations are handled using our USRLOC DB
		if (!lookup("location")) {
			sl_send_reply("404", "Not Foundx");
			break;
		};
	};
	append_hf("P-hint: usrloc applied\r\n"); 
	route(1);
}

route[1] 
{
	# !! Nathelper
/*	if (uri=~"[@:](192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)" &&
!search("^Route:")){
	    sl_send_reply("479", "We don't forward to private IP
addresses");
	    break;
        };
*/

	# if client or server know to be behind a NAT, enable relay
	if (isflagset(6)) {
	    force_rtp_proxy();
	};

	# NAT processing of replies; apply to all transactions (for example,
	# re-INVITEs from public to private UA are hard to identify as
	# NATed at the moment of request processing); look at replies
	t_on_reply("1");

	# send it out now; use stateful forwarding as it works reliably
	# even for UDP2TCP
	if (!t_relay()) {
		sl_reply_error();
	};
}

	# !! Nathelper
	onreply_route[1] {
    		# NATed transaction ?
    		if (isflagset(6) && status =~ "(183)|2[0-9][0-9]") {
        		fix_nated_contact();
			force_rtp_proxy();
    			# otherwise, is it a transaction behind a NAT and we
did not
    			# know at time of request processing ? (RFC1918
contacts)
    		} else if (nat_uac_test("1")) {
		        fix_nated_contact();
		};
}

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.698 / Virus Database: 455 - Release Date: 6/2/2004