[Serusers] SER as an ALG. (now w/version info)

[Kyle Bresin]

One quick addition, I'm using the latest versions of SER and mediaproxy 
that I could find:

ser 0.9.4 and mediaproxy 1.4.2.

Original problem follows:

I have been trying to configure SER w/MediaProxy module/server to be a 
drop in NAT solution in front of asterisk.  With the twist that I want 
to have asterisk continue acting as a registrar rather than SER.

Outbound calls from natted clients works perfectly currently.  The 
problem I'm having is with SER passing the REGISTERS through to 
asterisk.  SER/MP isn't rewriting the address in the packets to go back 
through SER, but instead sets it to be the NAT'd IP of the client.

So, when asterisk receives a call, and tries to send it to the external 
nat'd IP of the client, there is no open session from asterisk, so the 
firewall denies the request.

What I need to happen, is for SER/MP to rewrite the packet with it's own 
IP, so that asterisk sends it back to SER, and SER forwards it back down 
to the client, from a source IP which has an open firewall session.

Any help would be greatly appreciated, hopefully it's just a matter of 
me having an extraneous function call somewhere, or being ignorant of 
the right function to use.

Or, in ascii diagram form:

NAT_IP client --- EXTERNAL_FW_IP -----  SER_IP ----- ASTERISK

SER is giving asterisk the EXTERNAL_FW_IP for Registers, and I want it 
to give Asterisk the SER IP.

Something that would make SER rewrite *all* register packets to it's own 
IP would even work, since clients that don't need NAT won't be sent to 
SER in the first place.

My ser.cfg and mediaproxy.ini follow.  Lemme know if you need any more 
info from me.  And extra thanks to anyone who has taken the time reading 
this, I truly appreciate it.

kyle.

# ### ser.cfg ###
#
# ----------- global configuration parameters ------------------------

debug=3         # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no    # (cmd line: -E)

/* Uncomment these lines to enter debugging mode
fork=no
log_stderror=yes
*/

check_via=no    # (cmd. line: -v)
dns=no           # (cmd. line: -r)
rev_dns=no      # (cmd. line: -R)
port=5070
#children=4
fifo="/tmp/ser_fifo"
#fifo_db_url="mysql://ser:ser/ser"

# ------------------ module loading ----------------------------------

# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/dbtext.so"

loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
#loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/domain.so"

# !!! Media Proxy
loadmodule "/usr/local/lib/ser/modules/mediaproxy.so"

#modparam("mediaproxy", "mediaproxy_socket", 
"/var/run/proxydispatcher.sock")
modparam("mediaproxy", "mediaproxy_socket", "/var/run/mediaproxy.sock")
#modparam("mediaproxy", "sip_asymmetrics", 
"/usr/local/etc/ser/sip-asymmetric-clients")
#modparam("mediaproxy", "rtp_asymmetrics", 
"/usr/local/etc/ser/rtp-asymmetric-clients")
modparam("mediaproxy", "natping_interval", 20)

# ----------------- setting module-specific parameters ---------------

# -- usrloc params --

modparam("usrloc", "db_mode",   0)

# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)

# -------------------------  request routing logic -------------------

# main routing logic

route{

   # initial sanity checks -- messages with
   # max_forwards==0, or excessively long requests
   if (!mf_process_maxfwd_header("10")) {
       sl_send_reply("483","Too Many Hops");
       break;
   };
   if (msg:len >=  max_len ) {
       sl_send_reply("513", "Message too big");
       break;
   };

   if (client_nat_test("3")) {
       # Allow RR-ed requests, as these may indicate that
       # a NAT-enabled proxy takes care of it; unless it is
       # a REGISTER

       fix_contact(); # Rewrite contact with source IP of signalling
       force_rport(); # Add rport parameter to topmost Via
       setflag(6);    # Mark as NATed
#        use_media_proxy();
   };

   # we record-route all messages -- to make sure that
   # subsequent messages will go through our proxy; that's
   # particularly good if upstream and downstream entities
   # use different transport protocol
#    if (!method=="REGISTER") record_route();   
   record_route();   

   # subsequent messages withing a dialog should take the
   # path determined by record-routing
   if (loose_route()) {
       # mark routing logic in request
       append_hf("P-hint: rr-enforced\r\n");
       route(1);
       break;
   };

   if (!uri==myself) {
       # mark routing logic in request
       append_hf("P-hint: outbound\r\n");
       route(1);
       break;
   };

   route(1);
}

route[1]
{
   if (uri=~"[@:](192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)" && 
!search("^Route:")){
       sl_send_reply("479", "We don't forward to private IP addresses");
       break;
       };
  
   # if client or server know to be behind a NAT, enable relay
   if (isflagset(6)) {
       use_media_proxy();
   };

   # NAT processing of replies; apply to all transactions (for example,
   # re-INVITEs from public to private UA are hard to identify as
   # NATed at the moment of request processing); look at replies
   t_on_reply("1");

   # send it out now; use stateful forwarding as it works reliably
   # even for UDP2TCP
   if (!t_relay()) {
       sl_reply_error();
   };
}

onreply_route[1] {
   # NATed transaction ?
   if (isflagset(6) && status =~ "(183)|2[0-9][0-9]") {
   use_media_proxy();
   # otherwise, is it a transaction behind a NAT and we did not
   # know at time of request processing ? (RFC1918 contacts)
   } else if (client_nat_test("1")) {
       fix_contact();
       use_media_proxy();
   };
}

;
; Configuration file for MediaProxy
;

[Dispatcher]
  
start = yes
socket = /var/run/proxydispatcher.sock
;group = ser
defaultProxy = /var/run/mediaproxy.sock

[MediaProxy]

start = yes
socket = /var/run/mediaproxy.sock
;group = ser
;listen = None
;allow = None
;proxyIP = 127.0.0.1
portRange = 35000:65000
;TOS = 0xb8
;idleTimeout = 60
;holdTimeout = 3600
;forceClose = 0
accounting = off

[Accounting]
user = dbuser
password = dbpass
host = dbhost
database = radius
table = radacct