[Users] BYE from call recipient not passing the firewall

[Mark Price]

Hi,

I am experiencing the following:
openser 1.1 and asterisk are on public IP addresses, with openser acting as
a sip proxy in front of asterisk.
sip clients A and B live behind the same firewall.
Let A be a TCP UAC.  Let B be a UAC using TCP or UDP.
If A calls B and B hangs up, A never sees the BYE packet, and never hangs
up.
If A calls B and A hangs up, the BYE packet is transmitted just fine, and B
hangs up as it should.

tcpdump at the sip proxy shows that when B hangs up, the SIP hangup dialog
is as expected between

    B<->openser<->asterisk

Then, asterisk sends a BYE through openser which is addressed to A, but A
never responds.
To be more exact, A never responds because the BYE message is not passing
through the firewall.

Perhaps someone has seen such a problem?

I have included a collection of facts below about the situation.
If there are others I can provide you with, let me know.

If A and B are both TCP, then clients A and B each have exactly one tcp
stream between themselves and openser.  I.e. tcpdump shows precisely 2 each
of syn and syn/ack packets.
The source and destination ports of the final BYE packet are the same as the
destination and source ports of the original INVITE packet.

Furthermore, the time between phone registration and the sending of the last
BYE packet is on the order of 20 seconds, and the behavior is consistent, so
it is unlikely that the TCP stream timed out.

The following four packets were cut and pasted from tcpdump.  Would more
information be helpful?

The following packets represent:
1. invite from asterisk to openser
2. invite from openser to client B
3. bye from asterisk to openser
4. bye from openser to client B

Recall that INVITE(tcp.src, tcp.dst) == BYE (tcp.dst,tcp.src).

INVITE sip:9043067733 at joinuneta.com:5065 SIP/2.0\r\n
From: "Mark Price2" <sip:9043060000 at 66.129.95.24>;tag=as50a4e684\r\n
To: <sip:9043067733 at joinuneta.com:5065>\r\n
Contact: <sip:9043060000 at 66.129.95.24>\r\n
Call-ID: 6e9c8160194ea4eb59afa0da0c22633d at 66.129.95.24\r\n
CSeq: 102 INVITE\r\n

INVITE sip:9043067733 at 66.177.61.238:17522;transport=TLS;rinstance=58c12cb6506504ae
SIP/2.0\r\n
From: "Mark Price2" <sip:9043060000 at 66.129.95.24>;tag=as50a4e684\r\n
To: <sip:9043067733 at joinuneta.com:5065>\r\n
Contact: <sip:9043060000 at 66.129.95.24>\r\n
Call-ID: 6e9c8160194ea4eb59afa0da0c22633d at 66.129.95.24\r\n
CSeq: 102 INVITE\r\n

BYE sip:9043060000 at 66.177.61.238:17559 SIP/2.0\r\n
From: "9043067733 (Softphone)"<sip:9043067733 at joinuneta.com
>;tag=as3f8914c4\r\n
To: "Mark Price"<sip:9043060000 at joinuneta.com>;tag=3c60f44e\r\n
Contact: <sip:9043067733 at 66.129.95.24>\r\n
Call-ID: ZDFkMjBlMWJlOGZlZWE4NmZlMzQ2NWE0OWNiOGYzYzU.\r\n
CSeq: 102 BYE\r\n

BYE sip:9043060000 at 66.177.61.238:17559 SIP/2.0\r\n
From: "9043067733 (Softphone)"<sip:9043067733 at joinuneta.com
>;tag=as3f8914c4\r\n
To: "Mark Price"<sip:9043060000 at joinuneta.com>;tag=3c60f44e\r\n
Contact: <sip:9043067733 at 66.129.95.24>\r\n
Call-ID: ZDFkMjBlMWJlOGZlZWE4NmZlMzQ2NWE0OWNiOGYzYzU.\r\n

Thanks,
Mark Price
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sip-router.org/pipermail/sr-users/attachments/20061204/41ba9055/attachment.htm>