[Serusers] Problem running SER behind firewall
Wei Wang
wwang at m1global.com
Wed May 16 21:11:17 CEST 2007
Thanks for your help. Adding alias directive solved the problem!
-Wei
-----Original Message-----
From: Greger Viken Teigre [mailto:greger at teigre.com]
Sent: Wednesday, May 16, 2007 2:33 PM
To: Wei Wang
Cc: serusers at iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
Are you sure the ACK still does not reach ua2? I cannot see anything
wrong, except that you record route ack, which normally does no harm,
but has no effect
either.
I may confuse ips here.. Btw, I would expect the ack to not have any
Route, but with contact of ua2 as the r-uri. Do any of the firewalls do
SIP ALG and add
their own route?
another worth trying, is to add alias=public-ip to your config. It may
be that ser does not recognize the route as it's own and thus relays it
according to the
route.
g-)
------- Original message -------
From: Wei Wang <wwang at m1global.com>
Cc: serusers at iptel.org
Sent: 16.5.'07, 10:15
> Changed the cfg file to do record_route_preset to avoid private
address
> being added to the Record-Route header. Now the Record-Route header
> contains public address. But the problem remains.
>
> I am quite new to SIP. I don't understand why SER sent the last ACK
> received from UA1 to the firewall public address instead of UA2's
public
> IP. But INVITE went through fine.
>
> Thanks,
> Wei
>
> ============ tcpdump =================
> 10:02:09.277595 IP 68.158.174.169.33415 > 192.168.4.217.5060: SIP,
> length: 757
> E.......t.|AD..............cACK
> sip:1002 at 63.111.4.162:17784;rinstance=59a418695e254c5a SIP/2.0^M
> Via: SIP/2.0/UDP
>
68.158.174.169:30236;branch=z9hG4bK-d87543-a44efa3aad34e076-1--d87543-;r
> port^M
> Max-Forwards: 70^M
> Route: <sip:1002 at 66.134.1.34:5060;lr;nat=yes;ftag=9846c732>^M
> Contact: <sip:1001 at 68.158.174.169:33415>^M
> To: "1002"<sip:1002 at starpound.dnsalias.org>;tag=8126ba56^M
> From: "UA1"<sip:1001 at starpound.dnsalias.org>;tag=9846c732^M
> Call-ID: ZTZiYWY0ZmI2ZWUyMWNmNGNkZjJlMjQzNmQ2NTBmMTk.^M
> CSeq: 2 ACK^M
> Proxy-Authorization: Digest
>
username="1001",realm="starpound.dnsalias.org",nonce="464b100a413a877d15
>
0f21e026e37da975d1a72b",uri="sip:1002 at starpound.dnsalias.org",response="
> 3fb4c3d90a7c848146d49188666e95f9",algorithm=MD5^M
> User-Agent: X-Lite release 1009l stamp 38210^M
> Content-Length: 0^M
> ^M
>
> 10:02:09.277925 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
> 878
> E..... at .@.-.....B..".....v..ACK
> sip:1002 at 63.111.4.162:17784;rinstance=59a418695e254c5a SIP/2.0^M
> Record-Route:
<sip:1002 at 66.134.1.34:5060;nat=yes;ftag=9846c732;lr=on>^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
> Via: SIP/2.0/UDP
>
68.158.174.169:30236;branch=z9hG4bK-d87543-a44efa3aad34e076-1--d87543-;r
> port=33415^M
> Max-Forwards: 16^M
> Route: <sip:1002 at 66.134.1.34:5060;lr;nat=yes;ftag=9846c732>^M
> Contact: <sip:1001 at 68.158.174.169:33415>^M
> To: "1002"<sip:1002 at starpound.dnsalias.org>;tag=8126ba56^M
> From: "UA1"<sip:1001 at starpound.dnsalias.org>;tag=9846c732^M
> Call-ID: ZTZiYWY0ZmI2ZWUyMWNmNGNkZjJlMjQzNmQ2NTBmMTk.^M
> CSeq: 2 ACK^M
> Proxy-Authorization: Digest
>
username="1001",realm="starpound.dnsalias.org",nonce="464b100a413a877d15
>
0f21e026e37da975d1a72b",uri="sip:1002 at starpound.dnsalias.org",response="
> 3fb4c3d90a7c848146d49188666e95f9",algorithm=MD5^M
> User-Agent: X-Lite release 1009l stamp 38210^M
> Content-Length: 0^M
> =========== end tcpdump ==================
>
> ________________________________________
> From: Greger V. Teigre [mailto:greger at teigre.com]
> Sent: Wednesday, May 16, 2007 3:58 AM
> To: Wei Wang
> Cc: serusers at iptel.org
> Subject: Re: [Serusers] Problem running SER behind firewall
>
> You have to use your public ip by using record_route_preset also for
> non-NATed.
> As you can see, the Record-Route header contains your private address.
> g-)
>
> Wei Wang wrote:
> Greger,
>
> Thanks for the help. I've added advertised_address to the ser.cfg
file.
>
> ...
> listen=192.168.4.217
> port=5060
> advertised_address=66.134.1.34
> advertised_port=5060
> ....
>
> But it did not seem to help.
>
> Here is the TCP traffic:
>
> ================= START TCPDUMP =================
> 11:50:38.459320 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
> 862
> E..z.. at .@..'....B..".....f..ACK
> sip:1002 at 63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
> Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
> Via: SIP/2.0/UDP
>
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
> port=33341^M
> Max-Forwards: 16^M
> Route: <sip:1002 at 66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
> Contact: <sip:1001 at 68.158.174.169:33341>^M
> To: "1002"<sip:1002 at starpound.dnsalias.org>;tag=4a343c52^M
> From: "UA1"<sip:1001 at starpound.dnsalias.org>;tag=8c0a471f^M
> Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
> CSeq: 2 ACK^M
> Proxy-Authorization: Digest
>
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
>
1fde13326cf91821414477",uri="sip:1002 at starpound.dnsalias.org",response="
> 4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
> User-Agent: X-Lite release 1009l stamp 38210^M
> Content-Length: 0^M
>
> 11:50:38.459602 IP 192.168.4.1.5060 > 192.168.4.217.5060: SIP, length:
> 862
> E..z.. at .?..%.............f-.ACK
> sip:1002 at 63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
> Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
> Via: SIP/2.0/UDP
>
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
> port=33341^M
> Max-Forwards: 16^M
> Route: <sip:1002 at 66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
> Contact: <sip:1001 at 68.158.174.169:33341>^M
> To: "1002"<sip:1002 at starpound.dnsalias.org>;tag=4a343c52^M
> From: "UA1"<sip:1001 at starpound.dnsalias.org>;tag=8c0a471f^M
> Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
> CSeq: 2 ACK^M
> Proxy-Authorization: Digest
>
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
>
1fde13326cf91821414477",uri="sip:1002 at starpound.dnsalias.org",response="
> 4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
> User-Agent: X-Lite release 1009l stamp 38210^M
> Content-Length: 0^M
>
> 11:50:38.459885 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
> 982
> E..... at .@.-.....B.."......^M.ACK
> sip:1002 at 63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
> Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
> Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;received=192.168.4.1;branch=0^M
> Via: SIP/2.0/UDP
>
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
> port=33341^M
> Max-Forwards: 15^M
> Route: <sip:1002 at 66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
> Contact: <sip:1001 at 68.158.174.169:33341>^M
> To: "1002"<sip:1002 at starpound.dnsalias.org>;tag=4a343c52^M
> From: "UA1"<sip:1001 at starpound.dnsalias.org>;tag=8c0a471f^M
> Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
> CSeq: 2 ACK^M
> Proxy-Authorization: Digest
>
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
>
1fde13326cf91821414477",uri="sip:1002 at starpound.dnsalias.org",response="
> 4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
> User-Agent: X-Lite release 1009l stamp 38210^M
> Content-Length: 0^M
>
> ================= END TCPDUMP =================
>
> Again, the last ACT was sent to the firewall's external IP
> address(66.134.1.34).
>
>
> -----Original Message-----
> From: Greger V. Teigre [mailto:greger at teigre.com]
> Sent: Tuesday, May 15, 2007 10:53 AM
> To: Wei Wang
> Cc: serusers at iptel.org
> Subject: Re: [Serusers] Problem running SER behind firewall
>
> You need to use advertised_address and advertised_port just below
listen
>
> directive.
> g-)
>
> Wei Wang wrote:
>
> I have a problem running SER behind firewall.
> Here is the network diagram:
>
> |UA1|--|FW1| +--|FW|--|SER|
> \ /
> +--+
> / \
> |UA2|--|FW2| +--|MediaProxy|
>
> Where, UA1 and UA2 are Xlite soft-phones behind their own firewalls.
>
> SER
>
> is listening on private IP address 192.168.4.217. FW has public IP
> address 66.134.1.34 and forwards port 5060 to SER.
>
> The ser.cfg file is pretty much copied from SER getting start guide.
> When UA1 calling UA2, the call established fine but UA1 will hang up
>
> by
>
> itself after ~30 seconds. The captured IP packages on SER revealed
>
> that
>
> the last ACK received from UA2 by SER was sent to FW IP address. Since
> port 5060 is forwarded to SER on the FW, it caused a looping
>
> situation.
>
> The ser.cfg is listed at the end.
>
> Thanks in advance.
>
> Wei Wang
> wwang at m1global.com
>
>
> ======== ser.cfg ============
> debug=3 # debug level (cmd line: -dddddddddd)
> fork=yes
> log_stderror=no # (cmd line: -E)
>
> /* Uncomment these lines to enter debugging mode
> debug=3
> #debug=9
> fork=no
> log_stderror=yes
> */
>
> check_via=no # (cmd. line: -v)
> dns=no # (cmd. line: -r)
> rev_dns=no # (cmd. line: -R)
> listen=192.168.4.217
> #listen=66.134.1.36
> port=5060
> children=4
> fifo="/tmp/ser_fifo"
> fifo_db_url="mysql://ser:s3rv1c3@localhost/ser"
>
> # ------------------ module loading ----------------------------------
>
> # Uncomment this if you want to use SQL database
> loadmodule "/usr/local/lib/ser/modules/mysql.so"
> loadmodule "/usr/local/lib/ser/modules/sl.so"
> loadmodule "/usr/local/lib/ser/modules/tm.so"
> loadmodule "/usr/local/lib/ser/modules/rr.so"
> loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
> loadmodule "/usr/local/lib/ser/modules/usrloc.so"
> loadmodule "/usr/local/lib/ser/modules/registrar.so"
> loadmodule "/usr/local/lib/ser/modules/textops.so"
> loadmodule "/usr/local/lib/ser/modules/permissions.so"
>
> # Uncomment this if you want digest authentication
> # mysql.so must be loaded !
> loadmodule "/usr/local/lib/ser/modules/auth.so"
> loadmodule "/usr/local/lib/ser/modules/auth_db.so"
> loadmodule "/usr/local/lib/ser/modules/uri.so"
> loadmodule "/usr/local/lib/ser/modules/uri_db.so"
> loadmodule "/usr/local/lib/ser/modules/domain.so"
> loadmodule "/usr/local/lib/ser/modules/mediaproxy.so"
> loadmodule "/usr/local/lib/ser/modules/nathelper.so"
> loadmodule "/usr/local/lib/ser/modules/print.so"
> loadmodule "/usr/local/lib/ser/modules/xlog.so"
>
> # ----------------- setting module-specific parameters ---------------
>
> # -- usrloc params --
>
> #modparam("usrloc", "db_mode", 0)
>
> # Uncomment this if you want to use SQL database
> # for persistent storage and comment the previous line
> modparam("usrloc", "db_mode", 2)
>
> # -- auth params --
> # Uncomment if you are using auth module
> #
> modparam("auth_db|permissions|uri_db|usrloc", "db_url",
> "mysql://ser:s3rv1c3@localhost/ser")
> modparam("auth_db", "calculate_ha1", 1)
> #
> # If you set "calculate_ha1" parameter to yes (which true in this
> config),
> # uncomment also the following parameter)
> #
> modparam("auth_db", "password_column", "password")
>
> modparam("nathelper", "rtpproxy_disable", 1)
> modparam("nathelper", "natping_interval", 0)
>
> modparam("mediaproxy", "natping_interval", 30)
> #modparam("mediaproxy", "mediaproxy_socket",
>
> "/var/run/mediaproxy.sock")
>
> modparam("mediaproxy", "mediaproxy_socket",
> "/var/run/proxydispatcher.sock")
> modparam("mediaproxy", "sip_asymmetrics",
> "/usr/local/etc/ser/sip-clients")
> modparam("mediaproxy", "rtp_asymmetrics",
> "/usr/local/etc/ser/rtp-clients")
>
> modparam("registrar", "nat_flag", 6)
>
> # -- rr params --
> # add value to ;lr param to make some broken UAs happy
> modparam("rr", "enable_full_lr", 1)
>
> modparam("permissions", "db_mode", 1)
> modparam("permissions", "trusted_table", "trusted")
>
> modparam("xlog", "buf_size", 8192)
>
> # ------------------------- request routing logic -------------------
>
> # main routing logic
>
> route{
> # xlog("L_INFO", "Main route
> [From]%fu,[To]%tu,[Req-Method]%rm,[Req-RURI]%ru[IP-src]%is ...\n");
> if(method != "SUBSCRIBE") {
> xlog("L_INFO", "\r\n===========SIP
> MSG==================\r\n%mb\r\n_____END SIP
> MSG________________________\r\n");
> };
>
> # initial sanity checks -- messages with
> # max_forwards==0, or excessively long requests
> if (!mf_process_maxfwd_header("10")) {
> sl_send_reply("483","Too Many Hops");
> break;
> };
> if (msg:len >= 4086 ) {
> sl_send_reply("513", "Message too big");
> break;
> };
>
> # we record-route all messages -- to make sure that
> # subsequent messages will go through our proxy; that's
> # particularly good if upstream and downstream entities
> # use different transport protocol
> if (method == "INVITE" && client_nat_test("3")) {
> # xlog("L_INFO", "method==INVITE and nated: calling
> record_route_preset\n");
> # IP ADDRESS Here
> record_route_preset("66.134.1.34:5060;nat=yes");
> } else if (method!="REGISTER") {
> record_route();
> };
> # -------------------------
> # Call Tear Down Section
> #-------------------------
> if(method=="BYE" || method=="CANCEL") {
> #xlog("L_INFO", "RECEIVED BYE or CANCEL...");
> end_media_session();
> };
>
> # subsequent messages withing a dialog should take the
> # path determined by record-routing
> if (loose_route()) {
> xlog("L_INFO", "DEBUG: loose_route...");
>
> if((method=="INVITE" || method == "REFER") &&
> !has_totag()) {
> sl_send_reply("403", "Forbidden");
> break;
> };
> if(method == "INVITE") {
> if(!allow_trusted()) {
> if(!proxy_authorize("", "subscriber"))
>
> {
>
> proxy_challenge("", "0");
> break;
> } else if(!check_from()) {
> sl_send_reply("403", "Use
> From=ID");
> break;
> };
> consume_credentials();
> }
> if(client_nat_test("3")
> || search("^Route:.*;nat=yes")) {
> setflag(6);
> use_media_proxy();
> };
> };
> # mark routing logic in request
> #append_hf("P-hint: rr-enforced\r\n");
> route(1);
> break;
> };
>
> if (!uri==myself) {
> route(4);
> # mark routing logic in request
> #append_hf("P-hint: outbound\r\n");
> route(1);
> break;
> };
>
> # if the request is for other domain use UsrLoc
> # (in case, it does not work, use the following command
> # with proper names and addresses in it)
> if(method == "ACK") {
> route(1);
> break;
> } else if(method=="CANCEL") {
> route(1);
> break;
> } else if(method == "INVITE") {
> route(3);
> break;
> } else if (method=="REGISTER") {
> route(2);
> break;
> };
>
> lookup("aliases");
> if (!uri==myself) {
>
> route(4);
> #append_hf("P-hint: outbound alias\r\n");
> route(1);
> break;
> };
>
> # native SIP destinations are handled using our USRLOC DB
> if (!lookup("location")) {
> sl_send_reply("404", "Not Found");
> break;
> };
> append_hf("P-hint: usrloc applied\r\n");
> route(1);
> }
>
> route[1]
> {
> t_on_reply("1");
>
> # send it out now; use stateful forwarding as it works
>
> reliably
>
> # even for UDP2TCP
> if (!t_relay()) {
> if(method=="INVITE" || method == "ACK") {
> end_media_session();
> };
> sl_reply_error();
> };
> }
>
> route[2]
> {
> ############################
> # REGISTER Message Handler
> ###########################
> sl_send_reply("100", "Trying");
>
> if(!search("^Contact:[ ]*\*") && client_nat_test("7")) {
> setflag(6);
> fix_nated_register();
> force_rport();
> };
> if(!www_authorize("", "subscriber")) {
> www_challenge("", "0");
> break;
> };
>
> if(!check_to()) {
> sl_send_reply("401", "Unauthorized");
> break;
> };
> consume_credentials();
>
> if(!save("location")) {
> sl_reply_error();
> };
> }
>
> route[3]
> {
> ############################
> # INVITE Message Handler
> ###########################
> if(client_nat_test("3")) {
> setflag(7);
> force_rport();
> fix_nated_contact();
> };
>
> if(!allow_trusted()) {
> if(!proxy_authorize("", "subscriber")) {
> proxy_challenge("", "0");
> break;
> } else if(!check_from()) {
> sl_send_reply("403", "Use From=ID");
> break;
> };
> };
> consume_credentials();
>
> lookup("aliases");
> if(uri != myself) {
> route(4);
> route(1);
> break;
> };
>
> if(!lookup("location")) {
> sl_send_reply("404", "User Not Found");
> break;
> };
>
> route(4);
> route(1);
> }
>
> route[4] {
> #----------------------------
> # NAT Traversal Section
> #----------------------------
>
> if(isflagset(6) || isflagset(7)) {
> if(!isflagset(8)) {
> setflag(8);
> use_media_proxy();
> };
> };
> }
>
> onreply_route[1] {
> if((isflagset(6) || isflagset(7))
> && (status =~ "(180)|183)|2[0-9][0-9]")) {
>
> if(!search("^Content-Length:[ ]*0")) {
> use_media_proxy();
> };
> };
>
> if(client_nat_test("1")) {
> fix_nated_contact();
> };
> }
> =============== END ser.cfg ================
> _______________________________________________
> Serusers mailing list
> Serusers at lists.iptel.org
> http://lists.iptel.org/mailman/listinfo/serusers
>
>
>
>
>
>
>
More information about the sr-users
mailing list