[SR-Users] Another NAT question

[Daniel-Constantin Mierla]

Hello,

you can detect that the call is coming from public/external interface 
and goes to private/internal interface.

There are couple of ways to do it, one is to set a branch flag when they 
register, saying it is from external or internal. Then based on src ip 
($si) or rcv io ($Ri) of the invite and the branch flag from location, 
you decide to enforce the rtpproxy or not.

Alternative is to look at the forced socket or destination ip after 
lookup location and get the info from there about the message flow.

Cheers,
Daniel

On 10/13/12 11:43 PM, Moacir Ferreira wrote:
> Hi,
>   
> I have a scenario where I got a firewall with 3 interfaces: internal, DMZ and external. All the traffic from internal going to external is NATed. However, the traffic between internal and DMZ is NOT NATed. The external and DMZ are using public IP addresses. On the DMZ I have a Kamailio server running with RTPProxy + NAT Helper.
>   
> Everything works fine when public (from the internet) users (UAs) are behind NAT as Kamailio will force the RTP to go via RTPProxy. However, when the public user has a public IP, it will fail to establish the RTP to a user who registered on Kamailio coming from the internal firewall interface.
>   
> The reason is that, as I don't do NAT between internal and DMZ firewall interfaces, Kamailio will not RTPRroxy in between the UAs because, from the way Kamailio detects NAT, they are not behind NAT. So the public user UA tries to reach a private IP address. If the "inside" user tries to call a public user (a user on the Internet with a public IP), it works.
>
> Yes, I could do NAT in between the internal and DMZ firewall interfaces. However, this would force all RTP traffic of my UAs at the LAN go to Kamailio RTPProxy, an bad effect that I would like to avoid.
>
> So my question is: what would be the best approach to solve this issue using Kamailio and RTPProxy in such scenario?
>
> Cheers!
> Moacir 		 	   		
> _______________________________________________
> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
> sr-users at lists.sip-router.org
> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

-- 
Daniel-Constantin Mierla - http://www.asipto.com
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
Kamailio Advanced Training, Berlin, Nov 5-8, 2012 - http://asipto.com/u/kat
Kamailio Advanced Training, Miami, USA, Nov 12-14, 2012 - http://asipto.com/u/katu