[Kamailio-Users] Firewall and auth

Andreas Granig agranig at sipwise.com
Sun May 10 16:22:36 CEST 2009


Hi all,

I just tried a setup like

[UA] --> [pub][Firewall][priv] --> [priv][Kam]

where the Firewall maps the public IP reachable by UAs to a private IP 
where Kamailio is listening. If I run sipsak on the Kamailio-machine, I 
can register fine, but as soon as the request goes via Firewall, 
authentication stops working.

So how does the IP of Kamailio actually influence authentication? Do I 
have to set something special on Kamailio to make this work?

Here's the Register after a 401 and the resulting 401 again, and it 
looks pretty well to me (1.2.3.4 is the public Firewall IP, which is 
configured as outbound proxy on the UA, 172.17.10.50 is the private 
Kamailio-IP and is also used as domain for user sipwise1, which is 
trying to register). Trace is taken on client-side, but looks the same 
on the Kamailio server (NAT seems to be handled fine):

U 192.168.123.150:50600 -> 1.2.3.4:5060
REGISTER sip:1.2.3.4 SIP/2.0.
Via: SIP/2.0/UDP 192.168.123.150:50600;rport;branch=z9hG4bK906580090.
From: <sip:sipwise1 at 172.17.10.50>;tag=1631756043.
To: <sip:sipwise1 at 172.17.10.50>.
Call-ID: 1235449552.
CSeq: 4 REGISTER.
Contact: <sip:sipwise1 at 192.168.123.150:50600;line=e779ddd40d3251b>.
Authorization: Digest username="sipwise1", realm="172.17.10.50", 
nonce="4a06e2820000000a80c173db2d166fedb7d8d1e933c97855", 
uri="sip:1.2.3.4", response="de645a701a7c507c47a5278923bce54b", 
algorithm=MD5.
Max-Forwards: 70.
User-Agent: Linphone/2.1.1 (eXosip2/3.1.0).
Expires: 900.
Content-Length: 0.

U 1.2.3.4:5060 -> 192.168.123.150:50600
SIP/2.0 401 Unauthorized.
Via: SIP/2.0/UDP 
192.168.123.150:50600;rport=50600;branch=z9hG4bK906580090;received=213.47.175.165.
From: <sip:sipwise1 at 172.17.10.50>;tag=1631756043.
To: <sip:sipwise1 at 172.17.10.50>;tag=a49efde55ae28efd11dc5969af09c5db.b607.
Call-ID: 1235449552.
CSeq: 4 REGISTER.
WWW-Authenticate: Digest realm="172.17.10.50", 
nonce="4a06e2820000000b2bd307dd3e71c80e3d6549ccc2b28269".
Server: Sipwise registrar.
Content-Length: 0.

So the only thing referring to the public Firewall IP is in the R-Uri of 
the registration and in the Authorization-uri-token. Is this token also 
used to calculate the auth hashes somehow?
Username looks fine in the Authorization header, and so does Realm. Any 
ideas?

Andreas



More information about the Users mailing list