asterisk users - Aug 2007 - Asterisk and Client NAT

Hi,

I am trying to run an Asterisk (1.4.10) server on Ubuntu Linux Fiesty Fawn. The
server is behind NAT. I am testing SIP with the X-Lite client from xten. The
client is also behind NAT.

I realize that this is amongst the worst configurations, but I have been made to
believe that it can work... eventually. However, currently SIP call set up seems
to go fine, but no media is transferred in either direction. For example, the
following is output on the asterisk CLI despite no voice being heard.
-- Executing [101 at john:1] Playback('SIP/john-081da978',
'hello-world') in new stack

I have used tcpdump, ethereal and RTP debug to trace the problem. I have the
following data:

1. My SIP client is correctly receiving and processing SIP/SD packets. Ethereal
indicates that the client is told to send RTP traffic to server port 50296 and
all packets are sent to this port. However, this port IS NOT in the range
specified in rtp.conf. This is my first point of confusion.

2. Pushing onward, I forwarded ALL ports from my router (NAT) to the Asterisk
server to see if Asterisk would then pick up the voice stream. Tcp dump on the
Asterisk server indicates:
02:48:30.082693 IP pool-71-107-141-25.lsanca.dsl-w.verizon.net.50943 >
gaurav-desktop.local.50296: UDP, length 172

Each of these lines match a line in my ethereal capture on the client. However,
still no voice! This is my second point of confusion.

3. Finally, I tried using RTP debug to trace where audio packets from the server
are being sent. The output I got:

Sent RTP packet to      192.168.1.47:54626 (type 00, seq 058094, ts 012000, len
000160)

I have no idea where 192.168.1.47:54626 came from. There is no computer on my
server's LAN with that local ip, and it is NOT the local IP of my client
(which was 10.0.0.3).This is the third point of confusion.

My conf files are attached. Important details are below:

1. sip.conf
[global]
nat=yes
canreinvite=no

[john]
context=john
nat=yes
canreinvite=no
host=dynamic

2. extensions.conf

[john]

exten => 100,1,Dial(SIP/john) ; loopback
exten => 101,1,Playback(hello-world) ; the basics

3. rtp.conf

rtpstart=10000
rtpend=20000

Your expertise would be appreciated. My sincere thanks for your time and help in
advance.

--G




_________________________________________________________________
Explore the seven wonders of the world
http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://lists.digium.com/pipermail/asterisk-users/attachments/20070819/4e90b4d5/attachment-0001.htm
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sip.conf
Type: application/octet-stream
Size: 3106 bytes
Desc: not available
Url :
http://lists.digium.com/pipermail/asterisk-users/attachments/20070819/4e90b4d5/attachment-0003.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: extensions.conf
Type: application/octet-stream
Size: 13021 bytes
Desc: not available
Url :
http://lists.digium.com/pipermail/asterisk-users/attachments/20070819/4e90b4d5/attachment-0004.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rtp.conf
Type: application/octet-stream
Size: 496 bytes
Desc: not available
Url :
http://lists.digium.com/pipermail/asterisk-users/attachments/20070819/4e90b4d5/attachment-0005.obj

On Sun, 19 Aug 2007, G B wrote:
>
> Hi,
>
>
> I realize that this is amongst the worst configurations, but I have been 
> made to believe that it can work... eventually. However, currently SIP 
> call set up seems to go fine, but no media is transferred in either 
> direction. For example, the following is output on the asterisk CLI 
> despite no voice being heard. -- Executing [101 at john:1] 
> Playback('SIP/john-081da978', 'hello-world') in new stack
*sigh* The old NAT & SIP issue - again... )-:

There is a lot of the VoIP WiKi on it. Eg:
   http://www.voip-info.org/wiki-Asterisk+SIP+NAT+solutions

However, assuming the asterisk and client are behind different NAT 
firewalls, do this:

1. Tell the client to use a stun server and don't fiddle with the
client's
firewall (other than to make sure it's not actually firewalling 5060 and 
10000-20000)

If you're stuck for a stun server, use stun1.drogon.net:3478

2. Port forward 5060-5069 and 10000-20000 on the firewall that fronts the 
asterisk box to the asterisk box.

3. Tell asterisk it's behind a NAT firewall.
> 1. sip.conf
> [global]
> nat=yes
> canreinvite=no
This isn't enough. You also need to tell it the IP address of the external 
firewall, and your local network address.

   nat=yes
   localnet=192.168.2.0/24
   externip=1.2.3.4

Where 1.2.3.4 is the external IP address - the one the client is pointing 
to. This needs to be a static IP address (or at least not change for the 
duration of your use) the client can be behind a dynamic IP address.

you might need a bit more in the client definition - eg:

[100]
context=internal
type=friend
secret=very
qualify=yes
nat=yes
host=dynamic
canreinvite=no
dtmfmode=rfc2833
mailbox=100
callerid=Joe Bloggs <100>
callgroup=1
pickupgroup=1
subscribecontext=BLF

And that's it.

Gordon