asterisk users - Apr 2008 - SJphone behind NAT/Firewall without sound

Hi.

I need connect some LAN stations with SJphone to an Asterisk Server
published on Internet.

My Lan Clients access to Internet using a small linux firewall/proxy
server.  I use the next firewall script.  That is a simple script with
default policy ACCEPT, and NAT to share Internet.    I can connect to
the asterisk server, authtenticate the users in the server, and dial
to any extension,  but we can ear any sound.    I need some additional
rules in my script?

Thanks in advance

#!/bin/bash
IPTABLES=/sbin/iptables
EXT="eth0"
INT="eth1"
case "$1" in
	start)
		echo "1" > /proc/sys/net/ipv4/ip_forward
		$IPTABLES -F INPUT
		$IPTABLES -F OUTPUT
		$IPTABLES -F FORWARD
		$IPTABLES -F
		$IPTABLES -t nat -F
		$IPTABLES -t nat -A POSTROUTING -s 192.168.12.0/24 -d 0.0.0.0/0 -o
$EXT -j MASQUERADE
		$IPTABLES -t nat -A PREROUTING -p TCP -s 192.168.12.0/24 --dport 80
-d -j REDIRECT --to-port 3128
		$IPTABLES -A INPUT -i $EXT -p ICMP -j ACCEPT
		$IPTABLES -A INPUT -i $EXT -p TCP --dport 22 -m state --state NEW -j ACCEPT
		$IPTABLES -A INPUT -i $EXT -p TCP --dport 443 -m state --state NEW -j ACCEPT
		$IPTABLES -A INPUT -i $EXT -p TCP --dport 80 -m state --state NEW -j ACCEPT
		$IPTABLES -A INPUT -p TCP -m state --state RELATED -j ACCEPT
		$IPTABLES -A INPUT -i $EXT -m state --state NEW,INVALID -j DROP
		$IPTABLES -A FORWARD -i $EXT -m state --state NEW,INVALID -j DROP
		;;
	stop)
		$IPTABLES -F INPUT
		$IPTABLES -F OUTPUT
		$IPTABLES -F FORWARD
		$IPTABLES -F
		$IPTABLES -t nat -F
			;;
	restart)
			$0 stop
			sleep 2
			$0 start
		;;
	status)
		$IPTABLES -L
		$IPTABLES --table nat --list --exact --verbose --numeric --line-numbers
		;;
	*)
		echo "Usage: $0 {start|stop|restart|status}"
		exit 1
esac
exit 0

-- 
"Imagination is more important than knowlege"
A.E.

Is the Asterisk server yours? I am trying to figure out if Asterisk is in
your control and if it could be a problem at Asterisk, rather than your
SJPhone or your script, because I don't see any glaring problems in the
script.

Regards,
Amit.

-----Original Message-----
From: asterisk-users-bounces at lists.digium.com
[mailto:asterisk-users-bounces at lists.digium.com] On Behalf Of kazabe
Sent: Friday, April 04, 2008 9:00 AM
To: asterisk-users at lists.digium.com
Subject: [asterisk-users] SJphone behind NAT/Firewall without sound

Hi.

I need connect some LAN stations with SJphone to an Asterisk Server
published on Internet.

My Lan Clients access to Internet using a small linux firewall/proxy
server.  I use the next firewall script.  That is a simple script with
default policy ACCEPT, and NAT to share Internet.    I can connect to
the asterisk server, authtenticate the users in the server, and dial
to any extension,  but we can ear any sound.    I need some additional
rules in my script?

Thanks in advance

#!/bin/bash
IPTABLES=/sbin/iptables
EXT="eth0"
INT="eth1"
case "$1" in
	start)
		echo "1" > /proc/sys/net/ipv4/ip_forward
		$IPTABLES -F INPUT
		$IPTABLES -F OUTPUT
		$IPTABLES -F FORWARD
		$IPTABLES -F
		$IPTABLES -t nat -F
		$IPTABLES -t nat -A POSTROUTING -s 192.168.12.0/24 -d
0.0.0.0/0 -o
$EXT -j MASQUERADE
		$IPTABLES -t nat -A PREROUTING -p TCP -s 192.168.12.0/24
--dport 80
-d -j REDIRECT --to-port 3128
		$IPTABLES -A INPUT -i $EXT -p ICMP -j ACCEPT
		$IPTABLES -A INPUT -i $EXT -p TCP --dport 22 -m state
--state NEW -j ACCEPT
		$IPTABLES -A INPUT -i $EXT -p TCP --dport 443 -m state
--state NEW -j ACCEPT
		$IPTABLES -A INPUT -i $EXT -p TCP --dport 80 -m state
--state NEW -j ACCEPT
		$IPTABLES -A INPUT -p TCP -m state --state RELATED -j ACCEPT
		$IPTABLES -A INPUT -i $EXT -m state --state NEW,INVALID -j
DROP
		$IPTABLES -A FORWARD -i $EXT -m state --state NEW,INVALID -j
DROP
		;;
	stop)
		$IPTABLES -F INPUT
		$IPTABLES -F OUTPUT
		$IPTABLES -F FORWARD
		$IPTABLES -F
		$IPTABLES -t nat -F
			;;
	restart)
			$0 stop
			sleep 2
			$0 start
		;;
	status)
		$IPTABLES -L
		$IPTABLES --table nat --list --exact --verbose --numeric
--line-numbers
		;;
	*)
		echo "Usage: $0 {start|stop|restart|status}"
		exit 1
esac
exit 0

-- 
"Imagination is more important than knowlege"
A.E.

_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

On Thu, 3 Apr 2008 22:30:10 -0500, kazabe <kazabe at gmail.com>
wrote:
>I need connect some LAN stations with SJphone to an Asterisk Server
>published on Internet. [...] I dont manage the asterisk server. 
> I just manage my proxy/firewall, and i need to my users can
> connect to that server.
SIP works like FTP: One channel to manage calls, and a second one for
data (audio):

http://freshmeat.net/articles/view/2079/

Since Asterisk doesn't (yet) support STUN, to get audio packets to be
received, you must configure the NAT firewall to let them in, and
route them inside to the Asterisk server.
This must match whatever is listed under /etc/asterisk/rtp.conf (you
can reduce the range from 10000-20000 to eg. 10000-10010; I could be
wrong, but I think RTP actually needs two channels per call.)

The same thing is required for the client hosts running the SJPhone
application, but from what I read, most firewalls will work without
having to map ports, and STUN-capable applications like SJPhone will
keep the UDP ports open by sending out dummy packets regularly.

If you can't modify the NAT firewall in front of the Asterisk server,
I don't see how to solve this.