[Asterisk-Users] SIP Behind NAT (sipgate.de)

Scott James Williamson
Thu, 19 Feb 2004 12:23:00 -0000

Hello Users,

I am attempting to create a sip connection in the following network:

Sipgate.de --> Internet --> Gate --> Asterisk PBX --> Some Extension

Gate, the gateway and nat'ing firewall has sip udp (5060) traffic and
rtm udp (8000 to 8020) traffic forwarded to the asterisk pbx machine.
Both asterisk and x-lite are set to listen/use these port ranges.
(The forwards work, as X-lite works perfectly when forced to no
firewall ("Open IP") setting, simply writing the correct sip via:
headers. I
tested it this morning by calling to a normal number in .de)

However, when I attempt to use asterisk to do the same thing, I get
some strange behaviour. I have attempted to use the following
different configurations of sip.conf:

I am using asterisk cvs version " v1-0_stable" and chan_sip.c from cvs
is verson 1.292.2.6.


config #1 (the nat config)

--snip--

[general]
port = 5060
bindaddr = 0.0.0.0
externip = gate.sjwilliamson.ca
localnet = 192.168.1.0
localmask = 255.255.255.0
context = local
nat=yes

register => xxx:xxx@sipgate.de/6464 ; 6464 is my internal extension

[sipgate]
type=friend
secret=xxx
username=xxx
host=sipgate.de
nat=yes

--end snip--

config #2 (the no-nat config)

--snip--

[general]
port = 5060
bindaddr = 0.0.0.0
;externip = gate.sjwilliamson.ca
;localnet = 192.168.1.0
;localmask = 255.255.255.0
context = local
;nat=yes

register => xxx:xxx@sipgate.de/6464 ; 6464 is my internal extension

[sipgate]
type=friend
secret=xxx
username=xxx
host=sipgate.de
;nat=yes

--end snip--

What I find strage is:

     1. When using the no-nat config (2) asterisk is able to register
     with sipgate.de even though it sends out my internal address in
     the sip via header. However any sip invites are wrongly tagged
     with my internal ip address, and sipgate.de does not send me any
     audio, and the call times out (as it should). See following
     snippit:

--snip--

11 headers, 0 lines
Reliably Transmitting:
REGISTER sip:sipgate.de SIP/2.0
Via: SIP/2.0/UDP 192.168.1.100:5060;branch=z9hG4bK22fc46b2
From: <sip:8007163@sipgate.de>;tag=as11899051
To: <sip:8007163@sipgate.de>
Call-ID: 068cc5447a37ef1049b2625241fbc6f9@127.0.0.1
CSeq: 102 REGISTER
User-Agent: Asterisk PBX
Expires: 120
Contact: <sip:6464@192.168.1.100>
Event: registration
Content-length: 0

 (no NAT) to 217.10.79.9:5060


Sip read:

0 headers, 0 lines


Sip read:
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP
192.168.1.100:5060;branch=z9hG4bK22fc46b2;rport=62600;received=24.102.192.227
From: <sip:8007163@sipgate.de>;tag=as11899051
To: <sip:8007163@sipgate.de>;tag=b11cb9bb270104b49a99a995b8c68544.0784
Call-ID: 068cc5447a37ef1049b2625241fbc6f9@127.0.0.1
CSeq: 102 REGISTER
WWW-Authenticate: Digest realm="sipgate.de", nonce="x"
Server: Sip EXpress router (0.8.12 (i386/linux))
Content-Length: 0
Warning: 392 217.10.79.9:5060 "Noisy feedback tells:  pid=14272
req_src_ip=24.102.192.227 req_src_port=62600 in_uri=sip:sipgate.de
out_uri=sip:sipgate.de via_cnt==1"


10 headers, 0 lines
12 headers, 0 lines
Reliably Transmitting:
REGISTER sip:sipgate.de SIP/2.0
Via: SIP/2.0/UDP 192.168.1.100:5060;branch=z9hG4bK22fc46b2
From: <sip:8007163@sipgate.de>;tag=as11899051
To: <sip:8007163@sipgate.de>
Call-ID: 068cc5447a37ef1049b2625241fbc6f9@127.0.0.1
CSeq: 103 REGISTER
User-Agent: Asterisk PBX
Authorization: Digest username="8007163",
realm="sipgate.de",
algorithm="MD5", uri="sip:sipgate.de", nonce="x",
response="x"
Expires: 120
Contact: <sip:6464@192.168.1.100>
Event: registration
Content-length: 0

 (no NAT) to 217.10.79.9:5060


Sip read:
SIP/2.0 200 OK
Via: SIP/2.0/UDP
192.168.1.100:5060;branch=z9hG4bK22fc46b2;rport=62600;received=24.102.192.227
From: <sip:8007163@sipgate.de>;tag=as11899051
To: <sip:8007163@sipgate.de>;tag=b11cb9bb270104b49a99a995b8c68544.0784
Call-ID: 068cc5447a37ef1049b2625241fbc6f9@127.0.0.1
CSeq: 103 REGISTER
Contact: <sip:8007163@24.102.192.227:5060>;q=0.00;expires=780
Contact: <sip:6464@24.102.192.227:62600>;q=0.00;expires=120
Server: Sip EXpress router (0.8.12 (i386/linux))
Content-Length: 0
Warning: 392 217.10.79.9:5060 "Noisy feedback tells:  pid=14265
req_src_ip=24.102.192.227 req_src_port=62600 in_uri=sip:sipgate.de
out_uri=sip:sipgate.de via_cnt==1"


11 headers, 0 lines

--end snip--

   2. When I use the nat config (1) it gets even stranger. Asterisk
   cannot register with sipgate.de, even though the sip via header
   reflects my correct internet ip address. It attempts to re-transmit
   five times, with the interesting line "(no NAT) to
   217.10.79.9:5060".

--snip--

11 headers, 0 lines
Reliably Transmitting:
REGISTER sip:sipgate.de SIP/2.0
Via: SIP/2.0/UDP 24.102.192.227:5060;branch=z9hG4bK1cd66717
From: <sip:8007163@sipgate.de>;tag=as7c8d34b5
To: <sip:8007163@sipgate.de>
Call-ID: 412221511a281b686d90c8256317744e@127.0.0.1
CSeq: 102 REGISTER
User-Agent: Asterisk PBX
Expires: 120
Contact: <sip:6464@24.102.192.227>
Event: registration
Content-length: 0

 (no NAT) to 217.10.79.9:5060
Retransmitting #1 (no NAT):
REGISTER sip:sipgate.de SIP/2.0
Via: SIP/2.0/UDP 24.102.192.227:5060;branch=z9hG4bK2b457839
From: <sip:8007163@sipgate.de>;tag=as06e7a197
To: <sip:8007163@sipgate.de>
Call-ID: 412221511a281b686d90c8256317744e@127.0.0.1
CSeq: 104 REGISTER
User-Agent: Asterisk PBX
Expires: 120
Contact: <sip:6464@24.102.192.227>
Event: registration
Content-length: 0

--end snip--

Why is there no response when asterisk includes the proper sip via
header? sipgate.de seems smart enough to tell me my internet ip
address when I send it the internal (192.168.1.100) one.

Any suggestions / comments? Should I up-/downgrade chan_sip.c from
cvs?

Thank you,

Scott Williamson
----------------------------
FWD        : 253984
sipgate.de : (PSTN-prefix +49 0211) 8007163