asterisk users - Jan 2012 - Couple of questions: SIP ALG, allowguest=no

Hello

	I just read this article about an Asterisk server that got hacked to
make free international calls through an ITSP:

www.rowetel.com/blog/?p=2210

I have a couple of questions:

1. Am I correct in understanding that SIP ALG on a router makes it
easier to host an Asterisk server on a private LAN behind a NAT router
(no need to map ports for RTP + outgoing packets can be sent directly
to the remote SIP client instead of going through the Asterisk server
to rewrite the RTP port numbers)?
www.voip-info.org/wiki/view/Routers+SIP+ALG

2. If "allowguest=no" is commented out, it means that any SIP client
on the Net can connect to the Asterisk server and make outgoing calls
like legitimate SIP clients?

Thank you.

Hi,



I have an Opensips server dispatching to 3 Asterisk servers. I would 
like to assign public IPs to all of these servers and avoid NAT 
altogether - phones will also have public IPs. The way I set this in the
 lab, all the SIP traffic goes thru the SIP proxy (Opensips) and RTP 
goes directly between the Asterisk servers and the UAs.



The issue is that our provider (they will be both sip trunk and internet
 access provider for us) wants to assign us only 1 public IP on their 
voice network - they are saying that the above design is unusual. I'm 
new to this, is it?



If we end up getting only 1 public IP, I assume putting all behind NAT 
(or assigning the public IP to opensips and putting the asterisk servers
 behind NAT) will do it. rtpproxy is also setup on the Opensips server 
just in case - I can use it to force the RTP traffic thru the sip proxy.
 Any other way?



All I want to do is load balance the RTP traffic, avoid any unnecessay
processing and bottlenecks (rtpproxy, etc.).



Any thoughts? 



Thanks,

Matt 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.digium.com/pipermail/asterisk-users/attachments/20120107/2395da4b/attachment.htm>