Shorewall users - Oct 2012 - debugging SIP registration issues?

Hi all,

On a server with two interfaces, one connected to Internet (eth0), the
second to the LAN (eth1), I’ve installed ShoreWall and Asterisk amongst
other applications, with the LAN hosting SIP telephones amongst other
devices.

Every time my Shorewall/Asterisk server reboots, any SIP telephone within a
list of specific brand and models isn’t able to register with Asterisk until
its IP address is changed to one that doesn’t belong to the pool of IP
addresses previously assigned to one of the currently concerned devices. The
outcast IP address may become available after some time has passed, usually
from few hours to one or more days.

When I run tshark on the server and I capture packets on eth1 (LAN)
concerning one of the troubled SIP telephones, I can see that the telephone
send REGISTRATION requests to Asterisk. On the other side, monitoring
Asterisk at the same time via its CLI (sip set debug ip <phone-ip-addr>),
I
can see no packets coming from that phone that Asterisk is aware of. I’m
trying to find out who’s the culprit: Asterisk, Shorewall or ... in order to
fix the issue.

Now, assuming I run the following command [tshark –i  eth1 –f “host
<phone-IP-addr>”] on a shell of the server, am I correct saying that I see
what arrives to ShoreWall entry point?

If yes, what tshark or other application command should I run in order to
see what packets are passed from ShoreWall to Asterisk?

Any advice to debug this issue is welcome. Thanks.

Costa.

P.S. The policy LOC à FW = ACCEPT

 



------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_sfd2d_oct

On 10/18/2012 10:49 AM, Costantino wrote:
> Hi all,
>
> On a server with two interfaces, one connected to Internet (eth0), the
> second to the LAN (eth1), I’ve installed ShoreWall and Asterisk amongst
> other applications, with the LAN hosting SIP telephones amongst other
> devices.
>
> Every time my Shorewall/Asterisk server reboots, any SIP telephone
> within a list of specific brand and models isn’t able to register with
> Asterisk until its IP address is changed to one that doesn’t belong to
> the pool of IP addresses previously assigned to one of the currently
> concerned devices. The outcast IP address may become available after
> some time has passed, usually from few hours to one or more days.
>
> When I run tshark on the server and I capture packets on eth1 (LAN)
> concerning one of the troubled SIP telephones, I can see that the
> telephone send REGISTRATION requests to Asterisk. On the other side,
> monitoring Asterisk at the same time via its CLI (sip set debug ip
> <phone-ip-addr>), I can see no packets coming from that phone that
> Asterisk is aware of. I’m trying to find out who’s the culprit:
> Asterisk, Shorewall or ... in order to fix the issue.
Why don''t you just temporarily ''shorewall clear''; if
the problem is the
Shorewall-generated configuration, the phone should instantly connect. 
Be sure to ''shorewall start'' after the test.
> If yes, what tshark or other application command should I run in
> order to see what packets are passed from ShoreWall to Asterisk?
Shorewall doesn''t pass packets. Shorewall is a tool that configures 
Netfilter in your kernel (along with some entries in /proc, etc). Once 
''shorewall start'' completes, there is no Shorewall code
running in your
firewall at all.

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_sfd2d_oct