Problema con NAT y RTPPROXY - sr-users-es

12 Nov 2011


      Hola, estoy utilizando kamailio 3.2.0 (x86_64/linux) y desde hace unos días
estoy intentando comunicar un softphone desde el interior de una red con
NAT con el exterior. La configuración es la siguiente:
Softphone (192.168.0.5) <--> Kamailio (192.168.0.3) <--> Router
(192.168.0.1) <--> Softphone sobre smartphone
Todos los puertos del router están redireccionados a 192.168.0.3
Tengo instalado rtpproxy 1.2.1-1 con la siguiente configuración:
--------------------------/etc/defaults/rtpproxy--------------------------------
# The control socket.
#CONTROL_SOCK="unix:/var/run/rtpproxy/rtpproxy.sock"
# To listen on an UDP socket, uncomment this line:
CONTROL_SOCK=udp:127.0.0.1:22222
# Additional options that are passed to the daemon.
EXTRA_OPTS="-l candamil.dyndns.org"
----------------------------------------------------------------------------------------
y el funcionamiento es correcto. Este es el mensaje de salida del log de
kamailio:
----------------------------------------------------------------------------------------------
Nov 12 20:09:13 condor kamailio[7001]: INFO: rtpproxy [rtpproxy.c:1415]:
rtp proxy udp:127.0.0.1:22222 found, support for it enabled
-----------------------------------------------------------------------------------------------
Tanto el softphone del interior de la red como el del exterior son
linphone. La configuración del del interior de la red es la siguiente:
SIP identity: sip:1001@192.168.0.3
SIP proxy: sip:192.168.0.3
Indico conexión directa a internet.
En la del externo especifico como proxy y domain "candamil.dyndns.org", que
es la dirección DNS que apunta a la IP de mi router.
En este caso, los síntomas son los siguientes:
La autentificación de ambos, tanto externo como interno, es correcta.
Al realizar una llamada en cualquiera de los dos sentidos, el softphone
suena y la llamada se contesta y cuelga correctamente, pero no se transmite
la señal de voz. En el log figura el siguiente mensaje:
----------------------------------------------------------------------------------------------
Nov 12 20:23:14 condor kamailio[6991]: ERROR: rtpproxy [rtpproxy.c:2260]:
incorrect port 0 in reply from rtp proxy
----------------------------------------------------------------------------------------------
Ocurre lo mismo si en el interno indico que está tras NAT, con la ip del
router, y que está tras NAT con un servidor STUN (stunserver.org). En los 3
casos, en el softphone externo, figura una llamada de 1001@192.168.0.3,
mientras que en el interno, figura una llamada de 1002@candamil.dyndns.org.
Si cambio en el softphone interno el proxy a sip:candamil.dyndns.org, todo
se vuelve a repetir.
Si lo que hago es cambiar la SIP identity a sip:1001@candamil.dyndns.org,
al realizar una llamada desde interno a externo, el interno no llega a
percatarse de que se respondió a la llamada, y aparece el siguiente error
en el log:
----------------------------------------------------------------------------------------------------------
Nov 12 20:53:00 condor kamailio[7306]: ERROR: <core>
[parser/parse_via.c:2600]: ERROR: parse_via: invalid port number
<5060ranch=z9hG4bKc
50f.b4825246.0>
Nov 12 20:53:00 condor kamailio[7306]: ERROR: <core>
[parser/parse_via.c:2629]: ERROR: parse_via on: <SIP/2.0/UDP
192.168.0.3:5060ranch=z
9hG4bKc50f.b4825246.0;received=87.223.138.84#015#012Via: SIP/2.0/UDP
87.223.138.84:5060;rport=5060;branch=z9hG4bK1021772993#015#012From:
sip:1001@candamil.dyndns.org;tag=783852345#015#012To: <
sip:1002@candamil.dyndns.org>#015#012Call-ID: 1644787160#015#012CSeq: 21
INVITE#
015#012User-Agent: Linphone/3.4.0 (eXosip2/unknown)#015#012Content-Length:
0#015#012#015#012>
------------------------------------------------------------------------------------------------------------
Por el contrario, haciendo una llamada desde el externo al interno, ocurre
lo mismo que antes.
Por último, esta es la configuración relevante de kamailio:
-----------------------------------------kamailio.cfg----------------------------------------------------
#!define WITH_MYSQL
#!define WITH_AUTH
#!define WITH_NAT
####### Defined Values #########
# *** Value defines - IDs used later in config
#!ifdef WITH_MYSQL
# - database URL - used to connect to database server by modules such
#       as: auth_db, acc, usrloc, a.s.o.
#!define DBURL "mysql://openser:openserrw@localhost/openser"
#!endif
#!ifdef WITH_MULTIDOMAIN
# - the value for 'use_domain' parameters
#!define MULTIDOMAIN 1
#!else
#!define MULTIDOMAIN 0
#!endif
# - flags
#   FLT_ - per transaction (message) flags
# FLB_ - per branch flags
#!define FLT_ACC 1
#!define FLT_ACCMISSED 2
#!define FLT_ACCFAILED 3
#!define FLT_NATS 5
#!define FLB_NATB 6
#!define FLB_NATSIPPING 7
####### Global Parameters #########
/* uncomment the next line to disable the auto discovery of local aliases
   based on reverse DNS on IPs (default on) */
#auto_aliases=no
/* add local domain aliases */
alias="candamil.dyndns.org"
/* port to listen to
 * - can be specified more than once if needed to listen on many ports */
port=5060
#!ifdef WITH_TLS
enable_tls=yes
#!endif
# life time of TCP connection when there is no traffic
# - a bit higher than registration expires to cope with UA behind NAT
tcp_connection_lifetime=3605
####### Custom Parameters #########
#!ifdef WITH_PSTN
# PSTN GW Routing
#
# - pstn.gw_ip: valid IP or hostname as string value, example:
# pstn.gw_ip = "10.0.0.101" desc "My PSTN GW Address"
#
# - by default is empty to avoid misrouting
pstn.gw_ip = "" desc "PSTN GW Address"
#!endif
####### Modules Section ########
#!ifdef WITH_MYSQL
loadmodule "db_mysql.so"
#!endif
#!ifdef WITH_AUTH
loadmodule "auth.so"
loadmodule "auth_db.so"
#!ifdef WITH_NAT
loadmodule "nathelper.so"
loadmodule "rtpproxy.so"
#!endif
# ----------------- setting module-specific parameters ---------------
# ----- auth_db params -----
#!ifdef WITH_AUTH
modparam("auth_db", "db_url", DBURL)
modparam("auth_db", "calculate_ha1", yes)
modparam("auth_db", "password_column", "password")
modparam("auth_db", "load_credentials", "")
modparam("auth_db", "use_domain", MULTIDOMAIN)
#!ifdef WITH_NAT
# ----- rtpproxy params -----
modparam("rtpproxy", "rtpproxy_sock", "udp:127.0.0.1:22222")
# ----- nathelper params -----
modparam("nathelper", "natping_interval", 30)
modparam("nathelper", "ping_nated_only", 1)
modparam("nathelper", "sipping_bflag", FLB_NATSIPPING)
modparam("nathelper", "sipping_from", "sip:pinger@kamailio.org")
# params needed for NAT traversal in other modules
modparam("nathelper|registrar", "received_avp", "$avp(RECEIVED)")
modparam("usrloc", "nat_bflag", FLB_NATB)
#!endif
####### Routing Logic ########
# Main SIP request routing logic
# - processing of any incoming SIP request starts with this route
# - note: this is the same as route { ... }
request_route {
# per request initial checks
route(REQINIT);
# NAT detection
route(NATDETECT);
# handle requests within SIP dialogs
 route(WITHINDLG);
### only initial requests (no To tag)
# CANCEL processing
if (is_method("CANCEL"))
{
 if (t_check_trans())
t_relay();
exit;
 }
t_check_trans();
# authentication
 route(AUTH);
# record routing for dialog forming requests (in case they are routed)
 # - remove preloaded route headers
remove_hf("Route");
if (is_method("INVITE|SUBSCRIBE"))
 record_route();
# account only INVITEs
if (is_method("INVITE"))
 {
setflag(FLT_ACC); # do accounting
}
# dispatch requests to foreign domains
route(SIPOUT);
### requests for my local domains
# handle presence related requests
 route(PRESENCE);
# handle registrations
route(REGISTRAR);
if ($rU==$null)
{
# request with no Username in RURI
 sl_send_reply("484","Address Incomplete");
exit;
}
# dispatch destinations to PSTN
route(PSTN);
# user location service
route(LOCATION);
route(RELAY);
}
route[RELAY] {
# enable additional event routes for forwarded requests
# - serial forking, RTP relaying handling, a.s.o.
 if (is_method("INVITE|SUBSCRIBE")) {
t_on_branch("MANAGE_BRANCH");
 t_on_reply("MANAGE_REPLY");
}
if (is_method("INVITE")) {
 t_on_failure("MANAGE_FAILURE");
}
if (!t_relay()) {
 sl_reply_error();
}
exit;
}
# Per SIP request initial checks
route[REQINIT] {
#!ifdef WITH_ANTIFLOOD
# flood dection from same IP and traffic ban for a while
 # be sure you exclude checking trusted peers, such as pstn gateways
# - local host excluded (e.g., loop to self)
 if(src_ip!=myself)
{
if($sht(ipban=>$si)!=$null)
 {
# ip is already blocked
xdbg("request from blocked IP - $rm from $fu (IP:$si:$sp)\n");
 exit;
}
if (!pike_check_req())
 {
xlog("L_ALERT","ALERT: pike blocking $rm from $fu (IP:$si:$sp)\n");
 $sht(ipban=>$si) = 1;
exit;
}
 }
#!endif
if (!mf_process_maxfwd_header("10")) {
 sl_send_reply("483","Too Many Hops");
exit;
}
if(!sanity_check("1511", "7"))
{
xlog("Malformed SIP message from $si:$sp\n");
 exit;
}
}
# Handle requests within SIP dialogs
route[WITHINDLG] {
if (has_totag()) {
# sequential request withing a dialog should
 # take the path determined by record-routing
if (loose_route()) {
if (is_method("BYE")) {
 setflag(FLT_ACC); # do accounting ...
setflag(FLT_ACCFAILED); # ... even if the transaction fails
 }
if ( is_method("ACK") ) {
# ACK is forwarded statelessy
 route(NATMANAGE);
}
route(RELAY);
 } else {
if (is_method("SUBSCRIBE") && uri == myself) {
 # in-dialog subscribe requests
route(PRESENCE);
exit;
 }
if ( is_method("ACK") ) {
if ( t_check_trans() ) {
 # no loose-route, but stateful ACK;
# must be an ACK after a 487
# or e.g. 404 from upstream server
 t_relay();
exit;
} else {
 # ACK without matching transaction ... ignore and discard
exit;
}
 }
sl_send_reply("404","Not here");
}
 exit;
}
}
# Handle SIP registrations
route[REGISTRAR] {
 if (is_method("REGISTER"))
{
if(isflagset(FLT_NATS))
 {
setbflag(FLB_NATB);
# uncomment next line to do SIP NAT pinging
 setbflag(FLB_NATSIPPING);
}
if (!save("location"))
 sl_reply_error();
exit;
}
}
# USER location service
route[LOCATION] {
#!ifdef WITH_SPEEDIAL
# search for short dialing - 2-digit extension
 if($rU=~"^[0-9][0-9]$")
if(sd_lookup("speed_dial"))
route(SIPOUT);
#!endif
#!ifdef WITH_ALIASDB
# search in DB-based aliases
if(alias_db_lookup("dbaliases"))
 route(SIPOUT);
#!endif
$avp(oexten) = $rU;
if (!lookup("location")) {
 $var(rc) = $rc;
route(TOVOICEMAIL);
t_newtran();
 switch ($var(rc)) {
case -1:
case -3:
 send_reply("404", "Not Found");
exit;
case -2:
 send_reply("405", "Method Not Allowed");
exit;
}
 }
# when routing via usrloc, log the missed calls also
if (is_method("INVITE"))
 {
setflag(FLT_ACCMISSED);
}
}
# Presence server route
route[PRESENCE] {
if(!is_method("PUBLISH|SUBSCRIBE"))
return;
#!ifdef WITH_PRESENCE
if (!t_newtran())
{
sl_reply_error();
 exit;
};
if(is_method("PUBLISH"))
 {
handle_publish();
t_release();
 }
else
if( is_method("SUBSCRIBE"))
 {
handle_subscribe();
t_release();
 }
exit;
#!endif
 # if presence enabled, this part will not be executed
if (is_method("PUBLISH") || $rU==$null)
 {
sl_send_reply("404", "Not here");
exit;
 }
return;
}
# Authentication route
route[AUTH] {
#!ifdef WITH_AUTH
if (is_method("REGISTER"))
{
# authenticate the REGISTER requests (uncomment to enable auth)
 if (!www_authorize("$td", "subscriber"))
{
www_challenge("$td", "0");
 exit;
}
if ($au!=$tU)
 {
sl_send_reply("403","Forbidden auth ID");
exit;
 }
} else {
#!ifdef WITH_IPAUTH
if(allow_source_address())
 {
# source IP allowed
return;
 }
#!endif
# authenticate if from local subscriber
 if (from_uri==myself)
{
if (!proxy_authorize("$fd", "subscriber")) {
 proxy_challenge("$fd", "0");
exit;
}
 if (is_method("PUBLISH"))
{
if ($au!=$fU || $au!=$tU) {
 sl_send_reply("403","Forbidden auth ID");
exit;
 }
if ($au!=$rU) {
sl_send_reply("403","Forbidden R-URI");
 exit;
}
#!ifdef WITH_MULTIDOMAIN
if ($fd!=$rd) {
 sl_send_reply("403","Forbidden R-URI domain");
exit;
 }
#!endif
} else {
if ($au!=$fU) {
 sl_send_reply("403","Forbidden auth ID");
exit;
 }
}
consume_credentials();
 # caller authenticated
} else {
# caller is not local subscriber, then check if it calls
 # a local destination, otherwise deny, not an open relay here
if (!uri==myself)
 {
sl_send_reply("403","Not relaying");
exit;
 }
}
}
#!endif
return;
}
# Caller NAT detection route
route[NATDETECT] {
#!ifdef WITH_NAT
 force_rport();
if (nat_uac_test("19")) {
if (is_method("REGISTER")) {
 fix_nated_register();
} else {
fix_nated_contact();
 }
setflag(FLT_NATS);
}
#!endif
return;
}
# RTPProxy control
route[NATMANAGE] {
#!ifdef WITH_NAT
if (is_request()) {
 if(has_totag()) {
if(check_route_param("nat=yes")) {
setbflag(FLB_NATB);
 }
}
}
 if (!(isflagset(FLT_NATS) || isbflagset(FLB_NATB)))
return;
rtpproxy_manage();
if (is_request()) {
if (!has_totag()) {
 add_rr_param(";nat=yes");
}
}
 if (is_reply()) {
if(isbflagset(FLB_NATB)) {
fix_nated_contact();
 }
}
#!endif
return;
}
# Routing to foreign domains
route[SIPOUT] {
if (!uri==myself)
{
 append_hf("P-hint: outbound\r\n");
route(RELAY);
}
}
# PSTN GW routing
route[PSTN] {
#!ifdef WITH_PSTN
# check if PSTN GW IP is defined
if (strempty($sel(cfg_get.pstn.gw_ip))) {
 xlog("SCRIPT: PSTN rotuing enabled but pstn.gw_ip not defined\n");
return;
 }
# route to PSTN dialed numbers starting with '+' or '00'
 #     (international format)
# - update the condition to match your dialing rules for PSTN routing
 if(!($rU=~"^(+|00)[1-9][0-9]{3,20}$"))
return;
# only local users allowed to call
if(from_uri!=myself) {
sl_send_reply("403", "Not Allowed");
 exit;
}
$ru = "sip:" + $rU + "@" + $sel(cfg_get.pstn.gw_ip);
route(RELAY);
exit;
#!endif
return;
}
# XMLRPC routing
#!ifdef WITH_XMLRPC
route[XMLRPC] {
# allow XMLRPC from localhost
if ((method=="POST" || method=="GET")
 && (src_ip==127.0.0.1)) {
# close connection only for xmlrpclib user agents (there is a bug in
 # xmlrpclib: it waits for EOF before interpreting the response).
if ($hdr(User-Agent) =~ "xmlrpclib")
 set_reply_close();
set_reply_no_connect();
dispatch_rpc();
 exit;
}
send_reply("403", "Forbidden");
 exit;
}
#!endif
# route to voicemail server
route[TOVOICEMAIL] {
#!ifdef WITH_VOICEMAIL
 if(!is_method("INVITE"))
return;
# check if VoiceMail server IP is defined
 if (strempty($sel(cfg_get.voicemail.srv_ip))) {
xlog("SCRIPT: VoiceMail rotuing enabled but IP not defined\n");
 return;
}
if($avp(oexten)==$null)
 return;
$ru = "sip:" + $avp(oexten) + "@" + $sel(cfg_get.voicemail.srv_ip)
 + $sel(cfg_get.voicemail.srv_port);
route(RELAY);
exit;
#!endif
return;
}
# manage outgoing branches
branch_route[MANAGE_BRANCH] {
 xdbg("new branch [$T_branch_idx] to $ru\n");
route(NATMANAGE);
}
# manage incoming replies
onreply_route[MANAGE_REPLY] {
xdbg("incoming reply\n");
if(status=~"[12][0-9][0-9]")
 route(NATMANAGE);
}
# manage failure routing cases
failure_route[MANAGE_FAILURE] {
route(NATMANAGE);
if (t_is_canceled()) {
exit;
}
#!ifdef WITH_BLOCK3XX
# block call redirect based on 3xx replies.
if (t_check_status("3[0-9][0-9]")) {
 t_reply("404","Not found");
exit;
}
#!endif
#!ifdef WITH_VOICEMAIL
# serial forking
# - route to voicemail on busy or no answer (timeout)
 if (t_check_status("486|408")) {
route(TOVOICEMAIL);
exit;
 }
#!endif
}
--------------------------------------------------------------------------------------------------------------
Espero que alguien pueda echarme una mano. Gracias.