Hi, 

an benefit from using the AWS loadbalancer is the included DDOS prevention. Jonas Swiatek gave that as tipp to me. 

He simple setup self-signed certs on the Kamailio behind the NLB loadbalancer. 
So it's 

Internet -> TLS NLB/AWS loadbalancer -> TLS self-signed Kamailio. 

Should solve your problems. 

Kind regards
Karsten Horsmann 

Henning Westerholt <hw@gilawa.com> schrieb am Sa., 12. Aug. 2023, 11:09:

Hello David,

 

the simplest way is of course to just not use the AWS load-balancer. 😉 Do you have performance concerns using Kamailio for that purpose?

 

As you probably know, SIP as a protocol is not really suited for this kind of cloud balancing infrastructure, which targets more HTTP and other protocols. And Kamailio in a load-balancer scenario is usually the first TLS/TCP/UDP endpoint to reach from the client point of view.

 

Cheers,

 

Henning

 

--

Henning Westerholt – https://skalatan.de/blog/

Kamailio services – https://gilawa.com

 

From: David Villasmil <david.villasmil.work@gmail.com>
Sent: Samstag, 12. August 2023 02:55
To: Kamailio (SER) - Users Mailing List <sr-users@lists.kamailio.org>
Subject: [SR-Users] Kamailio behind TLS-TCP load balancer

 

Hello all,

 

I’m having lots of problems when trying to configure Kamailio behind an AWS tls load balancer to offload tls and receive on tcp on Kamailio. Everything else inside is UDP.

I found I need to manually add record-route presets every time and invite comes in. And when trying to forward an ACK to the client via tls/tcp load balancer Kamailio complaint the socket is not TLS so it fails.

 

Is there a simpler way of doing this via some parameters I don’t know?

 

Thanks for helping me with this!

 

David

--

Regards,

 

David Villasmil

phone: +34669448337

__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions
To unsubscribe send an email to sr-users-leave@lists.kamailio.org
Important: keep the mailing list in the recipients, do not reply only to the sender!
Edit mailing list options or unsubscribe: