14 May
2007
14 May
'07
7 p.m.
I have a problem running SER behind firewall.
Here is the network diagram:
|UA1|--|FW1| +--|FW|--|SER|
\ /
+--+
/ \
|UA2|--|FW2| +--|MediaProxy|
Where, UA1 and UA2 are Xlite soft-phones behind their own firewalls. SER
is listening on private IP address 192.168.4.217. FW has public IP
address 66.134.1.34 and forwards port 5060 to SER.
The ser.cfg file is pretty much copied from SER getting start guide.
When UA1 calling UA2, the call established fine but UA1 will hang up by
itself after ~30 seconds. The captured IP packages on SER revealed that
the last ACK received from UA2 by SER was sent to FW IP address. Since
port 5060 is forwarded to SER on the FW, it caused a looping situation.
The ser.cfg is listed at the end.
Thanks in advance.
Wei Wang
wwang(a)m1global.com
======== ser.cfg ============
debug=3 # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no # (cmd line: -E)
/* Uncomment these lines to enter debugging mode
debug=3
#debug=9
fork=no
log_stderror=yes
*/
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=192.168.4.217
#listen=66.134.1.36
port=5060
children=4
fifo="/tmp/ser_fifo"
fifo_db_url="mysql://ser:s3rv1c3@localhost/ser"
# ------------------ module loading ----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/permissions.so"
# Uncomment this if you want digest authentication
# mysql.so must be loaded !
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"
loadmodule "/usr/local/lib/ser/modules/uri.so"
loadmodule "/usr/local/lib/ser/modules/uri_db.so"
loadmodule "/usr/local/lib/ser/modules/domain.so"
loadmodule "/usr/local/lib/ser/modules/mediaproxy.so"
loadmodule "/usr/local/lib/ser/modules/nathelper.so"
loadmodule "/usr/local/lib/ser/modules/print.so"
loadmodule "/usr/local/lib/ser/modules/xlog.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
#modparam("usrloc", "db_mode", 0)
# Uncomment this if you want to use SQL database
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)
# -- auth params --
# Uncomment if you are using auth module
#
modparam("auth_db|permissions|uri_db|usrloc", "db_url",
"mysql://ser:s3rv1c3@localhost/ser")
modparam("auth_db", "calculate_ha1", 1)
#
# If you set "calculate_ha1" parameter to yes (which true in this
config),
# uncomment also the following parameter)
#
modparam("auth_db", "password_column", "password")
modparam("nathelper", "rtpproxy_disable", 1)
modparam("nathelper", "natping_interval", 0)
modparam("mediaproxy", "natping_interval", 30)
#modparam("mediaproxy", "mediaproxy_socket",
"/var/run/mediaproxy.sock")
modparam("mediaproxy", "mediaproxy_socket",
"/var/run/proxydispatcher.sock")
modparam("mediaproxy", "sip_asymmetrics",
"/usr/local/etc/ser/sip-clients")
modparam("mediaproxy", "rtp_asymmetrics",
"/usr/local/etc/ser/rtp-clients")
modparam("registrar", "nat_flag", 6)
# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)
modparam("permissions", "db_mode", 1)
modparam("permissions", "trusted_table", "trusted")
modparam("xlog", "buf_size", 8192)
# ------------------------- request routing logic -------------------
# main routing logic
route{
# xlog("L_INFO", "Main route
[From]%fu,[To]%tu,[Req-Method]%rm,[Req-RURI]%ru[IP-src]%is ...\n");
if(method != "SUBSCRIBE") {
xlog("L_INFO", "\r\n===========SIP
MSG==================\r\n%mb\r\n_____END SIP
MSG________________________\r\n");
};
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too Many Hops");
break;
};
if (msg:len >= 4086 ) {
sl_send_reply("513", "Message too big");
break;
};
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (method == "INVITE" && client_nat_test("3")) {
# xlog("L_INFO", "method==INVITE and nated: calling
record_route_preset\n");
# IP ADDRESS Here
record_route_preset("66.134.1.34:5060;nat=yes");
} else if (method!="REGISTER") {
record_route();
};
# -------------------------
# Call Tear Down Section
#-------------------------
if(method=="BYE" || method=="CANCEL") {
#xlog("L_INFO", "RECEIVED BYE or CANCEL...");
end_media_session();
};
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
xlog("L_INFO", "DEBUG: loose_route...");
if((method=="INVITE" || method == "REFER") &&
!has_totag()) {
sl_send_reply("403", "Forbidden");
break;
};
if(method == "INVITE") {
if(!allow_trusted()) {
if(!proxy_authorize("", "subscriber"))
{
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use
From=ID");
break;
};
consume_credentials();
}
if(client_nat_test("3")
|| search("^Route:.*;nat=yes")) {
setflag(6);
use_media_proxy();
};
};
# mark routing logic in request
#append_hf("P-hint: rr-enforced\r\n");
route(1);
break;
};
if (!uri==myself) {
route(4);
# mark routing logic in request
#append_hf("P-hint: outbound\r\n");
route(1);
break;
};
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if(method == "ACK") {
route(1);
break;
} else if(method=="CANCEL") {
route(1);
break;
} else if(method == "INVITE") {
route(3);
break;
} else if (method=="REGISTER") {
route(2);
break;
};
lookup("aliases");
if (!uri==myself) {
route(4);
#append_hf("P-hint: outbound alias\r\n");
route(1);
break;
};
# native SIP destinations are handled using our USRLOC DB
if (!lookup("location")) {
sl_send_reply("404", "Not Found");
break;
};
append_hf("P-hint: usrloc applied\r\n");
route(1);
}
route[1]
{
t_on_reply("1");
# send it out now; use stateful forwarding as it works reliably
# even for UDP2TCP
if (!t_relay()) {
if(method=="INVITE" || method == "ACK") {
end_media_session();
};
sl_reply_error();
};
}
route[2]
{
############################
# REGISTER Message Handler
###########################
sl_send_reply("100", "Trying");
if(!search("^Contact:[ ]*\*") && client_nat_test("7"))
{
setflag(6);
fix_nated_register();
force_rport();
};
if(!www_authorize("", "subscriber")) {
www_challenge("", "0");
break;
};
if(!check_to()) {
sl_send_reply("401", "Unauthorized");
break;
};
consume_credentials();
if(!save("location")) {
sl_reply_error();
};
}
route[3]
{
############################
# INVITE Message Handler
###########################
if(client_nat_test("3")) {
setflag(7);
force_rport();
fix_nated_contact();
};
if(!allow_trusted()) {
if(!proxy_authorize("", "subscriber")) {
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use From=ID");
break;
};
};
consume_credentials();
lookup("aliases");
if(uri != myself) {
route(4);
route(1);
break;
};
if(!lookup("location")) {
sl_send_reply("404", "User Not Found");
break;
};
route(4);
route(1);
}
route[4] {
#----------------------------
# NAT Traversal Section
#----------------------------
if(isflagset(6) || isflagset(7)) {
if(!isflagset(8)) {
setflag(8);
use_media_proxy();
};
};
}
onreply_route[1] {
if((isflagset(6) || isflagset(7))
&& (status =~ "(180)|183)|2[0-9][0-9]")) {
if(!search("^Content-Length:[ ]*0")) {
use_media_proxy();
};
};
if(client_nat_test("1")) {
fix_nated_contact();
};
}
=============== END ser.cfg ================
15 May
15 May
5:52 p.m.
You need to use advertised_address and advertised_port just below listen
directive.
g-)
Wei Wang wrote:
I have a problem running SER behind firewall.
Here is the network diagram:
|UA1|--|FW1| +--|FW|--|SER|
\ /
+--+
/ \
|UA2|--|FW2| +--|MediaProxy|
Where, UA1 and UA2 are Xlite soft-phones behind their own firewalls. SER
is listening on private IP address 192.168.4.217. FW has public IP
address 66.134.1.34 and forwards port 5060 to SER.
The ser.cfg file is pretty much copied from SER getting start guide.
When UA1 calling UA2, the call established fine but UA1 will hang up by
itself after ~30 seconds. The captured IP packages on SER revealed that
the last ACK received from UA2 by SER was sent to FW IP address. Since
port 5060 is forwarded to SER on the FW, it caused a looping situation.
The ser.cfg is listed at the end.
Thanks in advance.
Wei Wang
wwang(a)m1global.com
======== ser.cfg ============
debug=3 # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no # (cmd line: -E)
/* Uncomment these lines to enter debugging mode
debug=3
#debug=9
fork=no
log_stderror=yes
*/
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=192.168.4.217
#listen=66.134.1.36
port=5060
children=4
fifo="/tmp/ser_fifo"
fifo_db_url="mysql://ser:s3rv1c3@localhost/ser"
# ------------------ module loading ----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/permissions.so"
# Uncomment this if you want digest authentication
# mysql.so must be loaded !
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"
loadmodule "/usr/local/lib/ser/modules/uri.so"
loadmodule "/usr/local/lib/ser/modules/uri_db.so"
loadmodule "/usr/local/lib/ser/modules/domain.so"
loadmodule "/usr/local/lib/ser/modules/mediaproxy.so"
loadmodule "/usr/local/lib/ser/modules/nathelper.so"
loadmodule "/usr/local/lib/ser/modules/print.so"
loadmodule "/usr/local/lib/ser/modules/xlog.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
#modparam("usrloc", "db_mode", 0)
# Uncomment this if you want to use SQL database
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)
# -- auth params --
# Uncomment if you are using auth module
#
modparam("auth_db|permissions|uri_db|usrloc", "db_url",
"mysql://ser:s3rv1c3@localhost/ser")
modparam("auth_db", "calculate_ha1", 1)
#
# If you set "calculate_ha1" parameter to yes (which true in this
config),
# uncomment also the following parameter)
#
modparam("auth_db", "password_column", "password")
modparam("nathelper", "rtpproxy_disable", 1)
modparam("nathelper", "natping_interval", 0)
modparam("mediaproxy", "natping_interval", 30)
#modparam("mediaproxy", "mediaproxy_socket",
"/var/run/mediaproxy.sock")
modparam("mediaproxy", "mediaproxy_socket",
"/var/run/proxydispatcher.sock")
modparam("mediaproxy", "sip_asymmetrics",
"/usr/local/etc/ser/sip-clients")
modparam("mediaproxy", "rtp_asymmetrics",
"/usr/local/etc/ser/rtp-clients")
modparam("registrar", "nat_flag", 6)
# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)
modparam("permissions", "db_mode", 1)
modparam("permissions", "trusted_table", "trusted")
modparam("xlog", "buf_size", 8192)
# ------------------------- request routing logic -------------------
# main routing logic
route{
# xlog("L_INFO", "Main route
[From]%fu,[To]%tu,[Req-Method]%rm,[Req-RURI]%ru[IP-src]%is ...\n");
if(method != "SUBSCRIBE") {
xlog("L_INFO", "\r\n===========SIP
MSG==================\r\n%mb\r\n_____END SIP
MSG________________________\r\n");
};
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too Many Hops");
break;
};
if (msg:len >= 4086 ) {
sl_send_reply("513", "Message too big");
break;
};
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (method == "INVITE" && client_nat_test("3")) {
# xlog("L_INFO", "method==INVITE and nated: calling
record_route_preset\n");
# IP ADDRESS Here
record_route_preset("66.134.1.34:5060;nat=yes");
} else if (method!="REGISTER") {
record_route();
};
# -------------------------
# Call Tear Down Section
#-------------------------
if(method=="BYE" || method=="CANCEL") {
#xlog("L_INFO", "RECEIVED BYE or CANCEL...");
end_media_session();
};
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
xlog("L_INFO", "DEBUG: loose_route...");
if((method=="INVITE" || method == "REFER")
&&
!has_totag()) {
sl_send_reply("403", "Forbidden");
break;
};
if(method == "INVITE") {
if(!allow_trusted()) {
if(!proxy_authorize("",
"subscriber")) {
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use
From=ID");
break;
};
consume_credentials();
}
if(client_nat_test("3")
|| search("^Route:.*;nat=yes")) {
setflag(6);
use_media_proxy();
};
};
# mark routing logic in request
#append_hf("P-hint: rr-enforced\r\n");
route(1);
break;
};
if (!uri==myself) {
route(4);
# mark routing logic in request
#append_hf("P-hint: outbound\r\n");
route(1);
break;
};
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if(method == "ACK") {
route(1);
break;
} else if(method=="CANCEL") {
route(1);
break;
} else if(method == "INVITE") {
route(3);
break;
} else if (method=="REGISTER") {
route(2);
break;
};
lookup("aliases");
if (!uri==myself) {
route(4);
#append_hf("P-hint: outbound alias\r\n");
route(1);
break;
};
# native SIP destinations are handled using our USRLOC DB
if (!lookup("location")) {
sl_send_reply("404", "Not Found");
break;
};
append_hf("P-hint: usrloc applied\r\n");
route(1);
}
route[1]
{
t_on_reply("1");
# send it out now; use stateful forwarding as it works reliably
# even for UDP2TCP
if (!t_relay()) {
if(method=="INVITE" || method == "ACK") {
end_media_session();
};
sl_reply_error();
};
}
route[2]
{
############################
# REGISTER Message Handler
###########################
sl_send_reply("100", "Trying");
if(!search("^Contact:[ ]*\*") &&
client_nat_test("7")) {
setflag(6);
fix_nated_register();
force_rport();
};
if(!www_authorize("", "subscriber")) {
www_challenge("", "0");
break;
};
if(!check_to()) {
sl_send_reply("401", "Unauthorized");
break;
};
consume_credentials();
if(!save("location")) {
sl_reply_error();
};
}
route[3]
{
############################
# INVITE Message Handler
###########################
if(client_nat_test("3")) {
setflag(7);
force_rport();
fix_nated_contact();
};
if(!allow_trusted()) {
if(!proxy_authorize("", "subscriber")) {
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use From=ID");
break;
};
};
consume_credentials();
lookup("aliases");
if(uri != myself) {
route(4);
route(1);
break;
};
if(!lookup("location")) {
sl_send_reply("404", "User Not Found");
break;
};
route(4);
route(1);
}
route[4] {
#----------------------------
# NAT Traversal Section
#----------------------------
if(isflagset(6) || isflagset(7)) {
if(!isflagset(8)) {
setflag(8);
use_media_proxy();
};
};
}
onreply_route[1] {
if((isflagset(6) || isflagset(7))
&& (status =~ "(180)|183)|2[0-9][0-9]")) {
if(!search("^Content-Length:[ ]*0")) {
use_media_proxy();
};
};
if(client_nat_test("1")) {
fix_nated_contact();
};
}
=============== END ser.cfg ================
_______________________________________________
Serusers mailing list
Serusers(a)lists.iptel.org
http://lists.iptel.org/mailman/listinfo/serusers
7:01 p.m.
Greger,
Thanks for the help. I've added advertised_address to the ser.cfg file.
...
listen=192.168.4.217
port=5060
advertised_address=66.134.1.34
advertised_port=5060
....
But it did not seem to help.
Here is the TCP traffic:
================= START TCPDUMP =================
11:50:38.459320 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
862
E..z..@.@..'....B..".....f..ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
11:50:38.459602 IP 192.168.4.1.5060 > 192.168.4.217.5060: SIP, length:
862
E..z..@.?..%.............f-.ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
11:50:38.459885 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
982
E.....@.@.-.....B.."......^M.ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP 66.134.1.34:5060;received=192.168.4.1;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 15^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
================= END TCPDUMP =================
Again, the last ACT was sent to the firewall's external IP
address(66.134.1.34).
-----Original Message-----
From: Greger V. Teigre [mailto:greger@teigre.com]
Sent: Tuesday, May 15, 2007 10:53 AM
To: Wei Wang
Cc: serusers(a)iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
You need to use advertised_address and advertised_port just below listen
directive.
g-)
Wei Wang wrote:
I have a problem running SER behind firewall.
Here is the network diagram:
|UA1|--|FW1| +--|FW|--|SER|
\ /
+--+
/ \
|UA2|--|FW2| +--|MediaProxy|
Where, UA1 and UA2 are Xlite soft-phones behind their own firewalls.
SER
is listening on private IP address 192.168.4.217. FW
has public IP
address 66.134.1.34 and forwards port 5060 to SER.
The ser.cfg file is pretty much copied from SER getting start guide.
When UA1 calling UA2, the call established fine but UA1 will hang up
by
itself after ~30 seconds. The captured IP packages on
SER revealed
that
the last ACK received from UA2 by SER was sent to FW
IP address. Since
port 5060 is forwarded to SER on the FW, it caused a looping
situation.
The ser.cfg is listed at the end.
Thanks in advance.
Wei Wang
wwang(a)m1global.com
======== ser.cfg ============
debug=3 # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no # (cmd line: -E)
/* Uncomment these lines to enter debugging mode
debug=3
#debug=9
fork=no
log_stderror=yes
*/
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=192.168.4.217
#listen=66.134.1.36
port=5060
children=4
fifo="/tmp/ser_fifo"
fifo_db_url="mysql://ser:s3rv1c3@localhost/ser"
# ------------------ module loading ----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/permissions.so"
# Uncomment this if you want digest authentication
# mysql.so must be loaded !
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"
loadmodule "/usr/local/lib/ser/modules/uri.so"
loadmodule "/usr/local/lib/ser/modules/uri_db.so"
loadmodule "/usr/local/lib/ser/modules/domain.so"
loadmodule "/usr/local/lib/ser/modules/mediaproxy.so"
loadmodule "/usr/local/lib/ser/modules/nathelper.so"
loadmodule "/usr/local/lib/ser/modules/print.so"
loadmodule "/usr/local/lib/ser/modules/xlog.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
#modparam("usrloc", "db_mode", 0)
# Uncomment this if you want to use SQL database
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)
# -- auth params --
# Uncomment if you are using auth module
#
modparam("auth_db|permissions|uri_db|usrloc", "db_url",
"mysql://ser:s3rv1c3@localhost/ser")
modparam("auth_db", "calculate_ha1", 1)
#
# If you set "calculate_ha1" parameter to yes (which true in this
config),
# uncomment also the following parameter)
#
modparam("auth_db", "password_column", "password")
modparam("nathelper", "rtpproxy_disable", 1)
modparam("nathelper", "natping_interval", 0)
modparam("mediaproxy", "natping_interval", 30)
#modparam("mediaproxy", "mediaproxy_socket",
"/var/run/mediaproxy.sock")
modparam("mediaproxy",
"mediaproxy_socket",
"/var/run/proxydispatcher.sock")
modparam("mediaproxy", "sip_asymmetrics",
"/usr/local/etc/ser/sip-clients")
modparam("mediaproxy", "rtp_asymmetrics",
"/usr/local/etc/ser/rtp-clients")
modparam("registrar", "nat_flag", 6)
# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)
modparam("permissions", "db_mode", 1)
modparam("permissions", "trusted_table", "trusted")
modparam("xlog", "buf_size", 8192)
# ------------------------- request routing logic -------------------
# main routing logic
route{
# xlog("L_INFO", "Main route
[From]%fu,[To]%tu,[Req-Method]%rm,[Req-RURI]%ru[IP-src]%is ...\n");
if(method != "SUBSCRIBE") {
xlog("L_INFO", "\r\n===========SIP
MSG==================\r\n%mb\r\n_____END SIP
MSG________________________\r\n");
};
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too Many Hops");
break;
};
if (msg:len >= 4086 ) {
sl_send_reply("513", "Message too big");
break;
};
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (method == "INVITE" && client_nat_test("3")) {
# xlog("L_INFO", "method==INVITE and nated: calling
record_route_preset\n");
# IP ADDRESS Here
record_route_preset("66.134.1.34:5060;nat=yes");
} else if (method!="REGISTER") {
record_route();
};
# -------------------------
# Call Tear Down Section
#-------------------------
if(method=="BYE" || method=="CANCEL") {
#xlog("L_INFO", "RECEIVED BYE or CANCEL...");
end_media_session();
};
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
xlog("L_INFO", "DEBUG: loose_route...");
if((method=="INVITE" || method == "REFER")
&&
!has_totag()) {
sl_send_reply("403", "Forbidden");
break;
};
if(method == "INVITE") {
if(!allow_trusted()) {
if(!proxy_authorize("",
"subscriber"))
{
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use
From=ID");
break;
};
consume_credentials();
}
if(client_nat_test("3")
|| search("^Route:.*;nat=yes")) {
setflag(6);
use_media_proxy();
};
};
# mark routing logic in request
#append_hf("P-hint: rr-enforced\r\n");
route(1);
break;
};
if (!uri==myself) {
route(4);
# mark routing logic in request
#append_hf("P-hint: outbound\r\n");
route(1);
break;
};
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if(method == "ACK") {
route(1);
break;
} else if(method=="CANCEL") {
route(1);
break;
} else if(method == "INVITE") {
route(3);
break;
} else if (method=="REGISTER") {
route(2);
break;
};
lookup("aliases");
if (!uri==myself) {
route(4);
#append_hf("P-hint: outbound alias\r\n");
route(1);
break;
};
# native SIP destinations are handled using our USRLOC DB
if (!lookup("location")) {
sl_send_reply("404", "Not Found");
break;
};
append_hf("P-hint: usrloc applied\r\n");
route(1);
}
route[1]
{
t_on_reply("1");
# send it out now; use stateful forwarding as it works
reliably
# even for UDP2TCP
if (!t_relay()) {
if(method=="INVITE" || method == "ACK") {
end_media_session();
};
sl_reply_error();
};
}
route[2]
{
############################
# REGISTER Message Handler
###########################
sl_send_reply("100", "Trying");
if(!search("^Contact:[ ]*\*") &&
client_nat_test("7")) {
setflag(6);
fix_nated_register();
force_rport();
};
if(!www_authorize("", "subscriber")) {
www_challenge("", "0");
break;
};
if(!check_to()) {
sl_send_reply("401", "Unauthorized");
break;
};
consume_credentials();
if(!save("location")) {
sl_reply_error();
};
}
route[3]
{
############################
# INVITE Message Handler
###########################
if(client_nat_test("3")) {
setflag(7);
force_rport();
fix_nated_contact();
};
if(!allow_trusted()) {
if(!proxy_authorize("", "subscriber")) {
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use From=ID");
break;
};
};
consume_credentials();
lookup("aliases");
if(uri != myself) {
route(4);
route(1);
break;
};
if(!lookup("location")) {
sl_send_reply("404", "User Not Found");
break;
};
route(4);
route(1);
}
route[4] {
#----------------------------
# NAT Traversal Section
#----------------------------
if(isflagset(6) || isflagset(7)) {
if(!isflagset(8)) {
setflag(8);
use_media_proxy();
};
};
}
onreply_route[1] {
if((isflagset(6) || isflagset(7))
&& (status =~ "(180)|183)|2[0-9][0-9]")) {
if(!search("^Content-Length:[ ]*0")) {
use_media_proxy();
};
};
if(client_nat_test("1")) {
fix_nated_contact();
};
}
=============== END ser.cfg ================
_______________________________________________
Serusers mailing list
Serusers(a)lists.iptel.org
http://lists.iptel.org/mailman/listinfo/serusers
16 May
16 May
10:57 a.m.
You have to use your public ip by using record_route_preset also for
non-NATed.
As you can see, the Record-Route header contains your private address.
g-)
Wei Wang wrote:
Greger,
Thanks for the help. I've added advertised_address to the ser.cfg file.
...
listen=192.168.4.217
port=5060
advertised_address=66.134.1.34
advertised_port=5060
....
But it did not seem to help.
Here is the TCP traffic:
================= START TCPDUMP =================
11:50:38.459320 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
862
E..z..@.@..'....B..".....f..ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
11:50:38.459602 IP 192.168.4.1.5060 > 192.168.4.217.5060: SIP, length:
862
E..z..@.?..%.............f-.ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
11:50:38.459885 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
982
E.....@.@.-.....B.."......^M.ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP 66.134.1.34:5060;received=192.168.4.1;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 15^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
================= END TCPDUMP =================
Again, the last ACT was sent to the firewall's external IP
address(66.134.1.34).
-----Original Message-----
From: Greger V. Teigre [mailto:greger@teigre.com]
Sent: Tuesday, May 15, 2007 10:53 AM
To: Wei Wang
Cc: serusers(a)iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
You need to use advertised_address and advertised_port just below listen
directive.
g-)
Wei Wang wrote:
I have a problem running SER behind firewall.
Here is the network diagram:
|UA1|--|FW1| +--|FW|--|SER|
\ /
+--+
/ \
|UA2|--|FW2| +--|MediaProxy|
Where, UA1 and UA2 are Xlite soft-phones behind their own firewalls.
SER
is listening on private IP address 192.168.4.217.
FW has public IP
address 66.134.1.34 and forwards port 5060 to SER.
The ser.cfg file is pretty much copied from SER getting start guide.
When UA1 calling UA2, the call established fine but UA1 will hang up
by
itself after ~30 seconds. The captured IP
packages on SER revealed
that
the last ACK received from UA2 by SER was sent to
FW IP address. Since
port 5060 is forwarded to SER on the FW, it caused a looping
situation.
The ser.cfg is listed at the end.
Thanks in advance.
Wei Wang
wwang(a)m1global.com
======== ser.cfg ============
debug=3 # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no # (cmd line: -E)
/* Uncomment these lines to enter debugging mode
debug=3
#debug=9
fork=no
log_stderror=yes
*/
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=192.168.4.217
#listen=66.134.1.36
port=5060
children=4
fifo="/tmp/ser_fifo"
fifo_db_url="mysql://ser:s3rv1c3@localhost/ser"
# ------------------ module loading ----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/permissions.so"
# Uncomment this if you want digest authentication
# mysql.so must be loaded !
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"
loadmodule "/usr/local/lib/ser/modules/uri.so"
loadmodule "/usr/local/lib/ser/modules/uri_db.so"
loadmodule "/usr/local/lib/ser/modules/domain.so"
loadmodule "/usr/local/lib/ser/modules/mediaproxy.so"
loadmodule "/usr/local/lib/ser/modules/nathelper.so"
loadmodule "/usr/local/lib/ser/modules/print.so"
loadmodule "/usr/local/lib/ser/modules/xlog.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
#modparam("usrloc", "db_mode", 0)
# Uncomment this if you want to use SQL database
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)
# -- auth params --
# Uncomment if you are using auth module
#
modparam("auth_db|permissions|uri_db|usrloc", "db_url",
"mysql://ser:s3rv1c3@localhost/ser")
modparam("auth_db", "calculate_ha1", 1)
#
# If you set "calculate_ha1" parameter to yes (which true in this
config),
# uncomment also the following parameter)
#
modparam("auth_db", "password_column", "password")
modparam("nathelper", "rtpproxy_disable", 1)
modparam("nathelper", "natping_interval", 0)
modparam("mediaproxy", "natping_interval", 30)
#modparam("mediaproxy", "mediaproxy_socket",
"/var/run/mediaproxy.sock")
modparam("mediaproxy",
"mediaproxy_socket",
"/var/run/proxydispatcher.sock")
modparam("mediaproxy", "sip_asymmetrics",
"/usr/local/etc/ser/sip-clients")
modparam("mediaproxy", "rtp_asymmetrics",
"/usr/local/etc/ser/rtp-clients")
modparam("registrar", "nat_flag", 6)
# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)
modparam("permissions", "db_mode", 1)
modparam("permissions", "trusted_table", "trusted")
modparam("xlog", "buf_size", 8192)
# ------------------------- request routing logic -------------------
# main routing logic
route{
# xlog("L_INFO", "Main route
[From]%fu,[To]%tu,[Req-Method]%rm,[Req-RURI]%ru[IP-src]%is ...\n");
if(method != "SUBSCRIBE") {
xlog("L_INFO", "\r\n===========SIP
MSG==================\r\n%mb\r\n_____END SIP
MSG________________________\r\n");
};
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too Many Hops");
break;
};
if (msg:len >= 4086 ) {
sl_send_reply("513", "Message too big");
break;
};
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (method == "INVITE" && client_nat_test("3")) {
# xlog("L_INFO", "method==INVITE and nated: calling
record_route_preset\n");
# IP ADDRESS Here
record_route_preset("66.134.1.34:5060;nat=yes");
} else if (method!="REGISTER") {
record_route();
};
# -------------------------
# Call Tear Down Section
#-------------------------
if(method=="BYE" || method=="CANCEL") {
#xlog("L_INFO", "RECEIVED BYE or CANCEL...");
end_media_session();
};
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
xlog("L_INFO", "DEBUG: loose_route...");
if((method=="INVITE" || method == "REFER")
&&
!has_totag()) {
sl_send_reply("403", "Forbidden");
break;
};
if(method == "INVITE") {
if(!allow_trusted()) {
if(!proxy_authorize("",
"subscriber"))
{
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use
From=ID");
break;
};
consume_credentials();
}
if(client_nat_test("3")
|| search("^Route:.*;nat=yes")) {
setflag(6);
use_media_proxy();
};
};
# mark routing logic in request
#append_hf("P-hint: rr-enforced\r\n");
route(1);
break;
};
if (!uri==myself) {
route(4);
# mark routing logic in request
#append_hf("P-hint: outbound\r\n");
route(1);
break;
};
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if(method == "ACK") {
route(1);
break;
} else if(method=="CANCEL") {
route(1);
break;
} else if(method == "INVITE") {
route(3);
break;
} else if (method=="REGISTER") {
route(2);
break;
};
lookup("aliases");
if (!uri==myself) {
route(4);
#append_hf("P-hint: outbound alias\r\n");
route(1);
break;
};
# native SIP destinations are handled using our USRLOC DB
if (!lookup("location")) {
sl_send_reply("404", "Not Found");
break;
};
append_hf("P-hint: usrloc applied\r\n");
route(1);
}
route[1]
{
t_on_reply("1");
# send it out now; use stateful forwarding as it works
reliably
# even for UDP2TCP
if (!t_relay()) {
if(method=="INVITE" || method == "ACK") {
end_media_session();
};
sl_reply_error();
};
}
route[2]
{
############################
# REGISTER Message Handler
###########################
sl_send_reply("100", "Trying");
if(!search("^Contact:[ ]*\*") &&
client_nat_test("7")) {
setflag(6);
fix_nated_register();
force_rport();
};
if(!www_authorize("", "subscriber")) {
www_challenge("", "0");
break;
};
if(!check_to()) {
sl_send_reply("401", "Unauthorized");
break;
};
consume_credentials();
if(!save("location")) {
sl_reply_error();
};
}
route[3]
{
############################
# INVITE Message Handler
###########################
if(client_nat_test("3")) {
setflag(7);
force_rport();
fix_nated_contact();
};
if(!allow_trusted()) {
if(!proxy_authorize("", "subscriber")) {
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use From=ID");
break;
};
};
consume_credentials();
lookup("aliases");
if(uri != myself) {
route(4);
route(1);
break;
};
if(!lookup("location")) {
sl_send_reply("404", "User Not Found");
break;
};
route(4);
route(1);
}
route[4] {
#----------------------------
# NAT Traversal Section
#----------------------------
if(isflagset(6) || isflagset(7)) {
if(!isflagset(8)) {
setflag(8);
use_media_proxy();
};
};
}
onreply_route[1] {
if((isflagset(6) || isflagset(7))
&& (status =~ "(180)|183)|2[0-9][0-9]")) {
if(!search("^Content-Length:[ ]*0")) {
use_media_proxy();
};
};
if(client_nat_test("1")) {
fix_nated_contact();
};
}
=============== END ser.cfg ================
_______________________________________________
Serusers mailing list
Serusers(a)lists.iptel.org
http://lists.iptel.org/mailman/listinfo/serusers
5:15 p.m.
Changed the cfg file to do record_route_preset to avoid private address
being added to the Record-Route header. Now the Record-Route header
contains public address. But the problem remains.
I am quite new to SIP. I don't understand why SER sent the last ACK
received from UA1 to the firewall public address instead of UA2's public
IP. But INVITE went through fine.
Thanks,
Wei
============ tcpdump =================
10:02:09.277595 IP 68.158.174.169.33415 > 192.168.4.217.5060: SIP,
length: 757
E.......t.|AD..............cACK
sip:1002@63.111.4.162:17784;rinstance=59a418695e254c5a SIP/2.0^M
Via: SIP/2.0/UDP
68.158.174.169:30236;branch=z9hG4bK-d87543-a44efa3aad34e076-1--d87543-;r
port^M
Max-Forwards: 70^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=9846c732>^M
Contact: <sip:1001@68.158.174.169:33415>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=8126ba56^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=9846c732^M
Call-ID: ZTZiYWY0ZmI2ZWUyMWNmNGNkZjJlMjQzNmQ2NTBmMTk.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="464b100a413a877d15
0f21e026e37da975d1a72b",uri="sip:1002@starpound.dnsalias.org",response="
3fb4c3d90a7c848146d49188666e95f9",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
^M
10:02:09.277925 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
878
E.....@.@.-.....B..".....v..ACK
sip:1002@63.111.4.162:17784;rinstance=59a418695e254c5a SIP/2.0^M
Record-Route: <sip:1002@66.134.1.34:5060;nat=yes;ftag=9846c732;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:30236;branch=z9hG4bK-d87543-a44efa3aad34e076-1--d87543-;r
port=33415^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=9846c732>^M
Contact: <sip:1001@68.158.174.169:33415>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=8126ba56^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=9846c732^M
Call-ID: ZTZiYWY0ZmI2ZWUyMWNmNGNkZjJlMjQzNmQ2NTBmMTk.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="464b100a413a877d15
0f21e026e37da975d1a72b",uri="sip:1002@starpound.dnsalias.org",response="
3fb4c3d90a7c848146d49188666e95f9",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
=========== end tcpdump ==================
________________________________________
From: Greger V. Teigre [mailto:greger@teigre.com]
Sent: Wednesday, May 16, 2007 3:58 AM
To: Wei Wang
Cc: serusers(a)iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
You have to use your public ip by using record_route_preset also for
non-NATed.
As you can see, the Record-Route header contains your private address.
g-)
Wei Wang wrote:
Greger,
Thanks for the help. I've added advertised_address to the ser.cfg file.
...
listen=192.168.4.217
port=5060
advertised_address=66.134.1.34
advertised_port=5060
....
But it did not seem to help.
Here is the TCP traffic:
================= START TCPDUMP =================
11:50:38.459320 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
862
E..z..@.@..'....B..".....f..ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
11:50:38.459602 IP 192.168.4.1.5060 > 192.168.4.217.5060: SIP, length:
862
E..z..@.?..%.............f-.ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
11:50:38.459885 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
982
E.....@.@.-.....B.."......^M.ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP 66.134.1.34:5060;received=192.168.4.1;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 15^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
================= END TCPDUMP =================
Again, the last ACT was sent to the firewall's external IP
address(66.134.1.34).
-----Original Message-----
From: Greger V. Teigre [mailto:greger@teigre.com]
Sent: Tuesday, May 15, 2007 10:53 AM
To: Wei Wang
Cc: serusers(a)iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
You need to use advertised_address and advertised_port just below listen
directive.
g-)
Wei Wang wrote:
I have a problem running SER behind firewall.
Here is the network diagram:
|UA1|--|FW1| +--|FW|--|SER|
\ /
+--+
/ \
|UA2|--|FW2| +--|MediaProxy|
Where, UA1 and UA2 are Xlite soft-phones behind their own firewalls.
SER
is listening on private IP address 192.168.4.217. FW has public IP
address 66.134.1.34 and forwards port 5060 to SER.
The ser.cfg file is pretty much copied from SER getting start guide.
When UA1 calling UA2, the call established fine but UA1 will hang up
by
itself after ~30 seconds. The captured IP packages on SER revealed
that
the last ACK received from UA2 by SER was sent to FW IP address. Since
port 5060 is forwarded to SER on the FW, it caused a looping
situation.
The ser.cfg is listed at the end.
Thanks in advance.
Wei Wang
wwang(a)m1global.com
======== ser.cfg ============
debug=3 # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no # (cmd line: -E)
/* Uncomment these lines to enter debugging mode
debug=3
#debug=9
fork=no
log_stderror=yes
*/
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=192.168.4.217
#listen=66.134.1.36
port=5060
children=4
fifo="/tmp/ser_fifo"
fifo_db_url="mysql://ser:s3rv1c3@localhost/ser"
# ------------------ module loading ----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/permissions.so"
# Uncomment this if you want digest authentication
# mysql.so must be loaded !
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"
loadmodule "/usr/local/lib/ser/modules/uri.so"
loadmodule "/usr/local/lib/ser/modules/uri_db.so"
loadmodule "/usr/local/lib/ser/modules/domain.so"
loadmodule "/usr/local/lib/ser/modules/mediaproxy.so"
loadmodule "/usr/local/lib/ser/modules/nathelper.so"
loadmodule "/usr/local/lib/ser/modules/print.so"
loadmodule "/usr/local/lib/ser/modules/xlog.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
#modparam("usrloc", "db_mode", 0)
# Uncomment this if you want to use SQL database
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)
# -- auth params --
# Uncomment if you are using auth module
#
modparam("auth_db|permissions|uri_db|usrloc", "db_url",
"mysql://ser:s3rv1c3@localhost/ser")
modparam("auth_db", "calculate_ha1", 1)
#
# If you set "calculate_ha1" parameter to yes (which true in this
config),
# uncomment also the following parameter)
#
modparam("auth_db", "password_column", "password")
modparam("nathelper", "rtpproxy_disable", 1)
modparam("nathelper", "natping_interval", 0)
modparam("mediaproxy", "natping_interval", 30)
#modparam("mediaproxy", "mediaproxy_socket",
"/var/run/mediaproxy.sock")
modparam("mediaproxy", "mediaproxy_socket",
"/var/run/proxydispatcher.sock")
modparam("mediaproxy", "sip_asymmetrics",
"/usr/local/etc/ser/sip-clients")
modparam("mediaproxy", "rtp_asymmetrics",
"/usr/local/etc/ser/rtp-clients")
modparam("registrar", "nat_flag", 6)
# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)
modparam("permissions", "db_mode", 1)
modparam("permissions", "trusted_table", "trusted")
modparam("xlog", "buf_size", 8192)
# ------------------------- request routing logic -------------------
# main routing logic
route{
# xlog("L_INFO", "Main route
[From]%fu,[To]%tu,[Req-Method]%rm,[Req-RURI]%ru[IP-src]%is ...\n");
if(method != "SUBSCRIBE") {
xlog("L_INFO", "\r\n===========SIP
MSG==================\r\n%mb\r\n_____END SIP
MSG________________________\r\n");
};
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too Many Hops");
break;
};
if (msg:len >= 4086 ) {
sl_send_reply("513", "Message too big");
break;
};
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (method == "INVITE" && client_nat_test("3")) {
# xlog("L_INFO", "method==INVITE and nated: calling
record_route_preset\n");
# IP ADDRESS Here
record_route_preset("66.134.1.34:5060;nat=yes");
} else if (method!="REGISTER") {
record_route();
};
# -------------------------
# Call Tear Down Section
#-------------------------
if(method=="BYE" || method=="CANCEL") {
#xlog("L_INFO", "RECEIVED BYE or CANCEL...");
end_media_session();
};
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
xlog("L_INFO", "DEBUG: loose_route...");
if((method=="INVITE" || method == "REFER") &&
!has_totag()) {
sl_send_reply("403", "Forbidden");
break;
};
if(method == "INVITE") {
if(!allow_trusted()) {
if(!proxy_authorize("",
"subscriber"))
{
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use
From=ID");
break;
};
consume_credentials();
}
if(client_nat_test("3")
|| search("^Route:.*;nat=yes")) {
setflag(6);
use_media_proxy();
};
};
# mark routing logic in request
#append_hf("P-hint: rr-enforced\r\n");
route(1);
break;
};
if (!uri==myself) {
route(4);
# mark routing logic in request
#append_hf("P-hint: outbound\r\n");
route(1);
break;
};
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if(method == "ACK") {
route(1);
break;
} else if(method=="CANCEL") {
route(1);
break;
} else if(method == "INVITE") {
route(3);
break;
} else if (method=="REGISTER") {
route(2);
break;
};
lookup("aliases");
if (!uri==myself) {
route(4);
#append_hf("P-hint: outbound alias\r\n");
route(1);
break;
};
# native SIP destinations are handled using our USRLOC DB
if (!lookup("location")) {
sl_send_reply("404", "Not Found");
break;
};
append_hf("P-hint: usrloc applied\r\n");
route(1);
}
route[1]
{
t_on_reply("1");
# send it out now; use stateful forwarding as it works
reliably
# even for UDP2TCP
if (!t_relay()) {
if(method=="INVITE" || method == "ACK") {
end_media_session();
};
sl_reply_error();
};
}
route[2]
{
############################
# REGISTER Message Handler
###########################
sl_send_reply("100", "Trying");
if(!search("^Contact:[ ]*\*") && client_nat_test("7"))
{
setflag(6);
fix_nated_register();
force_rport();
};
if(!www_authorize("", "subscriber")) {
www_challenge("", "0");
break;
};
if(!check_to()) {
sl_send_reply("401", "Unauthorized");
break;
};
consume_credentials();
if(!save("location")) {
sl_reply_error();
};
}
route[3]
{
############################
# INVITE Message Handler
###########################
if(client_nat_test("3")) {
setflag(7);
force_rport();
fix_nated_contact();
};
if(!allow_trusted()) {
if(!proxy_authorize("", "subscriber")) {
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use From=ID");
break;
};
};
consume_credentials();
lookup("aliases");
if(uri != myself) {
route(4);
route(1);
break;
};
if(!lookup("location")) {
sl_send_reply("404", "User Not Found");
break;
};
route(4);
route(1);
}
route[4] {
#----------------------------
# NAT Traversal Section
#----------------------------
if(isflagset(6) || isflagset(7)) {
if(!isflagset(8)) {
setflag(8);
use_media_proxy();
};
};
}
onreply_route[1] {
if((isflagset(6) || isflagset(7))
&& (status =~ "(180)|183)|2[0-9][0-9]")) {
if(!search("^Content-Length:[ ]*0")) {
use_media_proxy();
};
};
if(client_nat_test("1")) {
fix_nated_contact();
};
}
=============== END ser.cfg ================
_______________________________________________
Serusers mailing list
Serusers(a)lists.iptel.org
http://lists.iptel.org/mailman/listinfo/serusers
9:33 p.m.
Are you sure the ACK still does not reach ua2? I cannot see anything wrong, except that
you record route ack, which normally does no harm, but has no effect
either.
I may confuse ips here.. Btw, I would expect the ack to not have any Route, but with
contact of ua2 as the r-uri. Do any of the firewalls do SIP ALG and add
their own route?
another worth trying, is to add alias=public-ip to your config. It may be that ser does
not recognize the route as it's own and thus relays it according to the
route.
g-)
------- Original message -------
From: Wei Wang <wwang(a)m1global.com>
Cc: serusers(a)iptel.org
Sent: 16.5.'07, 10:15
Changed the cfg file to do record_route_preset to
avoid private address
being added to the Record-Route header. Now the Record-Route header
contains public address. But the problem remains.
I am quite new to SIP. I don't understand why SER sent the last ACK
received from UA1 to the firewall public address instead of UA2's public
IP. But INVITE went through fine.
Thanks,
Wei
============ tcpdump =================
10:02:09.277595 IP 68.158.174.169.33415 > 192.168.4.217.5060: SIP,
length: 757
E.......t.|AD..............cACK
sip:1002@63.111.4.162:17784;rinstance=59a418695e254c5a SIP/2.0^M
Via: SIP/2.0/UDP
68.158.174.169:30236;branch=z9hG4bK-d87543-a44efa3aad34e076-1--d87543-;r
port^M
Max-Forwards: 70^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=9846c732>^M
Contact: <sip:1001@68.158.174.169:33415>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=8126ba56^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=9846c732^M
Call-ID: ZTZiYWY0ZmI2ZWUyMWNmNGNkZjJlMjQzNmQ2NTBmMTk.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="464b100a413a877d15
0f21e026e37da975d1a72b",uri="sip:1002@starpound.dnsalias.org",response="
3fb4c3d90a7c848146d49188666e95f9",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
^M
10:02:09.277925 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
878
E.....@.@.-.....B..".....v..ACK
sip:1002@63.111.4.162:17784;rinstance=59a418695e254c5a SIP/2.0^M
Record-Route: <sip:1002@66.134.1.34:5060;nat=yes;ftag=9846c732;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:30236;branch=z9hG4bK-d87543-a44efa3aad34e076-1--d87543-;r
port=33415^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=9846c732>^M
Contact: <sip:1001@68.158.174.169:33415>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=8126ba56^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=9846c732^M
Call-ID: ZTZiYWY0ZmI2ZWUyMWNmNGNkZjJlMjQzNmQ2NTBmMTk.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="464b100a413a877d15
0f21e026e37da975d1a72b",uri="sip:1002@starpound.dnsalias.org",response="
3fb4c3d90a7c848146d49188666e95f9",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
=========== end tcpdump ==================
________________________________________
From: Greger V. Teigre [mailto:greger@teigre.com]
Sent: Wednesday, May 16, 2007 3:58 AM
To: Wei Wang
Cc: serusers(a)iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
You have to use your public ip by using record_route_preset also for
non-NATed.
As you can see, the Record-Route header contains your private address.
g-)
Wei Wang wrote:
Greger,
Thanks for the help. I've added advertised_address to the ser.cfg file.
...
listen=192.168.4.217
port=5060
advertised_address=66.134.1.34
advertised_port=5060
....
But it did not seem to help.
Here is the TCP traffic:
================= START TCPDUMP =================
11:50:38.459320 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
862
E..z..@.@..'....B..".....f..ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
11:50:38.459602 IP 192.168.4.1.5060 > 192.168.4.217.5060: SIP, length:
862
E..z..@.?..%.............f-.ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 16^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
11:50:38.459885 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
982
E.....@.@.-.....B.."......^M.ACK
sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
Via: SIP/2.0/UDP 66.134.1.34:5060;received=192.168.4.1;branch=0^M
Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
port=33341^M
Max-Forwards: 15^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
Contact: <sip:1001@68.158.174.169:33341>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
================= END TCPDUMP =================
Again, the last ACT was sent to the firewall's external IP
address(66.134.1.34).
-----Original Message-----
From: Greger V. Teigre [mailto:greger@teigre.com]
Sent: Tuesday, May 15, 2007 10:53 AM
To: Wei Wang
Cc: serusers(a)iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
You need to use advertised_address and advertised_port just below listen
directive.
g-)
Wei Wang wrote:
I have a problem running SER behind firewall.
Here is the network diagram:
|UA1|--|FW1| +--|FW|--|SER|
\ /
+--+
/ \
|UA2|--|FW2| +--|MediaProxy|
Where, UA1 and UA2 are Xlite soft-phones behind their own firewalls.
SER
is listening on private IP address 192.168.4.217. FW has public IP
address 66.134.1.34 and forwards port 5060 to SER.
The ser.cfg file is pretty much copied from SER getting start guide.
When UA1 calling UA2, the call established fine but UA1 will hang up
by
itself after ~30 seconds. The captured IP packages on SER revealed
that
the last ACK received from UA2 by SER was sent to FW IP address. Since
port 5060 is forwarded to SER on the FW, it caused a looping
situation.
The ser.cfg is listed at the end.
Thanks in advance.
Wei Wang
wwang(a)m1global.com
======== ser.cfg ============
debug=3 # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no # (cmd line: -E)
/* Uncomment these lines to enter debugging mode
debug=3
#debug=9
fork=no
log_stderror=yes
*/
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=192.168.4.217
#listen=66.134.1.36
port=5060
children=4
fifo="/tmp/ser_fifo"
fifo_db_url="mysql://ser:s3rv1c3@localhost/ser"
# ------------------ module loading ----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/permissions.so"
# Uncomment this if you want digest authentication
# mysql.so must be loaded !
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"
loadmodule "/usr/local/lib/ser/modules/uri.so"
loadmodule "/usr/local/lib/ser/modules/uri_db.so"
loadmodule "/usr/local/lib/ser/modules/domain.so"
loadmodule "/usr/local/lib/ser/modules/mediaproxy.so"
loadmodule "/usr/local/lib/ser/modules/nathelper.so"
loadmodule "/usr/local/lib/ser/modules/print.so"
loadmodule "/usr/local/lib/ser/modules/xlog.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
#modparam("usrloc", "db_mode", 0)
# Uncomment this if you want to use SQL database
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)
# -- auth params --
# Uncomment if you are using auth module
#
modparam("auth_db|permissions|uri_db|usrloc", "db_url",
"mysql://ser:s3rv1c3@localhost/ser")
modparam("auth_db", "calculate_ha1", 1)
#
# If you set "calculate_ha1" parameter to yes (which true in this
config),
# uncomment also the following parameter)
#
modparam("auth_db", "password_column", "password")
modparam("nathelper", "rtpproxy_disable", 1)
modparam("nathelper", "natping_interval", 0)
modparam("mediaproxy", "natping_interval", 30)
#modparam("mediaproxy", "mediaproxy_socket",
"/var/run/mediaproxy.sock")
modparam("mediaproxy", "mediaproxy_socket",
"/var/run/proxydispatcher.sock")
modparam("mediaproxy", "sip_asymmetrics",
"/usr/local/etc/ser/sip-clients")
modparam("mediaproxy", "rtp_asymmetrics",
"/usr/local/etc/ser/rtp-clients")
modparam("registrar", "nat_flag", 6)
# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)
modparam("permissions", "db_mode", 1)
modparam("permissions", "trusted_table", "trusted")
modparam("xlog", "buf_size", 8192)
# ------------------------- request routing logic -------------------
# main routing logic
route{
# xlog("L_INFO", "Main route
[From]%fu,[To]%tu,[Req-Method]%rm,[Req-RURI]%ru[IP-src]%is ...\n");
if(method != "SUBSCRIBE") {
xlog("L_INFO", "\r\n===========SIP
MSG==================\r\n%mb\r\n_____END SIP
MSG________________________\r\n");
};
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too Many Hops");
break;
};
if (msg:len >= 4086 ) {
sl_send_reply("513", "Message too big");
break;
};
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (method == "INVITE" && client_nat_test("3")) {
# xlog("L_INFO", "method==INVITE and nated: calling
record_route_preset\n");
# IP ADDRESS Here
record_route_preset("66.134.1.34:5060;nat=yes");
} else if (method!="REGISTER") {
record_route();
};
# -------------------------
# Call Tear Down Section
#-------------------------
if(method=="BYE" || method=="CANCEL") {
#xlog("L_INFO", "RECEIVED BYE or CANCEL...");
end_media_session();
};
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
xlog("L_INFO", "DEBUG: loose_route...");
if((method=="INVITE" || method == "REFER")
&&
!has_totag()) {
sl_send_reply("403", "Forbidden");
break;
};
if(method == "INVITE") {
if(!allow_trusted()) {
if(!proxy_authorize("",
"subscriber"))
{
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use
From=ID");
break;
};
consume_credentials();
}
if(client_nat_test("3")
|| search("^Route:.*;nat=yes")) {
setflag(6);
use_media_proxy();
};
};
# mark routing logic in request
#append_hf("P-hint: rr-enforced\r\n");
route(1);
break;
};
if (!uri==myself) {
route(4);
# mark routing logic in request
#append_hf("P-hint: outbound\r\n");
route(1);
break;
};
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if(method == "ACK") {
route(1);
break;
} else if(method=="CANCEL") {
route(1);
break;
} else if(method == "INVITE") {
route(3);
break;
} else if (method=="REGISTER") {
route(2);
break;
};
lookup("aliases");
if (!uri==myself) {
route(4);
#append_hf("P-hint: outbound alias\r\n");
route(1);
break;
};
# native SIP destinations are handled using our USRLOC DB
if (!lookup("location")) {
sl_send_reply("404", "Not Found");
break;
};
append_hf("P-hint: usrloc applied\r\n");
route(1);
}
route[1]
{
t_on_reply("1");
# send it out now; use stateful forwarding as it works
reliably
# even for UDP2TCP
if (!t_relay()) {
if(method=="INVITE" || method == "ACK") {
end_media_session();
};
sl_reply_error();
};
}
route[2]
{
############################
# REGISTER Message Handler
###########################
sl_send_reply("100", "Trying");
if(!search("^Contact:[ ]*\*") &&
client_nat_test("7")) {
setflag(6);
fix_nated_register();
force_rport();
};
if(!www_authorize("", "subscriber")) {
www_challenge("", "0");
break;
};
if(!check_to()) {
sl_send_reply("401", "Unauthorized");
break;
};
consume_credentials();
if(!save("location")) {
sl_reply_error();
};
}
route[3]
{
############################
# INVITE Message Handler
###########################
if(client_nat_test("3")) {
setflag(7);
force_rport();
fix_nated_contact();
};
if(!allow_trusted()) {
if(!proxy_authorize("", "subscriber")) {
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use From=ID");
break;
};
};
consume_credentials();
lookup("aliases");
if(uri != myself) {
route(4);
route(1);
break;
};
if(!lookup("location")) {
sl_send_reply("404", "User Not Found");
break;
};
route(4);
route(1);
}
route[4] {
#----------------------------
# NAT Traversal Section
#----------------------------
if(isflagset(6) || isflagset(7)) {
if(!isflagset(8)) {
setflag(8);
use_media_proxy();
};
};
}
onreply_route[1] {
if((isflagset(6) || isflagset(7))
&& (status =~ "(180)|183)|2[0-9][0-9]")) {
if(!search("^Content-Length:[ ]*0")) {
use_media_proxy();
};
};
if(client_nat_test("1")) {
fix_nated_contact();
};
}
=============== END ser.cfg ================
_______________________________________________
Serusers mailing list
Serusers(a)lists.iptel.org
http://lists.iptel.org/mailman/listinfo/serusers
10:11 p.m.
Thanks for your help. Adding alias directive solved the problem!
-Wei
-----Original Message-----
From: Greger Viken Teigre [mailto:greger@teigre.com]
Sent: Wednesday, May 16, 2007 2:33 PM
To: Wei Wang
Cc: serusers(a)iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
Are you sure the ACK still does not reach ua2? I cannot see anything
wrong, except that you record route ack, which normally does no harm,
but has no effect
either.
I may confuse ips here.. Btw, I would expect the ack to not have any
Route, but with contact of ua2 as the r-uri. Do any of the firewalls do
SIP ALG and add
their own route?
another worth trying, is to add alias=public-ip to your config. It may
be that ser does not recognize the route as it's own and thus relays it
according to the
route.
g-)
------- Original message -------
From: Wei Wang <wwang(a)m1global.com
Cc: serusers(a)iptel.org
Sent: 16.5.'07, 10:15
0f21e026e37da975d1a72b",uri="sip:1002@starpound.dnsalias.org",response="
68.158.174.169:30236;branch=z9hG4bK-d87543-a44efa3aad34e076-1--d87543-;r
> port=33415^M
> Max-Forwards: 16^M
> Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=9846c732>^M
> Contact: <sip:1001@68.158.174.169:33415>^M
> To: "1002"<sip:1002@starpound.dnsalias.org>;tag=8126ba56^M
> From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=9846c732^M
> Call-ID: ZTZiYWY0ZmI2ZWUyMWNmNGNkZjJlMjQzNmQ2NTBmMTk.^M
> CSeq: 2 ACK^M
> Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="464b100a413a877d15
0f21e026e37da975d1a72b",uri="sip:1002@starpound.dnsalias.org",response="
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
> port=33341^M
> Max-Forwards: 16^M
> Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
> Contact: <sip:1001@68.158.174.169:33341>^M
> To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
> From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
> Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
> CSeq: 2 ACK^M
> Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
> 4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
> User-Agent: X-Lite release 1009l stamp 38210^M
> Content-Length: 0^M
>
> 11:50:38.459602 IP 192.168.4.1.5060 > 192.168.4.217.5060: SIP, length:
> 862
> E..z..@.?..%.............f-.ACK
> sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
> Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
> Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
> port=33341^M
> Max-Forwards: 16^M
> Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
> Contact: <sip:1001@68.158.174.169:33341>^M
> To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
> From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
> Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
> CSeq: 2 ACK^M
> Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
> 4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
> User-Agent: X-Lite release 1009l stamp 38210^M
> Content-Length: 0^M
>
> 11:50:38.459885 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
> 982
> E.....@.@.-.....B.."......^M.ACK
> sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
> Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
> Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;received=192.168.4.1;branch=0^M
> Via: SIP/2.0/UDP
68.158.174.169:34634;branch=z9hG4bK-d87543-d50d836cf977ab39-1--d87543-;r
> port=33341^M
> Max-Forwards: 15^M
> Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=8c0a471f>^M
> Contact: <sip:1001@68.158.174.169:33341>^M
> To: "1002"<sip:1002@starpound.dnsalias.org>;tag=4a343c52^M
> From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=8c0a471f^M
> Call-ID: YmNkZDA2NGUzNWQ0MGRmZTBhMDc2OTdhYTFlZTFhMGE.^M
> CSeq: 2 ACK^M
> Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="4649d7f70f1fe18816
1fde13326cf91821414477",uri="sip:1002@starpound.dnsalias.org",response="
Changed the cfg file to do record_route_preset to
avoid private
address
being added to the Record-Route header. Now the
Record-Route header
contains public address. But the problem remains.
I am quite new to SIP. I don't understand why SER sent the last ACK
received from UA1 to the firewall public address instead of UA2's
public
IP. But INVITE went through fine.
Thanks,
Wei
============ tcpdump =================
10:02:09.277595 IP 68.158.174.169.33415 > 192.168.4.217.5060: SIP,
length: 757
E.......t.|AD..............cACK
sip:1002@63.111.4.162:17784;rinstance=59a418695e254c5a SIP/2.0^M
Via: SIP/2.0/UDP
68.158.174.169:30236;branch=z9hG4bK-d87543-a44efa3aad34e076-1--d87543-;r
port^M
Max-Forwards: 70^M
Route: <sip:1002@66.134.1.34:5060;lr;nat=yes;ftag=9846c732>^M
Contact: <sip:1001@68.158.174.169:33415>^M
To: "1002"<sip:1002@starpound.dnsalias.org>;tag=8126ba56^M
From: "UA1"<sip:1001@starpound.dnsalias.org>;tag=9846c732^M
Call-ID: ZTZiYWY0ZmI2ZWUyMWNmNGNkZjJlMjQzNmQ2NTBmMTk.^M
CSeq: 2 ACK^M
Proxy-Authorization: Digest
username="1001",realm="starpound.dnsalias.org",nonce="464b100a413a877d15
3fb4c3d90a7c848146d49188666e95f9",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
^M
10:02:09.277925 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
878
E.....@.@.-.....B..".....v..ACK
sip:1002@63.111.4.162:17784;rinstance=59a418695e254c5a SIP/2.0^M
Record-Route:
<sip:1002@66.134.1.34:5060;nat=yes;ftag=9846c732;lr=on>^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
> Via: SIP/2.0/UDP
3fb4c3d90a7c848146d49188666e95f9",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
=========== end tcpdump ==================
________________________________________
From: Greger V. Teigre [mailto:greger@teigre.com]
Sent: Wednesday, May 16, 2007 3:58 AM
To: Wei Wang
Cc: serusers(a)iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
You have to use your public ip by using record_route_preset also for
non-NATed.
As you can see, the Record-Route header contains your private address.
g-)
Wei Wang wrote:
Greger,
Thanks for the help. I've added advertised_address to the ser.cfg
file.
>
> ...
> listen=192.168.4.217
> port=5060
> advertised_address=66.134.1.34
> advertised_port=5060
> ....
>
> But it did not seem to help.
>
> Here is the TCP traffic:
>
> ================= START TCPDUMP =================
> 11:50:38.459320 IP 192.168.4.217.5060 > 66.134.1.34.5060: SIP, length:
> 862
> E..z..@.@..'....B..".....f..ACK
> sip:1002@63.111.4.162:12829;rinstance=1b31f557c9fca8dd SIP/2.0^M
> Record-Route: <sip:192.168.4.217;ftag=8c0a471f;lr=on>^M
> Via: SIP/2.0/UDP 66.134.1.34:5060;branch=0^M
> Via: SIP/2.0/UDP
4e0599dd16884d25bd61cc753ca24a6b",algorithm=MD5^M
User-Agent: X-Lite release 1009l stamp 38210^M
Content-Length: 0^M
================= END TCPDUMP =================
Again, the last ACT was sent to the firewall's external IP
address(66.134.1.34).
-----Original Message-----
From: Greger V. Teigre [mailto:greger@teigre.com]
Sent: Tuesday, May 15, 2007 10:53 AM
To: Wei Wang
Cc: serusers(a)iptel.org
Subject: Re: [Serusers] Problem running SER behind firewall
You need to use advertised_address and advertised_port just below
listen
directive.
g-)
Wei Wang wrote:
I have a problem running SER behind firewall.
Here is the network diagram:
|UA1|--|FW1| +--|FW|--|SER|
\ /
+--+
/ \
|UA2|--|FW2| +--|MediaProxy|
Where, UA1 and UA2 are Xlite soft-phones behind their own firewalls.
SER
is listening on private IP address 192.168.4.217. FW has public IP
address 66.134.1.34 and forwards port 5060 to SER.
The ser.cfg file is pretty much copied from SER getting start guide.
When UA1 calling UA2, the call established fine but UA1 will hang up
by
itself after ~30 seconds. The captured IP packages on SER revealed
that
the last ACK received from UA2 by SER was sent to FW IP address. Since
port 5060 is forwarded to SER on the FW, it caused a looping
situation.
The ser.cfg is listed at the end.
Thanks in advance.
Wei Wang
wwang(a)m1global.com
======== ser.cfg ============
debug=3 # debug level (cmd line: -dddddddddd)
fork=yes
log_stderror=no # (cmd line: -E)
/* Uncomment these lines to enter debugging mode
debug=3
#debug=9
fork=no
log_stderror=yes
*/
check_via=no # (cmd. line: -v)
dns=no # (cmd. line: -r)
rev_dns=no # (cmd. line: -R)
listen=192.168.4.217
#listen=66.134.1.36
port=5060
children=4
fifo="/tmp/ser_fifo"
fifo_db_url="mysql://ser:s3rv1c3@localhost/ser"
# ------------------ module loading ----------------------------------
# Uncomment this if you want to use SQL database
loadmodule "/usr/local/lib/ser/modules/mysql.so"
loadmodule "/usr/local/lib/ser/modules/sl.so"
loadmodule "/usr/local/lib/ser/modules/tm.so"
loadmodule "/usr/local/lib/ser/modules/rr.so"
loadmodule "/usr/local/lib/ser/modules/maxfwd.so"
loadmodule "/usr/local/lib/ser/modules/usrloc.so"
loadmodule "/usr/local/lib/ser/modules/registrar.so"
loadmodule "/usr/local/lib/ser/modules/textops.so"
loadmodule "/usr/local/lib/ser/modules/permissions.so"
# Uncomment this if you want digest authentication
# mysql.so must be loaded !
loadmodule "/usr/local/lib/ser/modules/auth.so"
loadmodule "/usr/local/lib/ser/modules/auth_db.so"
loadmodule "/usr/local/lib/ser/modules/uri.so"
loadmodule "/usr/local/lib/ser/modules/uri_db.so"
loadmodule "/usr/local/lib/ser/modules/domain.so"
loadmodule "/usr/local/lib/ser/modules/mediaproxy.so"
loadmodule "/usr/local/lib/ser/modules/nathelper.so"
loadmodule "/usr/local/lib/ser/modules/print.so"
loadmodule "/usr/local/lib/ser/modules/xlog.so"
# ----------------- setting module-specific parameters ---------------
# -- usrloc params --
#modparam("usrloc", "db_mode", 0)
# Uncomment this if you want to use SQL database
# for persistent storage and comment the previous line
modparam("usrloc", "db_mode", 2)
# -- auth params --
# Uncomment if you are using auth module
#
modparam("auth_db|permissions|uri_db|usrloc", "db_url",
"mysql://ser:s3rv1c3@localhost/ser")
modparam("auth_db", "calculate_ha1", 1)
#
# If you set "calculate_ha1" parameter to yes (which true in this
config),
# uncomment also the following parameter)
#
modparam("auth_db", "password_column", "password")
modparam("nathelper", "rtpproxy_disable", 1)
modparam("nathelper", "natping_interval", 0)
modparam("mediaproxy", "natping_interval", 30)
#modparam("mediaproxy", "mediaproxy_socket",
"/var/run/mediaproxy.sock")
modparam("mediaproxy", "mediaproxy_socket",
"/var/run/proxydispatcher.sock")
modparam("mediaproxy", "sip_asymmetrics",
"/usr/local/etc/ser/sip-clients")
modparam("mediaproxy", "rtp_asymmetrics",
"/usr/local/etc/ser/rtp-clients")
modparam("registrar", "nat_flag", 6)
# -- rr params --
# add value to ;lr param to make some broken UAs happy
modparam("rr", "enable_full_lr", 1)
modparam("permissions", "db_mode", 1)
modparam("permissions", "trusted_table", "trusted")
modparam("xlog", "buf_size", 8192)
# ------------------------- request routing logic -------------------
# main routing logic
route{
# xlog("L_INFO", "Main route
[From]%fu,[To]%tu,[Req-Method]%rm,[Req-RURI]%ru[IP-src]%is ...\n");
if(method != "SUBSCRIBE") {
xlog("L_INFO", "\r\n===========SIP
MSG==================\r\n%mb\r\n_____END SIP
MSG________________________\r\n");
};
# initial sanity checks -- messages with
# max_forwards==0, or excessively long requests
if (!mf_process_maxfwd_header("10")) {
sl_send_reply("483","Too Many Hops");
break;
};
if (msg:len >= 4086 ) {
sl_send_reply("513", "Message too big");
break;
};
# we record-route all messages -- to make sure that
# subsequent messages will go through our proxy; that's
# particularly good if upstream and downstream entities
# use different transport protocol
if (method == "INVITE" && client_nat_test("3")) {
# xlog("L_INFO", "method==INVITE and nated: calling
record_route_preset\n");
# IP ADDRESS Here
record_route_preset("66.134.1.34:5060;nat=yes");
} else if (method!="REGISTER") {
record_route();
};
# -------------------------
# Call Tear Down Section
#-------------------------
if(method=="BYE" || method=="CANCEL") {
#xlog("L_INFO", "RECEIVED BYE or CANCEL...");
end_media_session();
};
# subsequent messages withing a dialog should take the
# path determined by record-routing
if (loose_route()) {
xlog("L_INFO", "DEBUG: loose_route...");
if((method=="INVITE" || method == "REFER")
&&
!has_totag()) {
sl_send_reply("403", "Forbidden");
break;
};
if(method == "INVITE") {
if(!allow_trusted()) {
if(!proxy_authorize("",
"subscriber"))
{
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use
From=ID");
break;
};
consume_credentials();
}
if(client_nat_test("3")
|| search("^Route:.*;nat=yes")) {
setflag(6);
use_media_proxy();
};
};
# mark routing logic in request
#append_hf("P-hint: rr-enforced\r\n");
route(1);
break;
};
if (!uri==myself) {
route(4);
# mark routing logic in request
#append_hf("P-hint: outbound\r\n");
route(1);
break;
};
# if the request is for other domain use UsrLoc
# (in case, it does not work, use the following command
# with proper names and addresses in it)
if(method == "ACK") {
route(1);
break;
} else if(method=="CANCEL") {
route(1);
break;
} else if(method == "INVITE") {
route(3);
break;
} else if (method=="REGISTER") {
route(2);
break;
};
lookup("aliases");
if (!uri==myself) {
route(4);
#append_hf("P-hint: outbound alias\r\n");
route(1);
break;
};
# native SIP destinations are handled using our USRLOC DB
if (!lookup("location")) {
sl_send_reply("404", "Not Found");
break;
};
append_hf("P-hint: usrloc applied\r\n");
route(1);
}
route[1]
{
t_on_reply("1");
# send it out now; use stateful forwarding as it works
reliably
# even for UDP2TCP
if (!t_relay()) {
if(method=="INVITE" || method == "ACK") {
end_media_session();
};
sl_reply_error();
};
}
route[2]
{
############################
# REGISTER Message Handler
###########################
sl_send_reply("100", "Trying");
if(!search("^Contact:[ ]*\*") &&
client_nat_test("7")) {
setflag(6);
fix_nated_register();
force_rport();
};
if(!www_authorize("", "subscriber")) {
www_challenge("", "0");
break;
};
if(!check_to()) {
sl_send_reply("401", "Unauthorized");
break;
};
consume_credentials();
if(!save("location")) {
sl_reply_error();
};
}
route[3]
{
############################
# INVITE Message Handler
###########################
if(client_nat_test("3")) {
setflag(7);
force_rport();
fix_nated_contact();
};
if(!allow_trusted()) {
if(!proxy_authorize("", "subscriber")) {
proxy_challenge("", "0");
break;
} else if(!check_from()) {
sl_send_reply("403", "Use From=ID");
break;
};
};
consume_credentials();
lookup("aliases");
if(uri != myself) {
route(4);
route(1);
break;
};
if(!lookup("location")) {
sl_send_reply("404", "User Not Found");
break;
};
route(4);
route(1);
}
route[4] {
#----------------------------
# NAT Traversal Section
#----------------------------
if(isflagset(6) || isflagset(7)) {
if(!isflagset(8)) {
setflag(8);
use_media_proxy();
};
};
}
onreply_route[1] {
if((isflagset(6) || isflagset(7))
&& (status =~ "(180)|183)|2[0-9][0-9]")) {
if(!search("^Content-Length:[ ]*0")) {
use_media_proxy();
};
};
if(client_nat_test("1")) {
fix_nated_contact();
};
}
=============== END ser.cfg ================
_______________________________________________
Serusers mailing list
Serusers(a)lists.iptel.org
http://lists.iptel.org/mailman/listinfo/serusers
6401
days inactive
6403
days old
6 comments
3 participants
participants (3)
-
Greger V. Teigre -
Greger Viken Teigre
-
Wei Wang