Hello,

while debugging a problem today I encountered a rather strange issue. The client's UA/router was messing up the Via header, with as result that all the IP's in the Via's were replaced by the public IP of the DSL modem.

Now the weird part: because of the mangled Via's, the expected result is that the reply would be routed back to the IP of the client. Instead, the replies were still following the "correct" return path through a series of OpenSER/Kamailio proxies. How is this possible?

According to rfc3261, a proxy must forward the reply to the next Via in the received _response_. It seems Kamailio is incorrectly keeping the Via from the request and sends the reply to the stored address of the Via from the _request_. Btw, no 'received' parameter is involved.

Can anyone with inside knowledge of Kamailio share his/her view on this issue? And possibly, how to fix it.

I suspect I can use check_via=1 to drop incoming replies with incorrect via, although the behaviour of check_via is undocumented (what does it do when check fails?). And why is the default value 0 (as has every example config on the web)?

There's also reply_to_via, but according to docs that's only for locally generated replies. Also, its use is beyond me, as the correct value is dependent on the src_ip of the request and thus can't possibly be a global option.

Alex.