Hi List
CPE behind Firewall, registering to Kamailio via TCP (or TLS).
When a call is sent to the CPE, kamailio attemts to open a new TCP connection and is blocked by Firewall.
Is there an option to tell kamailio to use the existing registered TCP connection?
Mit freundlichen Grüssen
-Benoît Panizzon-
It should automatically re-use an existing TCP connection. Can you give an example?
What I usually see is that the CPE has REGISTERed over TCP from an ephemeral TCP port, has given a Contact with a public port (5060, usually), and that the INVITE has a RURI with (implicit or explicit) port 5060 in it, which means that kamailio must attempt a new connection (because it doesn't have an existing TCP connection to the customer-side port 5060). Is this what's happening for you?
Perhaps you can look at the nathelper module for use of the add_contact_alias() function. Even if this is not related to REGISTER requests, it still might work for you.
James
On Mon, 6 Mar 2023 at 09:55, Benoit Panizzon benoit.panizzon@imp.ch wrote:
Hi List
CPE behind Firewall, registering to Kamailio via TCP (or TLS).
When a call is sent to the CPE, kamailio attemts to open a new TCP connection and is blocked by Firewall.
Is there an option to tell kamailio to use the existing registered TCP connection?
Mit freundlichen Grüssen
-Benoît Panizzon-
I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________
Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________ __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions To unsubscribe send an email to sr-users-leave@lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe:
Hi James
It should automatically re-use an existing TCP connection. Can you give an example?
After digging more in this issue, it looks like I found the solution:
Upon successful REGISTER authentication I do:
if ($proto != 'udp') { tcp_keepalive_enable("60", "5", "5"); # TCP KA once per minute tcp_set_connection_lifetime("3605"); # Live for one hour force_tcp_alias(); # Force traffic back on existing session if ($avp(debug) > 0) { xlog("L_INFO", "$cfg(route): KEEP ALIVE engaged on $proto => ConID: $conid\n"); } }
Especially force_tcp_alias() seems to make sure, communication TO the CPE takes the existing TCP or TLS session towards the CPE and does not create a new session.
Mit freundlichen Grüssen
-Benoît Panizzon-