Looking for Documentation/Guidance to Setup Kamailio and RTPProxy to Terminate Encryption for Asterisk
Hello, I am fairly new to SIP and just recently setup Asterisk for a few purposes. 1) To have my Hikvision doorbell videocall my phone when someone presses it 2) Videocalling between me and my families' phones/tablets 3) Eventually have a home phone setup for POTS calling. I currently have an ObiHai202 that is still working with GoogleVoice, so this not a priority at the moment.
I wanted to have encryption for SIP and RTP outside of my network, but wanted this to all be terminated on my OPNsense router. I can install Kamailio and RTPProxy on OPNsense since they are available for FreeBSD, but it looks like Rtpengine is currently not ported. Ideally I wanted most logic to be handled on my Asterisk server, and have Kamailio/RTPProxy do the bare minimum of encrypting/decryption and rewriting headers as needed.
## Diagram of my Targeted Setup ##
* Android Phones / Tablets running Linphone || SIPS(TLS) / SRTP || * OPNsense Router ~ WAN_IP(dynamic)=DOMAIN.com / LAN_IP=10.0.1.1 - Kamailio / RTPProxy || SIP(UDP) / RTP || * FreeBSD Application Server ~ LAN_IP=10.0.1.17 / Internal_IP=192.168.10.17 - Asterisk || SIP(UDP) / RTP || * Hikvision Doorbell ~ Internal_IP=192.168.10.100
####
From my reading so far I have a few questions... * To setup Kamailio > Asterisk it looks like I need to setup the dispatcher module; I also I may need to write some routing code. Am I correct, that I will need to use the dispatcher module? Will I need to modify the routing code/logic or is the default usually sufficient?
* I read RTPProxy does support SRTP, but I don't see any configuration options related to encryption. I assume this is just enabled in Asterisk/Kamailio?
* For Asterisk configuration I believe I just need to define the outbound_proxy. But now I am not sure how I can require SRTP between my Linphone clients and RTPProxy, while the leg between RTPProxy and Asterisk is unencrypted RTP?
Thanks for any help that is provided!
Also, I forgot to ask...
* I assume I need to run RTPProxy in bridging mode. Bind to WAN_IP for SRTP with Linphone clients, and LAN_IP for RTP with Asterisk. This is further complicated because my Router has a dynamic WAN_IP which could (but rarely does) change. Would the following parameters be correct for the rtpproxy daemon? -l 10.0.1.1/0.0.0.0 -A 10.0.1.1/DOMAIN.com
Thanks!
I think I have answered some of my questions.
1) Still wrapping my head around Kamailio <> Asterisk. I would appreciate any pointers what are the minimum settings needed to have Kamailio forward user registrations to Asterisk.
2) RTPProxy version 3+ supports SRTP and video. The FreeBSD is currently outdated but we are working on it.
3) I'm still not sure if I define a user's encryption=sdes on Asterisk if that will allow connection between RTPProxy and Asterisk to be unencrypted RTP?
4) I think I was thinking about this wrong, these sockets don't always exists and it doesn't really matter if they overlap. RTPProxy creates these listening sockets on the fly, so creating one for 0.0.0.0 should work to listen on WAN.
-
Joshua Ruehlig