<div dir="ltr"><div>hi guys,</div><div><br></div><div>both TLS and NAT are working fine with my FS system, but put them together raises problem, e.g. i can have encrypted voice calls(TLS+SRTP) within the same LAN, and uncrypted voice calls over different LANs, but when trying TLS+SRTP over different LANs, i cannot get my softphone(here im using Linphone) register to FS, it reports timeout.</div>
<div><br></div><div>i have a dedicated profile for NAT as below, could anyone figure out what the problem is?</div><div><br></div><div><profile name="tnat"></div><div> <settings></div><div> <param name="debug" value="0" /></div>
<div> <param name="sip-trace" value="no" /></div><div> <param name="rfc2833-pt" value="101" /></div><div> <param name="sip-port" value="5063" /></div>
<div> <param name="dialplan" value="XML" /></div><div> <param name="context" value="public" /></div><div> <param name="dtmf-duration" value="100" /></div>
<div> <param name="codec-prefs" value="$${outbound_codec_prefs}" /></div><div> <param name="use-rtp-timer" value="true" /></div><div> <param name="hold-music" value="$${hold_music}" /></div>
<div> <param name="rtp-timer-name" value="soft" /></div><div> <param name="manage-presence" value="false" /></div><div> <param name="aggressive-nat-detection" value="true" /></div>
<div> <param name="apply-nat-acl" value="rfc1918" /></div><div> <param name="inbound-codec-negotiation" value="generous" /></div><div> <param name="nonce-ttl" value="60" /></div>
<div> <param name="auth-calls" value="true" /></div><div> <param name="rtp-timeout-sec" value="1800" /></div><div> <param name="rtp-ip" value="$${local_ip_v4}" /></div>
<div> <param name="sip-ip" value="$${local_ip_v4}" /></div><div> <param name="ext-rtp-ip" value="111.111.111.111" /></div><div> <param name="ext-sip-ip" value="111.111.111.111" /></div>
<div> <param name="force-register-domain" value="111.111.111.111" /></div><div> <param name="stun-enabled" value="false" /></div><div> <param name="rtp-timeout-sec" value="300" /></div>
<div> <param name="rtp-hold-timeout-sec" value="1800" /></div><div> </div><div> <!-- TLS: disabled by default, set to "true" to enable --></div><div> <param name="tls" value="true"/></div>
<div> <!-- Set to true to not bind on the normal sip-port but only on the TLS port --></div><div> <param name="tls-only" value="false"/></div><div> <!-- additional bind parameters for TLS --></div>
<div> <param name="tls-bind-params" value="transport=tls"/></div><div> <!-- Port to listen on for TLS requests. I've specified to use this port --></div><div> <param name="tls-sip-port" value="5064"/></div>
<div> <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) --></div><div> <!--<param name="tls-cert-dir" value=""/>--></div><div> <!-- Optionally set the passphrase password used by openSSL to encrypt/decrypt TLS private key files --></div>
<div> <param name="tls-passphrase" value=""/></div><div> <!-- Verify the date on TLS certificates --></div><div> <param name="tls-verify-date" value="true"/></div>
<div> <!-- TLS verify policy, when registering/inviting gateways with other servers (outbound) or handling inbound registration/invite requests how should we verify their certificate --></div><div> <!-- set to 'in' to only verify incoming connections, 'out' to only verify outgoing connections, 'all' to verify all connections, also 'in_subjects', 'out_subjects' and 'all_subjects' for subject validation. Multiple policies can be split with a '|' pipe --></div>
<div> <param name="tls-verify-policy" value="none"/></div><div> <!-- Certificate max verify depth to use for validating peer TLS certificates when the verify policy is not none --></div>
<div> <param name="tls-verify-depth" value="2"/></div><div> <!-- If the tls-verify-policy is set to subjects_all or subjects_in this sets which subjects are allowed, multiple subjects can be split with a '|' pipe --></div>
<div> <param name="tls-verify-in-subjects" value=""/></div><div> <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 --></div><div>
<param name="tls-version" value="$${sip_tls_version}"/></div><div><br></div><div> <!-- Let calls hit the dialplan before selecting codec for the a-leg --></div><div> <param name="inbound-late-negotiation" value="true"/></div>
<div><br></div><div> <!-- Allow ZRTP clients to negotiate end-to-end security associations (also enables late negotiation) --></div><div> <param name="inbound-zrtp-passthru" value="true"/></div>
<div> </settings></div><div></profile></div><div><br></div></div>