- FreeSWITCH-users - FreeSWITCH Mailing Lists

[contrib] a new java ESL inbound/outbound client
by david varnes 30 Aug '10

30 Aug '10

Hi all, I had a basic java inbound ESL client kicking around that I have used in a couple of small projects over the last year. I needed something a little more complete for a new project so I dusted it off and made it less incomplete. It still needs more work and testing, but it certainly is usable right now. I have tested it against FS 1.0.4 and latest trunk. I have put it in my contrib area in svn in hopes that some may find it useful: http://svn.freeswitch.org/svn/freeswitch/trunk/contrib/dvarnes/java/esl-cli… I would be interested in any feedback ... Features * Apache License (ASL) version 2 * Standalone Inbound client * Framework classes to easily create an Outbound socket client * based on Netty [1] nio library version 3.1.5.GA (previously was using Apache MINA, but this is easier) * logging via slf4j * only dependencies are slf4j-api and netty (both Apache licensed) * single jar which is a valid OSGi bundle * built using maven * eclipse projects * reasonable level of java docs Still todo * Docs * Simple example apps * .. more in TODO.txt in project root. There is no binary jar available right now since I don't know how/if I can put files up to file.freeswitch.org. In the meantime to build you need maven [2] installed. If you are unfamiliar with maven usage, I can post a simple howto. davidv [1] http://www.jboss.org/netty/downloads.html [2] http://maven.apache.org

3 4

[announce] First release of Java ESL Client library
by david varnes 30 Aug '10

30 Aug '10

Hi FreeSWITCHERs, I have finally got around to lining up all the bits I wanted in order to do a first release (version 0.9.2) of the Java ESL Client that has been in the freeswitch-contrib git repository for some time now. First thanks to the people who checked it out, compiled it and reported some bugs. (I believe I have fixed them all :-) I have created a couple of new wiki pages for the Java and ESL topics: [1] to cover the various options that I know about to use Java for connecting to the very useful and versatile Event Socket. If there are other options or info, you know what to do, it is a wiki. [2] to describe my contributed Java ESL Client, with download, compile, and basic usage documented. The details are there, a quick summary of this client library features: * Apache License (ASL) version 2 * Standalone ready to use Inbound client * Framework classes to very easily create an Outbound socket client * based on the excellent Netty [3] nio library * logging via slf4j * only runtime dependencies are slf4j-api and netty (MIT and Apache licensed) * single jar which is a valid OSGi bundle * built using maven, * jar, source and javadocs available from maven central (GPG signed) * source is committed as an eclipse project * good coverage of java docs Now it is available as released binary jars it is easier to experiment with. Roadmap: Tentative next steps are outlined in [2] and a TODO file in git. After wider usage and feedback on the API design I would aim to release a version 1.0 and then simply track any ongoing changes in the core FreeSWITCH ESL. I enjoy getting feedback if you find it useful or have issues, patches or enhancement ideas. I know a few projects around the place have been using it even in un-released state :-) Hope it finds use out there ... davidv [1] http://wiki.freeswitch.org/wiki/Java_ESL [2] http://wiki.freeswitch.org/wiki/Java_ESL_Client [3] http://www.jboss.org/netty -- david varnes e: david.varnes(a)gmail.com p: +61 404 925 633

1 0

hello every one
by Sameer Khan 30 Aug '10

30 Aug '10

Please, I'm looking for skype static build 2.0.72. Would you guys contact me off list?

2 1

Esl rubymod get variable
by Nigel Kent 30 Aug '10

30 Aug '10

How can the value of a variable be retrieved in esl ruby

3 8

Selecting codec by sample rate
by Kristian Kielhofner 30 Aug '10

30 Aug '10

Hello everyone, Does FreeSWITCH support the ability to accept/reject/filter/modify codec by sample rate? I've defined SILK@8000h as the only supported codec in my profile yet clients calling in that prefer SILK@12000h over SILK@8000h are allowed to bring up the call at SILK@12000h. It seems that SILK at any sample rate is allowed as long as SILK at any sample rate is defined in the profile. My profile is set to scrooge and I've tried various combinations of late-negotiation, absolute_codec_string, etc to no avail. Should I be able to accept/reject specific sample rates? If not I'm willing to create a bounty for it... Thanks! -- Kristian Kielhofner http://www.astlinux.org http://blog.krisk.org http://www.star2star.com http://www.submityoursip.com http://www.voalte.com

4 6

NAT traversal questions - (long)...
by Dave Redmore 29 Aug '10

29 Aug '10

Hello All, I ran into an issue today that has burned up most of my day troubleshooting. I have resolved the problem, but would really like to understand what caused it, or some of the internal Freeswitch plumbing that is at play so that I can learn something from all of this time I have invested. I have a Freeswitch server running that acts as a proxy to an account with an ITSP for doing T38 faxing. The Freeswitch server has a public IP address - there are four "users" who register simple FXS ATAs to my server and it then proxies to the ITSP using the "proxy_media" functionality. It has been working very well for the last 6 months or so. I have never had to deal with any NAT traversal issues - I just point the ATA to the IP to register and everything is great. Here is what the four users "looked" like - User1 : Grandstream HT-287 -> DD-WRT Router (NAT) -> Internet -> Freeswitch Proxy User2 : Grandstream HT-503 -> DD-WRT Router (NAT) -> Internet -> Freeswitch Proxy User3 : Grandstream HT-502 -> Comcast/SMC Router (NAT) -> Internet -> Freeswitch Proxy User4 : Grandstream HT-287 -> IPCOP 1.4.11 (NAT) -> Comcast Gateway -> Freeswitch Proxy (User4 is my office, so the IPCOP firewall and the Freeswitch Proxy sit on the same Comcast Gateway) As I said, this all worked perfectly without any need to "fiddle" with anything on any firewalls - worked right out of the box. So, today I changed out my IPCOP firewall for a pfsense firewall - and my HT-287 would no longer register. After much head-scratching, packet captures, etc. I found that I needed to set up a Static Port NAT for the port the HT-287 was using (5062) in order to get this to work. So, I see WHAT is happening, but I really want to know WHY it is happening. Here are the gory details: The sofia status of the profile looks like this - when the I have the Static Port NAT in place (details changed for security): _______________________________________________________________ Call-ID: 0e551b3c694a793c(a)192.168.1.137 User: 8885554525(a)173.11.22.111 Contact: "user" <sip:8885554525@192.168.1.137;fs_nat=yes;fs_path=sip%3A8885554525%40173.22.22.55%3A5060> Agent: Grandstream HT287 1.1.0.45 DevId 000b821203c5 Status: Registered(UDP-NAT)(unknown) EXP(2010-08-29 01:17:03) Host: 173-11-22-111-illinois.hfc.comcastbusiness.net IP: 173.22.22.55 Port: 5060 Auth-User: 8885554525 Auth-Realm: 173.11.22.111 MWI-Account: 8885554525(a)173.11.22.111 Call-ID: 1716488819-5062-1(a)192.168.7.150 User: 8885554544(a)173.11.22.111 Contact: "user" <sip:8885554544@192.168.7.150:5062;user=phone;fs_nat=yes; fs_path=sip%3A8885554544%4098.255.0.11%3A5062%3Buser%3Dphone> Agent: Grandstream HT-502 V1.1B 1.0.1.63 Status: Registered(UDP-NAT)(unknown) EXP(2010-08-29 01:48:35) Host: 173-11-22-111-illinois.hfc.comcastbusiness.net IP: 98.255.0.11 Port: 5062 Auth-User: 8885554544 Auth-Realm: 173.11.22.111 MWI-Account: 8885554544(a)173.11.22.111 Call-ID: 090ee80e1a0ec9ed(a)10.8.11.149 User: 8885554549(a)173.11.22.111 Contact: "user" <sip:8885554549@10.8.11.149:5062> Agent: Grandstream HT287 1.1.0.45 DevId 000b82127390 Status: Registered(UDP)(unknown) EXP(2010-08-29 02:00:42) Host: 173-11-22-111-illinois.hfc.comcastbusiness.net IP: 173.11.22.99 Port: 5062 Auth-User: 8885554549 Auth-Realm: 173.11.22.111 MWI-Account: 8885554549(a)173.11.22.111 Call-ID: 1035241259-5060-1(a)10.1.10.150 User: 8885554547(a)173.11.22.111 Contact: "user" <sip:8885554547@10.1.10.150:5060;user=phone;fs_nat=yes;fs _path=sip%3A8885554547%4098.222.55.100%3A5060%3Buser%3Dphone> Agent: Grandstream HT-503 V1.1B 1.0.1.63 Status: Registered(UDP-NAT)(unknown) EXP(2010-08-29 00:15:09) Host: 173-11-22-111-illinois.hfc.comcastbusiness.net IP: 98.222.55.100 Port: 5060 Auth-User: 8885554547 Auth-Realm: 173.11.22.111 MWI-Account: 8885554547(a)173.11.22.111 ___________________________________________________________ The "User4" account is in red. The "Contact" field is substantially different and the "Status" indicates "Registered (UDP)", rather than "Registered (UDP-NAT)" as the others. When I do a packet capture on the external NIC interface (eth0) - I see the following when the HT-287 tries to register and the Static Port NAT is NOT in place: ___________________________________________________________________ Internet Protocol, Src: 173.11.22.99 (173.11.22.99), Dst: 173.11.22.111 (173.11.22.111) User Datagram Protocol, Src Port: 11521 (11521), Dst Port: 5090 (5090) Session Initiation Protocol Request-Line: REGISTER sip:173.11.22.111:5090 SIP/2.0 Method: REGISTER Request-URI: sip:173.11.22.111:5090 Request-URI Host Part: 173.11.22.111 Request-URI Host Port: 5090 Message Header Via: SIP/2.0/UDP 10.8.11.149:5062;branch=z9hG4bKda48f838c8689e41 Transport: UDP Sent-by Address: 10.8.11.149 Sent-by port: 5062 Branch: z9hG4bKda48f838c8689e41 From: <sip:8885554549@173.11.22.111:5090>;tag=c8a0d452edc5ac4b SIP from address: sip:8885554549@173.11.22.111:5090 SIP tag: c8a0d452edc5ac4b To: <sip:8885554549@173.11.22.111:5090> Contact: <sip:88855564549@10.8.11.149:5062> Contact Binding: <sip:8885554549@10.8.11.149:5062> Supported: replaces, timer Call-ID: aa77d777bae71be6(a)10.8.11.149 CSeq: 100 REGISTER Sequence Number: 100 Method: REGISTER Expires: 3600 User-Agent: Grandstream HT287 1.1.0.45 DevId 000b82127390 Max-Forwards: 70 Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE,UPDATE Content-Length: 0 _______________________________________________________________ When Freeswitch replies back with a "401 Unauthorized" - asking for further Auth - it replies back to port 5062 - so the packet never comes back (pfsense is looking for a packet back on port 11521 in this case). If I put the Static Port NAT in place - all is well, because the "Source" port shows as "5062" - the rest of the packet looks pretty much the same. Now, here is a packet coming from one of the other Users - this one comes through a DD-WRT router - here we see that the Source Port is 5060 : _________________________________________________________________ Internet Protocol, Src: 173.22.22.55 (173.22.22.55), Dst: 173.11.22.111 (173.11.22.111) User Datagram Protocol, Src Port: sip (5060), Dst Port: 5090 (5090) Session Initiation Protocol Request-Line: REGISTER sip:173.11.22.111:5090 SIP/2.0 Method: REGISTER Request-URI: sip:173.11.22.111:5090 [Resent Packet: False] Message Header Via: SIP/2.0/UDP 192.168.1.137;branch=z9hG4bK665bc67a1c64292b Transport: UDP Sent-by Address: 192.168.1.137 Branch: z9hG4bK665bc67a1c64292b From: "fax" <sip:8885554525@173.11.22.111:5090>;tag=8dc68b35111c4261 To: <sip:8156564525@173.15.28.101:5090> Contact: <sip:8885554525@192.168.1.137> Contact Binding: <sip:8885554525@192.168.1.137> Call-ID: 0e551b3c694a793c(a)192.168.1.137 CSeq: 503 REGISTER Sequence Number: 503 Method: REGISTER Expires: 3600 User-Agent: Grandstream HT287 1.1.0.45 DevId 000b821203c5 Max-Forwards: 70 Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE,UPDATE Content-Length: 0 ______________________________________________________________________ Here is one more packet coming from a Comcast/SMC Router - again, the source port is correct: ______________________________________________________________________ Internet Protocol, Src: 98.244.55.100 (98.244.55.100), Dst: 173.11.22.111 (173.11.22.111) User Datagram Protocol, Src Port: sip (5060), Dst Port: 5090 (5090) Session Initiation Protocol Request-Line: REGISTER sip:173.11.22.111:5090 SIP/2.0 Message Header Via: SIP/2.0/UDP 10.1.10.150:5060;branch=z9hG4bK58981045;rport Transport: UDP Sent-by Address: 10.1.10.150 Sent-by port: 5060 Branch: z9hG4bK58981045 RPort: rport From: <sip:8885554547@173.11.22.111:5090;user=phone>;tag=138706651 To: <sip:8885554547@173.11.22.111:5090;user=phone> Call-ID: 1035241259-5060-1(a)10.1.10.150 CSeq: 79875 REGISTER Sequence Number: 79875 Method: REGISTER Contact: <sip:8885554547@10.1.10.150:5060;user=phone>;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B821F9A84>" Contact Binding: <sip:8885554547@10.1.10.150:5060;user=phone>;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B821F9A84>" Max-Forwards: 70 User-Agent: Grandstream HT-503 V1.1B 1.0.1.63 Supported: path Expires: 300 Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, UPDATE Content-Length: 0 ___________________________________________________________ So, here are my questions: - Why is the Sofia Status so much different for the registration coming through the pfSense firewall. It looks like it doesn't get tagged as being NAT'd and the "Contact" info is much less. - Do most modern routers automatically Static Port NAT any SIP traffic? Both DD-WRT and SMC routers appear to be doing this - and not just on a simple Port bases (UDP 5060 only), because one of these examples is on 5062. Are these "SIP aware" firewalls that are doing this automatically, as the IPCOP did before? - Is the extra "Contact" data in the last packet example different because it is a different UA (HT-503 rather than an HT-287) - Is Freeswitch not flagging the registration from my office (User4) as being NAT'd because it is coming in on the same subnet as the interface Freeswitch received the packet on (Freeswitch is at 173.11.22.111 and pfsense is at 173.11.22.99)? Sorry for this terribly long posting - I'm just very curious to understand what is going on here, now that I have collected all this information. Thanks, Dave

4 6

Re: [Freeswitch-users] NAT traversal questions - (long)...
by Dave Redmore 29 Aug '10

29 Aug '10

Thanks for your help/thoughts Tony. I just confirmed that siproxd is not installed - SSH'd in and checked running processes to be sure. Like I said earlier - I can make it work - I have disabled the automatic outbound NAT and set up AON (Advanced Outbound Nat). It is just that I want to understand what I am seeing so that I can learn from all this. Here is one thing - If Freeswitch flagged my pfsense connection as being behind NAT - would it then compensate for the Source port being 11521 (per the packet capture in the original email)? Am I totally wrong in thinking that it would be "normal" to see packets with the source port changed for users behind generic NAT firewalls? I might try hooking the IPCOP box back up and doing a capture of that, so I can see what is different between the IPCOP (worked "out of the box") vs. the pfsense. Dave ----- Original Message ----- From: "Tony Graziano" <tgraziano(a)myitdepartment.net> To: "FreeSWITCH Users Help" <freeswitch-users(a)lists.freeswitch.org> Sent: Sunday, August 29, 2010 10:53:05 AM GMT -06:00 US/Canada Central Subject: Re: [Freeswitch-users] NAT traversal questions - (long)... If pfsense and your FS install are on the same subnet then "something" must be sitting in between to randomize the ports. In the 1.2.x install of pfsense, siproxd is installed by default. There is also a default rule for port 5060 that is in pfsense. I suggest removing the filters AND rules and starting from scratch. I believe this is also the default, and undesired installation, when installing a sip system behind it, even for the beta snapshots of pfsense 2.0. Please check your installed packages. Please remove any rules you did not create for the network and start over. What you are describing sounds to me the siproxd IS/WAS installed. It picks up on anything on the LAN and randomizes the port. It's a very common thing with pfsense. On Sun, Aug 29, 2010 at 11:26 AM, Dave Redmore < dave.redmore(a)spigotsystems.com > wrote: Confusion abounds here - sorry if I am being obtuse... A few points on all this - 1 - sipproxd is NOT installed on the firewall 2 - I am confused by the source port randomization issue. I think that what pfsense does by default is randomize the source port translations, rather than using the same source port translations for all connections from an internal host. This is completely different from the issue of telling pfsense to not change the source port at all - i.e. create a Static Port NAT. 3 - One of the things that I find most confusing about what I saw/see in the packet captures is that I EXPECTED to see non-SIP ports as the source port for the registration requests. What we commonly call NAT is more accurately described as PAT (Port Address Translation) - it functions by translating the source port of requests in and out of the firewall. It is one of the FEW things that I like about Cisco is that they more accurately use the terms NAT and PAT. 4 - So, that brings me back to why am I NOT seeing random source ports - why is Freeswitch NOT tagging my connection from pfsense as being NAT'd? Dave To start receiving Spigot Network's once a month newsletter filled with interesting technology news and great offers click SUBSCRIBE ----- Original Message ----- From: "Tony Graziano" < tgraziano(a)myitdepartment.net > To: "FreeSWITCH Users Help" < freeswitch-users(a)lists.freeswitch.org > Sent: Sunday, August 29, 2010 7:11:26 AM GMT -06:00 US/Canada Central Subject: Re: [Freeswitch-users] NAT traversal questions - (long)... Yeah, the sipxroxd is in the installed packages on his build. Remove the intsalled package and make sure the default rule for outgoing traffic is set for manual/static nat, not automatic. http://blog.myitdepartment.net/?p=37 On Sun, Aug 29, 2010 at 7:40 AM, Tony Graziano < tgraziano(a)myitdepartment.net > wrote: > Ipcop has a similar setting to pfsense. You probably missed it. > > MOST FIREWALLS do not use static port NAT. The default rules for > pfsense (and packages) for port 5060 should be removed. > > On your outbound rule for your LAN static port nat needs to be > enabled. Once you do that recreate the nat rules AND remove the > siproxd package by default. > > This is really a pfsense firewall question, it is clear static port > was not enabled so the source port was re-written because that is what > MOST firewalls do by default. > > On 8/29/10, Dave Redmore < dave.redmore(a)spigotsystems.com > wrote: >> Hello All, >> >> I ran into an issue today that has burned up most of my day troubleshooting. >> I have resolved the problem, but would really like to understand what caused >> it, or some of the internal Freeswitch plumbing that is at play so that I >> can learn something from all of this time I have invested. >> >> I have a Freeswitch server running that acts as a proxy to an account with >> an ITSP for doing T38 faxing. The Freeswitch server has a public IP address >> - there are four "users" who register simple FXS ATAs to my server and it >> then proxies to the ITSP using the "proxy_media" functionality. It has been >> working very well for the last 6 months or so. I have never had to deal with >> any NAT traversal issues - I just point the ATA to the IP to register and >> everything is great. >> >> Here is what the four users "looked" like - >> >> User1 : Grandstream HT-287 -> DD-WRT Router (NAT) -> Internet -> Freeswitch >> Proxy >> User2 : Grandstream HT-503 -> DD-WRT Router (NAT) -> Internet -> Freeswitch >> Proxy >> User3 : Grandstream HT-502 -> Comcast/SMC Router (NAT) -> Internet -> >> Freeswitch Proxy >> User4 : Grandstream HT-287 -> IPCOP 1.4.11 (NAT) -> Comcast Gateway -> >> Freeswitch Proxy >> >> (User4 is my office, so the IPCOP firewall and the Freeswitch Proxy sit on >> the same Comcast Gateway) >> >> As I said, this all worked perfectly without any need to "fiddle" with >> anything on any firewalls - worked right out of the box. >> >> So, today I changed out my IPCOP firewall for a pfsense firewall - and my >> HT-287 would no longer register. >> >> After much head-scratching, packet captures, etc. I found that I needed to >> set up a Static Port NAT for the port the HT-287 was using (5062) in order >> to get this to work. >> >> So, I see WHAT is happening, but I really want to know WHY it is happening. >> >> Here are the gory details: >> >> The sofia status of the profile looks like this - when the I have the Static >> Port NAT in place (details changed for security): >> >> _______________________________________________________________ >> Call-ID: 0e551b3c694a793c(a)192.168.1.137 >> User: 8885554525(a)173.11.22.111 >> Contact: "user" >> < sip:8885554525@192.168.1.137 ;fs_nat=yes;fs_path=sip%3A8885554525%40173.22.22.55%3A5060> >> Agent: Grandstream HT287 1.1.0.45 DevId 000b821203c5 >> Status: Registered(UDP-NAT)(unknown) EXP(2010-08-29 01:17:03) >> Host: 173-11-22-111-illinois.hfc.comcastbusiness.net >> IP: 173.22.22.55 >> Port: 5060 >> Auth-User: 8885554525 >> Auth-Realm: 173.11.22.111 >> MWI-Account: 8885554525(a)173.11.22.111 >> >> Call-ID: 1716488819-5062-1(a)192.168.7.150 >> User: 8885554544(a)173.11.22.111 >> Contact: "user" <sip:8885554544@192.168.7.150:5062;user=phone;fs_nat=yes; >> fs_path=sip%3A8885554544%4098.255.0.11%3A5062%3Buser%3Dphone> >> Agent: Grandstream HT-502 V1.1B 1.0.1.63 >> Status: Registered(UDP-NAT)(unknown) EXP(2010-08-29 01:48:35) >> Host: 173-11-22-111-illinois.hfc.comcastbusiness.net >> IP: 98.255.0.11 >> Port: 5062 >> Auth-User: 8885554544 >> Auth-Realm: 173.11.22.111 >> MWI-Account: 8885554544(a)173.11.22.111 >> >> Call-ID: 090ee80e1a0ec9ed(a)10.8.11.149 >> User: 8885554549(a)173.11.22.111 >> Contact: "user" < sip:8885554549@10.8.11.149:5062 > >> Agent: Grandstream HT287 1.1.0.45 DevId 000b82127390 >> Status: Registered(UDP)(unknown) EXP(2010-08-29 02:00:42) >> Host: 173-11-22-111-illinois.hfc.comcastbusiness.net >> IP: 173.11.22.99 >> Port: 5062 >> Auth-User: 8885554549 >> Auth-Realm: 173.11.22.111 >> MWI-Account: 8885554549(a)173.11.22.111 >> >> Call-ID: 1035241259-5060-1(a)10.1.10.150 >> User: 8885554547(a)173.11.22.111 >> Contact: "user" <sip:8885554547@10.1.10.150:5060;user=phone;fs_nat=yes;fs >> _path=sip%3A8885554547%4098.222.55.100%3A5060%3Buser%3Dphone> >> Agent: Grandstream HT-503 V1.1B 1.0.1.63 >> Status: Registered(UDP-NAT)(unknown) EXP(2010-08-29 00:15:09) >> Host: 173-11-22-111-illinois.hfc.comcastbusiness.net >> IP: 98.222.55.100 >> Port: 5060 >> Auth-User: 8885554547 >> Auth-Realm: 173.11.22.111 >> MWI-Account: 8885554547(a)173.11.22.111 >> ___________________________________________________________ >> >> The "User4" account is in red. The "Contact" field is substantially >> different and the "Status" indicates "Registered (UDP)", rather than >> "Registered (UDP-NAT)" as the others. >> >> When I do a packet capture on the external NIC interface (eth0) - I see the >> following when the HT-287 tries to register and the Static Port NAT is NOT >> in place: >> >> ___________________________________________________________________ >> Internet Protocol, Src: 173.11.22.99 (173.11.22.99), Dst: 173.11.22.111 >> (173.11.22.111) >> User Datagram Protocol, Src Port: 11521 (11521), Dst Port: 5090 (5090) >> Session Initiation Protocol >> Request-Line: REGISTER sip: 173.11.22.111:5090 SIP/2.0 >> Method: REGISTER >> Request-URI: sip: 173.11.22.111:5090 >> Request-URI Host Part: 173.11.22.111 >> Request-URI Host Port: 5090 >> Message Header >> Via: SIP/2.0/UDP 10.8.11.149:5062;branch=z9hG4bKda48f838c8689e41 >> Transport: UDP >> Sent-by Address: 10.8.11.149 >> Sent-by port: 5062 >> Branch: z9hG4bKda48f838c8689e41 >> From: < sip:8885554549@173.11.22.111:5090 >;tag=c8a0d452edc5ac4b >> SIP from address: sip:8885554549@173.11.22.111:5090 >> SIP tag: c8a0d452edc5ac4b >> To: < sip:8885554549@173.11.22.111:5090 > >> Contact: < sip:88855564549@10.8.11.149:5062 > >> Contact Binding: < sip:8885554549@10.8.11.149:5062 > >> Supported: replaces, timer >> Call-ID: aa77d777bae71be6(a)10.8.11.149 >> CSeq: 100 REGISTER >> Sequence Number: 100 >> Method: REGISTER >> Expires: 3600 >> User-Agent: Grandstream HT287 1.1.0.45 DevId 000b82127390 >> Max-Forwards: 70 >> Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE,UPDATE >> Content-Length: 0 >> _______________________________________________________________ >> >> When Freeswitch replies back with a "401 Unauthorized" - asking for further >> Auth - it replies back to port 5062 - so the packet never comes back >> (pfsense is looking for a packet back on port 11521 in this case). >> >> If I put the Static Port NAT in place - all is well, because the "Source" >> port shows as "5062" - the rest of the packet looks pretty much the same. >> >> Now, here is a packet coming from one of the other Users - this one comes >> through a DD-WRT router - here we see that the Source Port is 5060 : >> >> _________________________________________________________________ >> Internet Protocol, Src: 173.22.22.55 (173.22.22.55), Dst: 173.11.22.111 >> (173.11.22.111) >> User Datagram Protocol, Src Port: sip (5060), Dst Port: 5090 (5090) >> Session Initiation Protocol >> Request-Line: REGISTER sip: 173.11.22.111:5090 SIP/2.0 >> Method: REGISTER >> Request-URI: sip: 173.11.22.111:5090 >> [Resent Packet: False] >> Message Header >> Via: SIP/2.0/UDP 192.168.1.137;branch=z9hG4bK665bc67a1c64292b >> Transport: UDP >> Sent-by Address: 192.168.1.137 >> Branch: z9hG4bK665bc67a1c64292b >> From: "fax" < sip:8885554525@173.11.22.111:5090 >;tag=8dc68b35111c4261 >> To: < sip:8156564525@173.15.28.101:5090 > >> Contact: < sip:8885554525@192.168.1.137 > >> Contact Binding: < sip:8885554525@192.168.1.137 > >> Call-ID: 0e551b3c694a793c(a)192.168.1.137 >> CSeq: 503 REGISTER >> Sequence Number: 503 >> Method: REGISTER >> Expires: 3600 >> User-Agent: Grandstream HT287 1.1.0.45 DevId 000b821203c5 >> Max-Forwards: 70 >> Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE,UPDATE >> Content-Length: 0 >> ______________________________________________________________________ >> >> Here is one more packet coming from a Comcast/SMC Router - again, the source >> port is correct: >> >> ______________________________________________________________________ >> Internet Protocol, Src: 98.244.55.100 (98.244.55.100), Dst: 173.11.22.111 >> (173.11.22.111) >> User Datagram Protocol, Src Port: sip (5060), Dst Port: 5090 (5090) >> Session Initiation Protocol >> Request-Line: REGISTER sip: 173.11.22.111:5090 SIP/2.0 >> Message Header >> Via: SIP/2.0/UDP 10.1.10.150:5060;branch=z9hG4bK58981045;rport >> Transport: UDP >> Sent-by Address: 10.1.10.150 >> Sent-by port: 5060 >> Branch: z9hG4bK58981045 >> RPort: rport >> From: <sip:8885554547@173.11.22.111:5090;user=phone>;tag=138706651 >> To: <sip:8885554547@173.11.22.111:5090;user=phone> >> Call-ID: 1035241259-5060-1(a)10.1.10.150 >> CSeq: 79875 REGISTER >> Sequence Number: 79875 >> Method: REGISTER >> Contact: >> <sip:8885554547@10.1.10.150:5060;user=phone>;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B821F9A84>" >> Contact Binding: >> <sip:8885554547@10.1.10.150:5060;user=phone>;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B821F9A84>" >> Max-Forwards: 70 >> User-Agent: Grandstream HT-503 V1.1B 1.0.1.63 >> Supported: path >> Expires: 300 >> Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, >> UPDATE >> Content-Length: 0 >> ___________________________________________________________ >> >> So, here are my questions: >> >> - Why is the Sofia Status so much different for the registration coming >> through the pfSense firewall. It looks like it doesn't get tagged as being >> NAT'd and the "Contact" info is much less. >> >> - Do most modern routers automatically Static Port NAT any SIP traffic? Both >> DD-WRT and SMC routers appear to be doing this - and not just on a simple >> Port bases (UDP 5060 only), because one of these examples is on 5062. Are >> these "SIP aware" firewalls that are doing this automatically, as the IPCOP >> did before? >> >> - Is the extra "Contact" data in the last packet example different because >> it is a different UA (HT-503 rather than an HT-287) >> >> - Is Freeswitch not flagging the registration from my office (User4) as >> being NAT'd because it is coming in on the same subnet as the interface >> Freeswitch received the packet on (Freeswitch is at 173.11.22.111 and >> pfsense is at 173.11.22.99)? >> >> Sorry for this terribly long posting - I'm just very curious to understand >> what is going on here, now that I have collected all this information. >> >> Thanks, >> >> Dave >> >> >> > > -- > Sent from my mobile device > > ====================== > Tony Graziano, Manager > Telephone: 434.984.8430 > sip: tgraziano(a)voice.myitdepartment.net > Fax: 434.984.8431 > > Email: tgraziano(a)myitdepartment.net > > LAN/Telephony/Security and Control Systems Helpdesk: > Telephone: 434.984.8426 > sip: helpdesk(a)voice.myitdepartment.net > Fax: 434.984.8427 > > Helpdesk Contract Customers: > http://www.myitdepartment.net/gethelp/ > > Why do mathematicians always confuse Halloween and Christmas? > Because 31 Oct = 25 Dec. > -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 sip: tgraziano(a)voice.myitdepartment.net Fax: 434.984.8431 Email: tgraziano(a)myitdepartment.net LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 sip: helpdesk(a)voice.myitdepartment.net Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ Why do mathematicians always confuse Halloween and Christmas? Because 31 Oct = 25 Dec. _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 sip: tgraziano(a)voice.myitdepartment.net Fax: 434.984.8431 Email: tgraziano(a)myitdepartment.net LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 sip: helpdesk(a)voice.myitdepartment.net Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ Why do mathematicians always confuse Halloween and Christmas? Because 31 Oct = 25 Dec. _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

4 3

INCOMPATIBLE_DESTINATION
by Jonas Gauffin 29 Aug '10

29 Aug '10

Hello, Why do this call result in INCOMPATIBLE_DESTINATION? http://pastebin.freeswitch.org/13736 Regards, Jonas

2 5

Re: [Freeswitch-users] NAT traversal questions - (long)...
by Dave Redmore 29 Aug '10

29 Aug '10

Confusion abounds here - sorry if I am being obtuse... A few points on all this - 1 - sipproxd is NOT installed on the firewall 2 - I am confused by the source port randomization issue. I think that what pfsense does by default is randomize the source port translations, rather than using the same source port translations for all connections from an internal host. This is completely different from the issue of telling pfsense to not change the source port at all - i.e. create a Static Port NAT. 3 - One of the things that I find most confusing about what I saw/see in the packet captures is that I EXPECTED to see non-SIP ports as the source port for the registration requests. What we commonly call NAT is more accurately described as PAT (Port Address Translation) - it functions by translating the source port of requests in and out of the firewall. It is one of the FEW things that I like about Cisco is that they more accurately use the terms NAT and PAT. 4 - So, that brings me back to why am I NOT seeing random source ports - why is Freeswitch NOT tagging my connection from pfsense as being NAT'd? Dave To start receiving Spigot Network's once a month newsletter filled with interesting technology news and great offers click SUBSCRIBE ----- Original Message ----- From: "Tony Graziano" <tgraziano(a)myitdepartment.net> To: "FreeSWITCH Users Help" <freeswitch-users(a)lists.freeswitch.org> Sent: Sunday, August 29, 2010 7:11:26 AM GMT -06:00 US/Canada Central Subject: Re: [Freeswitch-users] NAT traversal questions - (long)... Yeah, the sipxroxd is in the installed packages on his build. Remove the intsalled package and make sure the default rule for outgoing traffic is set for manual/static nat, not automatic. http://blog.myitdepartment.net/?p=37 On Sun, Aug 29, 2010 at 7:40 AM, Tony Graziano <tgraziano(a)myitdepartment.net> wrote: > Ipcop has a similar setting to pfsense. You probably missed it. > > MOST FIREWALLS do not use static port NAT. The default rules for > pfsense (and packages) for port 5060 should be removed. > > On your outbound rule for your LAN static port nat needs to be > enabled. Once you do that recreate the nat rules AND remove the > siproxd package by default. > > This is really a pfsense firewall question, it is clear static port > was not enabled so the source port was re-written because that is what > MOST firewalls do by default. > > On 8/29/10, Dave Redmore <dave.redmore(a)spigotsystems.com> wrote: >> Hello All, >> >> I ran into an issue today that has burned up most of my day troubleshooting. >> I have resolved the problem, but would really like to understand what caused >> it, or some of the internal Freeswitch plumbing that is at play so that I >> can learn something from all of this time I have invested. >> >> I have a Freeswitch server running that acts as a proxy to an account with >> an ITSP for doing T38 faxing. The Freeswitch server has a public IP address >> - there are four "users" who register simple FXS ATAs to my server and it >> then proxies to the ITSP using the "proxy_media" functionality. It has been >> working very well for the last 6 months or so. I have never had to deal with >> any NAT traversal issues - I just point the ATA to the IP to register and >> everything is great. >> >> Here is what the four users "looked" like - >> >> User1 : Grandstream HT-287 -> DD-WRT Router (NAT) -> Internet -> Freeswitch >> Proxy >> User2 : Grandstream HT-503 -> DD-WRT Router (NAT) -> Internet -> Freeswitch >> Proxy >> User3 : Grandstream HT-502 -> Comcast/SMC Router (NAT) -> Internet -> >> Freeswitch Proxy >> User4 : Grandstream HT-287 -> IPCOP 1.4.11 (NAT) -> Comcast Gateway -> >> Freeswitch Proxy >> >> (User4 is my office, so the IPCOP firewall and the Freeswitch Proxy sit on >> the same Comcast Gateway) >> >> As I said, this all worked perfectly without any need to "fiddle" with >> anything on any firewalls - worked right out of the box. >> >> So, today I changed out my IPCOP firewall for a pfsense firewall - and my >> HT-287 would no longer register. >> >> After much head-scratching, packet captures, etc. I found that I needed to >> set up a Static Port NAT for the port the HT-287 was using (5062) in order >> to get this to work. >> >> So, I see WHAT is happening, but I really want to know WHY it is happening. >> >> Here are the gory details: >> >> The sofia status of the profile looks like this - when the I have the Static >> Port NAT in place (details changed for security): >> >> _______________________________________________________________ >> Call-ID: 0e551b3c694a793c(a)192.168.1.137 >> User: 8885554525(a)173.11.22.111 >> Contact: "user" >> <sip:8885554525@192.168.1.137;fs_nat=yes;fs_path=sip%3A8885554525%40173.22.22.55%3A5060> >> Agent: Grandstream HT287 1.1.0.45 DevId 000b821203c5 >> Status: Registered(UDP-NAT)(unknown) EXP(2010-08-29 01:17:03) >> Host: 173-11-22-111-illinois.hfc.comcastbusiness.net >> IP: 173.22.22.55 >> Port: 5060 >> Auth-User: 8885554525 >> Auth-Realm: 173.11.22.111 >> MWI-Account: 8885554525(a)173.11.22.111 >> >> Call-ID: 1716488819-5062-1(a)192.168.7.150 >> User: 8885554544(a)173.11.22.111 >> Contact: "user" <sip:8885554544@192.168.7.150:5062;user=phone;fs_nat=yes; >> fs_path=sip%3A8885554544%4098.255.0.11%3A5062%3Buser%3Dphone> >> Agent: Grandstream HT-502 V1.1B 1.0.1.63 >> Status: Registered(UDP-NAT)(unknown) EXP(2010-08-29 01:48:35) >> Host: 173-11-22-111-illinois.hfc.comcastbusiness.net >> IP: 98.255.0.11 >> Port: 5062 >> Auth-User: 8885554544 >> Auth-Realm: 173.11.22.111 >> MWI-Account: 8885554544(a)173.11.22.111 >> >> Call-ID: 090ee80e1a0ec9ed(a)10.8.11.149 >> User: 8885554549(a)173.11.22.111 >> Contact: "user" <sip:8885554549@10.8.11.149:5062> >> Agent: Grandstream HT287 1.1.0.45 DevId 000b82127390 >> Status: Registered(UDP)(unknown) EXP(2010-08-29 02:00:42) >> Host: 173-11-22-111-illinois.hfc.comcastbusiness.net >> IP: 173.11.22.99 >> Port: 5062 >> Auth-User: 8885554549 >> Auth-Realm: 173.11.22.111 >> MWI-Account: 8885554549(a)173.11.22.111 >> >> Call-ID: 1035241259-5060-1(a)10.1.10.150 >> User: 8885554547(a)173.11.22.111 >> Contact: "user" <sip:8885554547@10.1.10.150:5060;user=phone;fs_nat=yes;fs >> _path=sip%3A8885554547%4098.222.55.100%3A5060%3Buser%3Dphone> >> Agent: Grandstream HT-503 V1.1B 1.0.1.63 >> Status: Registered(UDP-NAT)(unknown) EXP(2010-08-29 00:15:09) >> Host: 173-11-22-111-illinois.hfc.comcastbusiness.net >> IP: 98.222.55.100 >> Port: 5060 >> Auth-User: 8885554547 >> Auth-Realm: 173.11.22.111 >> MWI-Account: 8885554547(a)173.11.22.111 >> ___________________________________________________________ >> >> The "User4" account is in red. The "Contact" field is substantially >> different and the "Status" indicates "Registered (UDP)", rather than >> "Registered (UDP-NAT)" as the others. >> >> When I do a packet capture on the external NIC interface (eth0) - I see the >> following when the HT-287 tries to register and the Static Port NAT is NOT >> in place: >> >> ___________________________________________________________________ >> Internet Protocol, Src: 173.11.22.99 (173.11.22.99), Dst: 173.11.22.111 >> (173.11.22.111) >> User Datagram Protocol, Src Port: 11521 (11521), Dst Port: 5090 (5090) >> Session Initiation Protocol >> Request-Line: REGISTER sip:173.11.22.111:5090 SIP/2.0 >> Method: REGISTER >> Request-URI: sip:173.11.22.111:5090 >> Request-URI Host Part: 173.11.22.111 >> Request-URI Host Port: 5090 >> Message Header >> Via: SIP/2.0/UDP 10.8.11.149:5062;branch=z9hG4bKda48f838c8689e41 >> Transport: UDP >> Sent-by Address: 10.8.11.149 >> Sent-by port: 5062 >> Branch: z9hG4bKda48f838c8689e41 >> From: <sip:8885554549@173.11.22.111:5090>;tag=c8a0d452edc5ac4b >> SIP from address: sip:8885554549@173.11.22.111:5090 >> SIP tag: c8a0d452edc5ac4b >> To: <sip:8885554549@173.11.22.111:5090> >> Contact: <sip:88855564549@10.8.11.149:5062> >> Contact Binding: <sip:8885554549@10.8.11.149:5062> >> Supported: replaces, timer >> Call-ID: aa77d777bae71be6(a)10.8.11.149 >> CSeq: 100 REGISTER >> Sequence Number: 100 >> Method: REGISTER >> Expires: 3600 >> User-Agent: Grandstream HT287 1.1.0.45 DevId 000b82127390 >> Max-Forwards: 70 >> Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE,UPDATE >> Content-Length: 0 >> _______________________________________________________________ >> >> When Freeswitch replies back with a "401 Unauthorized" - asking for further >> Auth - it replies back to port 5062 - so the packet never comes back >> (pfsense is looking for a packet back on port 11521 in this case). >> >> If I put the Static Port NAT in place - all is well, because the "Source" >> port shows as "5062" - the rest of the packet looks pretty much the same. >> >> Now, here is a packet coming from one of the other Users - this one comes >> through a DD-WRT router - here we see that the Source Port is 5060 : >> >> _________________________________________________________________ >> Internet Protocol, Src: 173.22.22.55 (173.22.22.55), Dst: 173.11.22.111 >> (173.11.22.111) >> User Datagram Protocol, Src Port: sip (5060), Dst Port: 5090 (5090) >> Session Initiation Protocol >> Request-Line: REGISTER sip:173.11.22.111:5090 SIP/2.0 >> Method: REGISTER >> Request-URI: sip:173.11.22.111:5090 >> [Resent Packet: False] >> Message Header >> Via: SIP/2.0/UDP 192.168.1.137;branch=z9hG4bK665bc67a1c64292b >> Transport: UDP >> Sent-by Address: 192.168.1.137 >> Branch: z9hG4bK665bc67a1c64292b >> From: "fax" <sip:8885554525@173.11.22.111:5090>;tag=8dc68b35111c4261 >> To: <sip:8156564525@173.15.28.101:5090> >> Contact: <sip:8885554525@192.168.1.137> >> Contact Binding: <sip:8885554525@192.168.1.137> >> Call-ID: 0e551b3c694a793c(a)192.168.1.137 >> CSeq: 503 REGISTER >> Sequence Number: 503 >> Method: REGISTER >> Expires: 3600 >> User-Agent: Grandstream HT287 1.1.0.45 DevId 000b821203c5 >> Max-Forwards: 70 >> Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE,UPDATE >> Content-Length: 0 >> ______________________________________________________________________ >> >> Here is one more packet coming from a Comcast/SMC Router - again, the source >> port is correct: >> >> ______________________________________________________________________ >> Internet Protocol, Src: 98.244.55.100 (98.244.55.100), Dst: 173.11.22.111 >> (173.11.22.111) >> User Datagram Protocol, Src Port: sip (5060), Dst Port: 5090 (5090) >> Session Initiation Protocol >> Request-Line: REGISTER sip:173.11.22.111:5090 SIP/2.0 >> Message Header >> Via: SIP/2.0/UDP 10.1.10.150:5060;branch=z9hG4bK58981045;rport >> Transport: UDP >> Sent-by Address: 10.1.10.150 >> Sent-by port: 5060 >> Branch: z9hG4bK58981045 >> RPort: rport >> From: <sip:8885554547@173.11.22.111:5090;user=phone>;tag=138706651 >> To: <sip:8885554547@173.11.22.111:5090;user=phone> >> Call-ID: 1035241259-5060-1(a)10.1.10.150 >> CSeq: 79875 REGISTER >> Sequence Number: 79875 >> Method: REGISTER >> Contact: >> <sip:8885554547@10.1.10.150:5060;user=phone>;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B821F9A84>" >> Contact Binding: >> <sip:8885554547@10.1.10.150:5060;user=phone>;reg-id=1;+sip.instance="<urn:uuid:00000000-0000-1000-8000-000B821F9A84>" >> Max-Forwards: 70 >> User-Agent: Grandstream HT-503 V1.1B 1.0.1.63 >> Supported: path >> Expires: 300 >> Allow: INVITE, ACK, OPTIONS, CANCEL, BYE, SUBSCRIBE, NOTIFY, INFO, REFER, >> UPDATE >> Content-Length: 0 >> ___________________________________________________________ >> >> So, here are my questions: >> >> - Why is the Sofia Status so much different for the registration coming >> through the pfSense firewall. It looks like it doesn't get tagged as being >> NAT'd and the "Contact" info is much less. >> >> - Do most modern routers automatically Static Port NAT any SIP traffic? Both >> DD-WRT and SMC routers appear to be doing this - and not just on a simple >> Port bases (UDP 5060 only), because one of these examples is on 5062. Are >> these "SIP aware" firewalls that are doing this automatically, as the IPCOP >> did before? >> >> - Is the extra "Contact" data in the last packet example different because >> it is a different UA (HT-503 rather than an HT-287) >> >> - Is Freeswitch not flagging the registration from my office (User4) as >> being NAT'd because it is coming in on the same subnet as the interface >> Freeswitch received the packet on (Freeswitch is at 173.11.22.111 and >> pfsense is at 173.11.22.99)? >> >> Sorry for this terribly long posting - I'm just very curious to understand >> what is going on here, now that I have collected all this information. >> >> Thanks, >> >> Dave >> >> >> > > -- > Sent from my mobile device > > ====================== > Tony Graziano, Manager > Telephone: 434.984.8430 > sip: tgraziano(a)voice.myitdepartment.net > Fax: 434.984.8431 > > Email: tgraziano(a)myitdepartment.net > > LAN/Telephony/Security and Control Systems Helpdesk: > Telephone: 434.984.8426 > sip: helpdesk(a)voice.myitdepartment.net > Fax: 434.984.8427 > > Helpdesk Contract Customers: > http://www.myitdepartment.net/gethelp/ > > Why do mathematicians always confuse Halloween and Christmas? > Because 31 Oct = 25 Dec. > -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 sip: tgraziano(a)voice.myitdepartment.net Fax: 434.984.8431 Email: tgraziano(a)myitdepartment.net LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 sip: helpdesk(a)voice.myitdepartment.net Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ Why do mathematicians always confuse Halloween and Christmas? Because 31 Oct = 25 Dec. _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users(a)lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

2 1

How to stop FS from replying to OPTIONS?
by Victor Chukalovskiy 29 Aug '10

29 Aug '10

4 8