Hello Brian and others. You ask some interesting questions which perhaps go beyond my level of knowledge. Freeswitch is running on Windows 7 and Windows Firewall is running. The only firewall rule I have set up for Freeswitch is that for public network addresses it will only accept packets from the IP address of our provider. We've never been actually hijacked by people looking for SIP servers to take advantage of, but at some stage I became aware from the logs that we were being bombarded by frequent registration and call attempts from the public internet. These attempts were all failing but this activity was chewing up a lot of our monthly data. So I put the firewall rule in to shield us from any such attempts other than from our VOIP provider. I'm pretty sure that is working correctly. People looking for SIP servers just don't see ours now - it is no longer visible. The only other player in this I think is the router itself. Routers can often act in misterious ways and I can't be sure that it isn't doing some sort of port translation. The only rule in place on the router is to forward UDP port 5060 to Freeswitch. After doing some further reading, it has occurred to me that my NAT settings are probably wrong. The registration packets I am sending to the provider reference our private 192.168 address and not our public IP address. The router must be manipulating that information in the register packet or the provider might not be able to respond. Having said that, I am aware that providers also get up to tricks to deal with NAT when it is clear the packet has come from an address different from the addresses in the packet headers. I'm afraid my brain starts to fry at this point. OK so what are the NAT settings? In the SIP profile external.xml, I think they are at their default settings, ie I don't think I have ever changed them. The parameter aggressive-nat-detection is commented out. ext-rtp-ip and ext-sip-ip are both set to auto-nat. Cheers. Clive Lansink Email: Clive@Lansink.Co.NZ Phone: +64 9 520-4242 Mobile: +64 21 663-999 Fax: +64 21 789-150 -----Original message----- From: Brian West <brian@freeswitch.org> To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] Mistified by a registration issue Reply-to: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Date: Sat, 15 Mar 2014 19:59:41 -0500 Firewall uname -a what CPU? What nat settings have you tried? Because you’ll notice on both the remote is receiving you from 5061 not 5060 as it should if your firewall is correctly configured. -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Mar 15, 2014, at 4:21 PM, Clive Lansink <clive@lansink.co.nz> wrote:

Hello listers.

I have had Freeswitch running for quite some time now with few issues. But recently I installed a new router and came across this problem while configuring it. I have my Sofia external profile set to use port 5060 and my internal profile uses another port. So I followed my previous practice and set the router to forward UDP port 5060 to Freeswitch and that works properly. I decided on this occasion that itmight be a good idea to also open up ports 16384-32768 so these are also forwarded to Freeswitch, as these are the RTP ports Freeswitch is set to use. I quickly found to my surprise that Freeswitch would fail to register with the external provider once I did this, but as soon as I stopped forwarding ports 16384-32768, Freeswitch would again register as it should.

This seems really weird since I don't see how ports 16384-32768 can have any impact on the registration process on port 5060, and in any case whatever might be happening on these ports only involves Freeswitch so how can setting up such a port forwarding impact on registration.

I would be pleased if anyone out there can answer this.

I have included two SIP traces from the log. The first, trace1.txt, is the registration sequence when the ports are not forwarded. You can see Freeswitch sends a register, and the provider responds with an unauthorised which I think is the usual way it works. Freeswitch then responds with a register again and the provider responds with an ok. There are also some options packets in the sequence. So this is the regular pattern I see when Freeswitch is registered and remains registered.

The second, trace2.txt, shows what happens when the ports 16384-32768 are set in the router to be forwarded to Freeswitch. Here we see Freeswitch sends a register packet, though it doesn't have the authentication information. I presume this is because at this point the gateway knows that it is not registered so this is like the first step in registering from scratch. Then we see the provider respond with an unauthorised message including (as before) the instruction for how to authenticate. But then Freeswitch doesn't respond with a follow-up attempt to register and eventually we see that it just reports that it timed out trying to register.

I'm not a SIP expert but I don't see anything in the second dialog to explain why Freeswitch doesn't follow up to complete the registration even though it clearly does receive the unauthorised message with the authentication information.

It would be great if someone could suggest what might be going on here.

Thank you.

Clive Lansink Email: Clive@Lansink.Co.NZ Phone: +64 9 520-4242 Mobile: +64 21 663-999 Fax: +64 21 789-150 <trace1.txt><trace2.txt>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org