Greetings all, A question on NATing in Freeswitch - I have my internal SIP profile to use a static public IP for the ext-sip-ip and ext-rtp-ip. The Freeswitch server is on a local LAN IP, for example 192.168.0.10. External SIP clients can access the server via the external IP, as there's a static NAT on the router to map the public IP to the private IP. I have another SIP client on a different LAN, but behind the same firewall, for example, 10.0.0.10. This client is allowed to talk to the server on its private ip of 192.168.0.10, by allowing inter-vlan traffic to pass through. My challenge is, how do I get Freeswitch to recognise this internal SIP client as being allowed to use the internal IP for SIP/RTP communications, and therefore present the client with internal addresses in the SIP header for SIP/RTP? Due to statically setting ext-sip-ip and ext-rtp-ip, Freeswitch tells the client to go via the public IP. The firewall has a policy to not accept traffic to the public IP if sourced from an internal device. I have explored the NATing options in Freeswitch, but can't find anything that fits my scenario. It seems to be more towards how to enable NAT in certain situations, not disable it. I have also looked at re-writing the SDP, but this re-writes the incoming SDP from the clients. My intention was to re-write the outgoing SDP from the Freeswitch to include the internal IP address as the RTP connect in address. I don't have much Asterisk experience, but I seem to remember a nat.conf file where you could specify subnets that were treated differently. These could be classed as internal subnets, and would be given the private IP in the SDP from asterisk, everything got the public IP. I'm also aware that I could create another SIP profile easily with different NATing/IP options, but I want to find out if there's anything I can do with the above first. Many thanks for the help!
One simple option would be to have a 2nd profile listening on another port (eg 5080) that does not use ext-*-ip and connect to that internally. -Steve On 7 February 2013 11:44, Ben <ben122uk@gmail.com> wrote:
Greetings all,****
** **
A question on NATing in Freeswitch – I have my internal SIP profile to use a static public IP for the ext-sip-ip and ext-rtp-ip. The Freeswitch server is on a local LAN IP, for example 192.168.0.10. External SIP clients can access the server via the external IP, as there’s a static NAT on the router to map the public IP to the private IP.****
** **
I have another SIP client on a different LAN, but behind the same firewall, for example, 10.0.0.10. This client is allowed to talk to the server on its private ip of 192.168.0.10, by allowing inter-vlan traffic to pass through. My challenge is, how do I get Freeswitch to recognise this internal SIP client as being allowed to use the internal IP for SIP/RTP communications, and therefore present the client with internal addresses in the SIP header for SIP/RTP? Due to statically setting ext-sip-ip and ext-rtp-ip, Freeswitch tells the client to go via the public IP. The firewall has a policy to not accept traffic to the public IP if sourced from an internal device.****
** **
I have explored the NATing options in Freeswitch, but can’t find anything that fits my scenario. It seems to be more towards how to enable NAT in certain situations, not disable it. I have also looked at re-writing the SDP, but this re-writes the incoming SDP from the clients. My intention was to re-write the outgoing SDP from the Freeswitch to include the internal IP address as the RTP connect in address.****
** **
I don’t have much Asterisk experience, but I seem to remember a nat.conf file where you could specify subnets that were treated differently. These could be classed as internal subnets, and would be given the private IP in the SDP from asterisk, everything got the public IP.****
** **
I’m also aware that I could create another SIP profile easily with different NATing/IP options, but I want to find out if there’s anything I can do with the above first.****
** **
Many thanks for the help!****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Steve, thanks for getting back to me. Yes that's certainly my secondary option. However, if there's a chance that my scenario below could work then I'd like to explore it. As a bit more information, the internal SIP client is a SIP call generator that health checks the server periodically by putting through a call. I'd like it to put through a call to the live profile in parallel with the external clients so that it's testing the live profile, and not a separate test profile. If there's a situation where the live profile fails, but the test profile is still functional, the call generator would never know the live profile is down if it was calling the test profile. Unless you think this isn't likely to happen, and it's more likely the Sofia module would go down, bringing all profiles down with it? From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Steven Ayre Sent: 07 February 2013 13:07 To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] Use local IPv4 for specific LAN IP address range One simple option would be to have a 2nd profile listening on another port (eg 5080) that does not use ext-*-ip and connect to that internally. -Steve On 7 February 2013 11:44, Ben <ben122uk@gmail.com> wrote: Greetings all, A question on NATing in Freeswitch - I have my internal SIP profile to use a static public IP for the ext-sip-ip and ext-rtp-ip. The Freeswitch server is on a local LAN IP, for example 192.168.0.10. External SIP clients can access the server via the external IP, as there's a static NAT on the router to map the public IP to the private IP. I have another SIP client on a different LAN, but behind the same firewall, for example, 10.0.0.10. This client is allowed to talk to the server on its private ip of 192.168.0.10, by allowing inter-vlan traffic to pass through. My challenge is, how do I get Freeswitch to recognise this internal SIP client as being allowed to use the internal IP for SIP/RTP communications, and therefore present the client with internal addresses in the SIP header for SIP/RTP? Due to statically setting ext-sip-ip and ext-rtp-ip, Freeswitch tells the client to go via the public IP. The firewall has a policy to not accept traffic to the public IP if sourced from an internal device. I have explored the NATing options in Freeswitch, but can't find anything that fits my scenario. It seems to be more towards how to enable NAT in certain situations, not disable it. I have also looked at re-writing the SDP, but this re-writes the incoming SDP from the clients. My intention was to re-write the outgoing SDP from the Freeswitch to include the internal IP address as the RTP connect in address. I don't have much Asterisk experience, but I seem to remember a nat.conf file where you could specify subnets that were treated differently. These could be classed as internal subnets, and would be given the private IP in the SDP from asterisk, everything got the public IP. I'm also aware that I could create another SIP profile easily with different NATing/IP options, but I want to find out if there's anything I can do with the above first. Many thanks for the help! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (2)
-
Ben
-
Steven Ayre