Binding to virtual interface (ipsec vpn)
Hello everyone, I'm having trouble binding FS to another ip on a virtual interface (eth0:3). The virtual interface's ip address is the gateway to an ipsec vpn, and the only way to access this voip provider's sip server, is through the vpn. I tried setting up an additional sip profile, with rtp-ip and sip-ip as the virtual interface's ip, but when I do that, no packets are sent at all when trying to make a call with originate through the cli (according to tcpdump). I tried also setting ext-rtp-ip and ext-sip-ip to the same virtual interface's ip, but nothing happened, still no packets being sent (according to tcpdump) when trying to make a call. Finally I tried only setting ext-rtp-ip and ext-sip-ip to the virtual interface's ip, and leave rtp-ip and sip-ip to $${local_ip_v4}, then tcpdump started seeing some traffic (when trying to originate a call) which I was able to capture. When I loaded the trace on wireshark though, I noticed the source ip being used to send all the (sip) packets, is the one from eth0 (public ip), and not eth0:3's ip (private ip for vpn). Has anyone had any similiar experiences? how were you able to solve it? Thanks for your help! Nico
If you set the IP in sip-ip and rtp-ip that is abound to eth0:3 then it should bind to that interface/ip and use that... I haven't see anything out of the usual when doing this. Show me your profile config and the output of ifconfig -a /b On Oct 11, 2010, at 4:46 AM, Nicolas Brenner wrote:
Hello everyone,
I'm having trouble binding FS to another ip on a virtual interface (eth0:3). The virtual interface's ip address is the gateway to an ipsec vpn, and the only way to access this voip provider's sip server, is through the vpn.
I tried setting up an additional sip profile, with rtp-ip and sip-ip as the virtual interface's ip, but when I do that, no packets are sent at all when trying to make a call with originate through the cli (according to tcpdump). I tried also setting ext-rtp-ip and ext-sip-ip to the same virtual interface's ip, but nothing happened, still no packets being sent (according to tcpdump) when trying to make a call. Finally I tried only setting ext-rtp-ip and ext-sip-ip to the virtual interface's ip, and leave rtp-ip and sip-ip to $${local_ip_v4}, then tcpdump started seeing some traffic (when trying to originate a call) which I was able to capture. When I loaded the trace on wireshark though, I noticed the source ip being used to send all the (sip) packets, is the one from eth0 (public ip), and not eth0:3's ip (private ip for vpn).
Has anyone had any similiar experiences? how were you able to solve it?
Thanks for your help!
Nico
Here's the output of ifconfig -a: http://pastebin.freeswitch.org/14199 This is the output of route: http://pastebin.freeswitch.org/14200 This is the external.xml file under sip_profiles (is the default, only modified sip-ip and rtp-ip): http://pastebin.freeswitch.org/14201 This is somegateway.xml file under sip_profiles/external/ http://pastebin.freeswitch.org/14202 Output of sofia status from cli (tried with alias=true and alias=false on internal profile): http://pastebin.freeswitch.org/14203 This is the cli output with loglevel all set to 9 and siptrace on for external profile: http://pastebin.freeswitch.org/14204 Thanks On Mon, Oct 11, 2010 at 2:33 PM, Brian West <brian@freeswitch.org> wrote:
If you set the IP in sip-ip and rtp-ip that is abound to eth0:3 then it should bind to that interface/ip and use that... I haven't see anything out of the usual when doing this.
Show me your profile config and the output of ifconfig -a
/b
On Oct 11, 2010, at 4:46 AM, Nicolas Brenner wrote:
Hello everyone,
I'm having trouble binding FS to another ip on a virtual interface (eth0:3). The virtual interface's ip address is the gateway to an ipsec vpn, and the only way to access this voip provider's sip server, is through the vpn.
I tried setting up an additional sip profile, with rtp-ip and sip-ip as the virtual interface's ip, but when I do that, no packets are sent at all when trying to make a call with originate through the cli (according to tcpdump). I tried also setting ext-rtp-ip and ext-sip-ip to the same virtual interface's ip, but nothing happened, still no packets being sent (according to tcpdump) when trying to make a call. Finally I tried only setting ext-rtp-ip and ext-sip-ip to the virtual interface's ip, and leave rtp-ip and sip-ip to $${local_ip_v4}, then tcpdump started seeing some traffic (when trying to originate a call) which I was able to capture. When I loaded the trace on wireshark though, I noticed the source ip being used to send all the (sip) packets, is the one from eth0 (public ip), and not eth0:3's ip (private ip for vpn).
Has anyone had any similiar experiences? how were you able to solve it?
Thanks for your help!
Nico
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Another thing to check is that there is only one IP address assigned to the interface. A problem with using the "right" IP address can occur if there is more than one IP address assigned to the same interface. Without routing rules, the operating system chooses the IP address from the interface that it believes is the best one for delivering the traffic, and sometimes it is not the address you want to use. -- Russell Mosemann ________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
The system routes are well configured, I can ping and telnet the gateway from bash, all traffic to that gateway's ip is routed through the needed interface. Now, are there other routes I should be addressing in FS config files? On Mon, Oct 11, 2010 at 6:33 PM, <Russell.Mosemann@cune.org> wrote:
Another thing to check is that there is only one IP address assigned to the interface. A problem with using the "right" IP address can occur if there is more than one IP address assigned to the same interface. Without routing rules, the operating system chooses the IP address from the interface that it believes is the best one for delivering the traffic, and sometimes it is not the address you want to use.
-- Russell Mosemann
________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
When you do "sofia status" do you see the correct IP address for the profile in question? Also, when you make an outbound call can you see where (if?) the packets are going? Perhaps to another interface? -MC On Mon, Oct 11, 2010 at 2:44 PM, Nicolas Brenner <nico@clickfono.com> wrote:
The system routes are well configured, I can ping and telnet the gateway from bash, all traffic to that gateway's ip is routed through the needed interface. Now, are there other routes I should be addressing in FS config files?
On Mon, Oct 11, 2010 at 6:33 PM, <Russell.Mosemann@cune.org> wrote:
Another thing to check is that there is only one IP address assigned to the interface. A problem with using the "right" IP address can occur if there is more than one IP address assigned to the same interface. Without routing rules, the operating system chooses the IP address from the interface that it believes is the best one for delivering the traffic, and sometimes it is not the address you want to use.
-- Russell Mosemann
________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Yup, here's the output: http://pastebin.freeswitch.org/14203 I'm trying to originate a call using the gateway on 200.13.15.220, originating it from 172.26.6.161. Seems like no packets are going out at all, at least tcpdump is not getting any. Oddly, if instead of setting sip-ip and rtp-ip to the ip of the interface I need, I set ext-sip-ip and ext-rtp-ip to that ip, tcpdump starts seeing traffic, but the traffic is originated from the wrong ip/interface (the public one, instead of the one with the ipsec vpn). On Mon, Oct 11, 2010 at 6:50 PM, Michael Collins <msc@freeswitch.org> wrote:
When you do "sofia status" do you see the correct IP address for the profile in question? Also, when you make an outbound call can you see where (if?) the packets are going? Perhaps to another interface?
-MC
On Mon, Oct 11, 2010 at 2:44 PM, Nicolas Brenner <nico@clickfono.com>wrote:
The system routes are well configured, I can ping and telnet the gateway from bash, all traffic to that gateway's ip is routed through the needed interface. Now, are there other routes I should be addressing in FS config files?
On Mon, Oct 11, 2010 at 6:33 PM, <Russell.Mosemann@cune.org> wrote:
Another thing to check is that there is only one IP address assigned to the interface. A problem with using the "right" IP address can occur if there is more than one IP address assigned to the same interface. Without routing rules, the operating system chooses the IP address from the interface that it believes is the best one for delivering the traffic, and sometimes it is not the address you want to use.
-- Russell Mosemann
________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I haven't been able to solve this, but one thing I noticed though, is that the internal profile is being aliased to the ip of the interface I'm trying to use in the external profile, I'm guessing this causes trouble, the problem is that if I disable aliasing, it doesn't make a difference, and checking out the list archive, apparently is a bad idea to disable aliasing anyway. How do I prevent the internal profile from aliasing to a specific ip? and what ip should the internal profile should alias to if the server has to private ("internal") ip? Thanks. On Mon, Oct 11, 2010 at 7:21 PM, Nicolas Brenner <nico@clickfono.com> wrote:
Yup, here's the output:
http://pastebin.freeswitch.org/14203
I'm trying to originate a call using the gateway on 200.13.15.220, originating it from 172.26.6.161.
Seems like no packets are going out at all, at least tcpdump is not getting any. Oddly, if instead of setting sip-ip and rtp-ip to the ip of the interface I need, I set ext-sip-ip and ext-rtp-ip to that ip, tcpdump starts seeing traffic, but the traffic is originated from the wrong ip/interface (the public one, instead of the one with the ipsec vpn).
On Mon, Oct 11, 2010 at 6:50 PM, Michael Collins <msc@freeswitch.org>wrote:
When you do "sofia status" do you see the correct IP address for the profile in question? Also, when you make an outbound call can you see where (if?) the packets are going? Perhaps to another interface?
-MC
On Mon, Oct 11, 2010 at 2:44 PM, Nicolas Brenner <nico@clickfono.com>wrote:
The system routes are well configured, I can ping and telnet the gateway from bash, all traffic to that gateway's ip is routed through the needed interface. Now, are there other routes I should be addressing in FS config files?
On Mon, Oct 11, 2010 at 6:33 PM, <Russell.Mosemann@cune.org> wrote:
Another thing to check is that there is only one IP address assigned to the interface. A problem with using the "right" IP address can occur if there is more than one IP address assigned to the same interface. Without routing rules, the operating system chooses the IP address from the interface that it believes is the best one for delivering the traffic, and sometimes it is not the address you want to use.
-- Russell Mosemann
________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I tried a few more things and discovered that apparently the sip profile configuration was fine, but the problem has something to do with the gateway, because when I try originating a call through another gateway, it generates traffic fine, it doesn't work because is not on the right network interface, but at least it tries. This is the configuration of the gateway that is not working (although it appears fine with sofia status on the console) <gateway name="somegateway"> <param name="username" value="someuser"/> <param name="password" value="somepass"/> <param name="from-domain" value="200.13.15.220:5061"/> <param name="realm" value="200.13.15.220:5061"/> <param name="proxy" value="200.13.15.220:5061"/> <param name="from-user" value="someuser"/> <param name="caller-id-in-from" value="false"/> <param name="expire-seconds" value="600"/> <param name="register" value="false"/> <param name="retry_seconds" value="5"/> <param name="extension" value="2011"/> <param name="context" value="public"/> <param name="codec-prefs" value="G729"/> <param name="rfc2833-pt" value="101"/> </gateway> Could it be because of the port (5061)? On Mon, Oct 18, 2010 at 10:33 AM, Nicolas Brenner <nico@clickfono.com>wrote:
I haven't been able to solve this, but one thing I noticed though, is that the internal profile is being aliased to the ip of the interface I'm trying to use in the external profile, I'm guessing this causes trouble, the problem is that if I disable aliasing, it doesn't make a difference, and checking out the list archive, apparently is a bad idea to disable aliasing anyway.
How do I prevent the internal profile from aliasing to a specific ip? and what ip should the internal profile should alias to if the server has to private ("internal") ip?
Thanks.
On Mon, Oct 11, 2010 at 7:21 PM, Nicolas Brenner <nico@clickfono.com>wrote:
Yup, here's the output:
http://pastebin.freeswitch.org/14203
I'm trying to originate a call using the gateway on 200.13.15.220, originating it from 172.26.6.161.
Seems like no packets are going out at all, at least tcpdump is not getting any. Oddly, if instead of setting sip-ip and rtp-ip to the ip of the interface I need, I set ext-sip-ip and ext-rtp-ip to that ip, tcpdump starts seeing traffic, but the traffic is originated from the wrong ip/interface (the public one, instead of the one with the ipsec vpn).
On Mon, Oct 11, 2010 at 6:50 PM, Michael Collins <msc@freeswitch.org>wrote:
When you do "sofia status" do you see the correct IP address for the profile in question? Also, when you make an outbound call can you see where (if?) the packets are going? Perhaps to another interface?
-MC
On Mon, Oct 11, 2010 at 2:44 PM, Nicolas Brenner <nico@clickfono.com>wrote:
The system routes are well configured, I can ping and telnet the gateway from bash, all traffic to that gateway's ip is routed through the needed interface. Now, are there other routes I should be addressing in FS config files?
On Mon, Oct 11, 2010 at 6:33 PM, <Russell.Mosemann@cune.org> wrote:
Another thing to check is that there is only one IP address assigned to the interface. A problem with using the "right" IP address can occur if there is more than one IP address assigned to the same interface. Without routing rules, the operating system chooses the IP address from the interface that it believes is the best one for delivering the traffic, and sometimes it is not the address you want to use.
-- Russell Mosemann
________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
100% you should only be setting sip-ip sip-port and rtp-ip you don't need the ext-* family of params at all. did you check netstat -na | grep <your ip> to see that it was bound? I think it's a network interface configuration problem more than anything else. It could also be iptables which you can prove by disabling it to see any improvement and then craft appropriate rules. On Mon, Oct 11, 2010 at 4:46 AM, Nicolas Brenner <nico@clickfono.com> wrote:
Hello everyone, I'm having trouble binding FS to another ip on a virtual interface (eth0:3). The virtual interface's ip address is the gateway to an ipsec vpn, and the only way to access this voip provider's sip server, is through the vpn. I tried setting up an additional sip profile, with rtp-ip and sip-ip as the virtual interface's ip, but when I do that, no packets are sent at all when trying to make a call with originate through the cli (according to tcpdump). I tried also setting ext-rtp-ip and ext-sip-ip to the same virtual interface's ip, but nothing happened, still no packets being sent (according to tcpdump) when trying to make a call. Finally I tried only setting ext-rtp-ip and ext-sip-ip to the virtual interface's ip, and leave rtp-ip and sip-ip to $${local_ip_v4}, then tcpdump started seeing some traffic (when trying to originate a call) which I was able to capture. When I loaded the trace on wireshark though, I noticed the source ip being used to send all the (sip) packets, is the one from eth0 (public ip), and not eth0:3's ip (private ip for vpn). Has anyone had any similiar experiences? how were you able to solve it? Thanks for your help!
Nico _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
On Mon, Oct 11, 2010 at 5:57 PM, Anthony Minessale < anthony.minessale@gmail.com> wrote:
100% you should only be setting sip-ip sip-port and rtp-ip you don't need the ext-* family of params at all.
did you check netstat -na | grep <your ip> to see that it was bound?
The external profile is bound to port 5080 on the specified ip address, maybe the title of my email is somewhat misleading, but the problem is that even though it is bound to that address, it is not sending out any traffic.
I think it's a network interface configuration problem more than anything else.
The network interface is actually working fine, I can ping the gateway and telnet to the port where it is configured to listen. Basically, I can communicate with it manually, but not with FS.
It could also be iptables which you can prove by disabling it to see any improvement and then craft appropriate rules.
iptables is actually disabled for these tests, yet this is all I get from tcpdump while trying to originate a call: tcpdump -nq -s 0 -A -vvv host 200.13.15.220 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 0 packets captured 0 packets received by filter 0 packets dropped by kernel
On Mon, Oct 11, 2010 at 4:46 AM, Nicolas Brenner <nico@clickfono.com> wrote:
Hello everyone, I'm having trouble binding FS to another ip on a virtual interface (eth0:3). The virtual interface's ip address is the gateway to an ipsec vpn, and the only way to access this voip provider's sip server, is through the vpn. I tried setting up an additional sip profile, with rtp-ip and sip-ip as the virtual interface's ip, but when I do that, no packets are sent at all when trying to make a call with originate through the cli (according to tcpdump). I tried also setting ext-rtp-ip and ext-sip-ip to the same virtual interface's ip, but nothing happened, still no packets being sent (according to tcpdump) when trying to make a call. Finally I tried only setting ext-rtp-ip and ext-sip-ip to the virtual interface's ip, and leave rtp-ip and sip-ip to $${local_ip_v4}, then tcpdump started seeing some traffic (when trying to originate a call) which I was able to capture. When I loaded the trace on wireshark though, I noticed the source ip being used to send all the (sip) packets, is the one from eth0 (public ip), and not eth0:3's ip (private ip for vpn). Has anyone had any similiar experiences? how were you able to solve it? Thanks for your help!
Nico _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Nicolas Brenner <nico@clickfono.com> said:
tcpdump -nq -s 0 -A -vvv host 200.13.15.220 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
Check if any udp traffic is going out from FS. You can restrict it by specifying a port, in case you have DNS or DHCP on the same machine. tcpdump -nq -s 0 -A -vvv udp -- Russell Mosemann ________________________________________________________ Concordia University, Nebraska See http://www.cune.edu/ for the latest news and events!
participants (5)
-
Anthony Minessale
-
Brian West
-
Michael Collins
-
Nicolas Brenner
-
Russell.Mosemann＠cune.org