Internal Sofia profile fails to load if STUN fails
I came across this accidentally, because of a broken firewall. I rebooted a Freeswitch server, which came up but failed to load the internal profile. When trying to reload the profile from fs_cli, I got an error message that the stun server was invalid, which wasn't the case, it was just the firewall blocking traffic. Disabling the firewall and restarting the server got everything working again. This effectively prevents a server from functioning, in the event of having to reboot during an internet outage or if the stun server is temporarily inaccessible. I'd rather the profile load regardless and continue to probe the stun server until it gets a response. Is there any way to set this? Francis
we can't set the profile addresses until we get a stun response, and we can't start the profile listening without that address... so in short, no, no good way to do that. On May 6, 2014, at 8:46 AM, Francis <sms@icefire.qza.net.au> wrote:
I came across this accidentally, because of a broken firewall.
I rebooted a Freeswitch server, which came up but failed to load the internal profile. When trying to reload the profile from fs_cli, I got an error message that the stun server was invalid, which wasn't the case, it was just the firewall blocking traffic. Disabling the firewall and restarting the server got everything working again.
This effectively prevents a server from functioning, in the event of having to reboot during an internet outage or if the stun server is temporarily inaccessible. I'd rather the profile load regardless and continue to probe the stun server until it gets a response. Is there any way to set this?
Francis
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Isn't that making the assumption that dynamic addressing is required? Shouldn't he be able to configure that information staticly if he isn't behind a NAT? He doesn't indicate in his message if stun is actually required for his deployment. -- Nathan On 05/06/2014 02:10 PM, Michael Jerris wrote:
we can't set the profile addresses until we get a stun response, and we can't start the profile listening without that address... so in short, no, no good way to do that.
On May 6, 2014, at 8:46 AM, Francis <sms@icefire.qza.net.au> wrote:
I came across this accidentally, because of a broken firewall.
I rebooted a Freeswitch server, which came up but failed to load the internal profile. When trying to reload the profile from fs_cli, I got an error message that the stun server was invalid, which wasn't the case, it was just the firewall blocking traffic. Disabling the firewall and restarting the server got everything working again.
This effectively prevents a server from functioning, in the event of having to reboot during an internet outage or if the stun server is temporarily inaccessible. I'd rather the profile load regardless and continue to probe the stun server until it gets a response. Is there any way to set this?
Francis
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- ------------------------------------------------------------ Nathan Neulinger nneul@mst.edu Missouri S&T Information Technology (573) 612-1412 System Administrator - Architect
you can configure it statically, what mike is talking about, is people behind nat on a dynamic ip Ken Sent from my iPad
On May 6, 2014, at 22:23, Nathan Neulinger <nneul@mst.edu> wrote:
Isn't that making the assumption that dynamic addressing is required?
Shouldn't he be able to configure that information staticly if he isn't behind a NAT? He doesn't indicate in his message if stun is actually required for his deployment.
-- Nathan
On 05/06/2014 02:10 PM, Michael Jerris wrote: we can't set the profile addresses until we get a stun response, and we can't start the profile listening without that address... so in short, no, no good way to do that.
On May 6, 2014, at 8:46 AM, Francis <sms@icefire.qza.net.au> wrote:
I came across this accidentally, because of a broken firewall.
I rebooted a Freeswitch server, which came up but failed to load the internal profile. When trying to reload the profile from fs_cli, I got an error message that the stun server was invalid, which wasn't the case, it was just the firewall blocking traffic. Disabling the firewall and restarting the server got everything working again.
This effectively prevents a server from functioning, in the event of having to reboot during an internet outage or if the stun server is temporarily inaccessible. I'd rather the profile load regardless and continue to probe the stun server until it gets a response. Is there any way to set this?
Francis
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- ------------------------------------------------------------ Nathan Neulinger nneul@mst.edu Missouri S&T Information Technology (573) 612-1412 System Administrator - Architect
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You could also schedule 'sofia profile <name> start' to run periodically. If the profile is already started it'll do nothing, but if it isn't (eg STUN failed) it'll start it. That way if it fails on boot that command might start it a few minutes later. But really your issue is with your firewall. On a reboot it should work just fine if your firewall is configured right. It'll only be a issue in the event that your internet link is down during boot. -Steve On 7 May 2014 05:23, Ken Rice <krice@freeswitch.org> wrote:
you can configure it statically, what mike is talking about, is people behind nat on a dynamic ip
Ken Sent from my iPad
On May 6, 2014, at 22:23, Nathan Neulinger <nneul@mst.edu> wrote:
Isn't that making the assumption that dynamic addressing is required?
Shouldn't he be able to configure that information staticly if he isn't behind a NAT? He doesn't indicate in his message if stun is actually required for his deployment.
-- Nathan
On 05/06/2014 02:10 PM, Michael Jerris wrote: we can't set the profile addresses until we get a stun response, and we can't start the profile listening without that address... so in short, no, no good way to do that.
On May 6, 2014, at 8:46 AM, Francis <sms@icefire.qza.net.au> wrote:
I came across this accidentally, because of a broken firewall.
I rebooted a Freeswitch server, which came up but failed to load the internal profile. When trying to reload the profile from fs_cli, I got an error message that the stun server was invalid, which wasn't the case, it was just the firewall blocking traffic. Disabling the firewall and restarting the server got everything working again.
This effectively prevents a server from functioning, in the event of having to reboot during an internet outage or if the stun server is temporarily inaccessible. I'd rather the profile load regardless and continue to probe the stun server until it gets a response. Is there any way to set this?
Francis
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- ------------------------------------------------------------ Nathan Neulinger nneul@mst.edu Missouri S&T Information Technology (573) 612-1412 System Administrator - Architect
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Yes, I was thinking something along those lines, thanks! I did a test, starting the profile when it was already running and it does a stun lookup, which had me wondering what would happen if the lookup failed, so I added a bogus stun server and sure enough, it threw an error, but the profile stayed up regardless. That's pretty much what I was hoping for, so setting up a cron job should do the trick. Good to know there's a way to make it work if static IP's aren't available. -Francis On 2014-05-07 20:13, Steven Ayre wrote:
You could also schedule 'sofia profile <name> start' to run periodically. If the profile is already started it'll do nothing, but if it isn't (eg STUN failed) it'll start it. That way if it fails on boot that command might start it a few minutes later.
But really your issue is with your firewall. On a reboot it should work just fine if your firewall is configured right. It'll only be a issue in the event that your internet link is down during boot.
-Steve
On 7 May 2014 05:23, Ken Rice <krice@freeswitch.org> wrote:
you can configure it statically, what mike is talking about, is people behind nat on a dynamic ip
Ken Sent from my iPad
On May 6, 2014, at 22:23, Nathan Neulinger <nneul@mst.edu> wrote:
Isn't that making the assumption that dynamic addressing is required?
Shouldn't he be able to configure that information staticly if he isn't behind a NAT? He doesn't indicate in his message if stun is actually required for his deployment.
-- Nathan
On 05/06/2014 02:10 PM, Michael Jerris wrote: we can't set the profile addresses until we get a stun response, and we can't start the profile listening without that address... so in short, no, no good way to do that.
On May 6, 2014, at 8:46 AM, Francis <sms@icefire.qza.net.au> wrote:
I came across this accidentally, because of a broken firewall.
I rebooted a Freeswitch server, which came up but failed to load the internal profile. When trying to reload the profile from fs_cli, I got an error message that the stun server was invalid, which wasn't the case, it was just the firewall blocking traffic. Disabling the firewall and restarting the server got everything working again.
This effectively prevents a server from functioning, in the event of having to reboot during an internet outage or if the stun server is temporarily inaccessible. I'd rather the profile load regardless and continue to probe the stun server until it gets a response. Is there any way to set this?
Francis
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
-- ------------------------------------------------------------ Nathan Neulinger nneul@mst.edu Missouri S&T Information Technology (573) 612-1412 [8] System Administrator - Architect
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
Links: ------ [1] http://www.freeswitchsolutions.com [2] http://www.cudatel.com [3] http://www.freeswitch.org [4] http://wiki.freeswitch.org [5] http://www.cluecon.com [6] http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [7] http://lists.freeswitch.org/mailman/options/freeswitch-users [8] tel:%28573%29%20612-1412
I spoke too soon. :( If the stun lookup fails, the profile defaults to the internal address, so running this periodically could result in intermittant failures. I might have a crack at a script - 1. Query the status of the profile 2. Check if the IP is RFC1918 Yes: Start the profile No: Do nothing -Francis On 2014-05-07 17:38, Francis wrote:
Yes, I was thinking something along those lines, thanks!
I did a test, starting the profile when it was already running and it does a stun lookup, which had me wondering what would happen if the lookup failed, so I added a bogus stun server and sure enough, it threw an error, but the profile stayed up regardless. That's pretty much what I was hoping for, so setting up a cron job should do the trick.
Good to know there's a way to make it work if static IP's aren't available.
-Francis
On 2014-05-07 20:13, Steven Ayre wrote:
You could also schedule 'sofia profile <name> start' to run periodically. If the profile is already started it'll do nothing, but if it isn't (eg STUN failed) it'll start it. That way if it fails on boot that command might start it a few minutes later.
But really your issue is with your firewall. On a reboot it should work just fine if your firewall is configured right. It'll only be a issue in the event that your internet link is down during boot.
-Steve
On 7 May 2014 05:23, Ken Rice <krice@freeswitch.org> wrote: you can configure it statically, what mike is talking about, is people behind nat on a dynamic ip
Ken Sent from my iPad
On May 6, 2014, at 22:23, Nathan Neulinger <nneul@mst.edu> wrote:
Isn't that making the assumption that dynamic addressing is required?
Shouldn't he be able to configure that information staticly if he isn't behind a NAT? He doesn't indicate in his message if stun is actually required for his deployment.
-- Nathan
On 05/06/2014 02:10 PM, Michael Jerris wrote: we can't set the profile addresses until we get a stun response, and we can't start the profile listening without that address... so in short, no, no good way to do that.
On May 6, 2014, at 8:46 AM, Francis <sms@icefire.qza.net.au> wrote:
I came across this accidentally, because of a broken firewall.
I rebooted a Freeswitch server, which came up but failed to load the internal profile. When trying to reload the profile from fs_cli, I got an error message that the stun server was invalid, which wasn't the case, it was just the firewall blocking traffic. Disabling the firewall and restarting the server got everything working again.
This effectively prevents a server from functioning, in the event of having to reboot during an internet outage or if the stun server is temporarily inaccessible. I'd rather the profile load regardless and continue to probe the stun server until it gets a response. Is there any way to set this?
Francis
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
-- ------------------------------------------------------------ Nathan Neulinger nneul@mst.edu Missouri S&T Information Technology (573) 612-1412 [8] System Administrator - Architect
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1]
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2]
Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5]
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3]
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com [1] FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com [2] Official FreeSWITCH Sites http://www.freeswitch.org [3] http://wiki.freeswitch.org [4] http://www.cluecon.com [5] FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [6] UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users [7] http://www.freeswitch.org [3] Links: ------ [1] http://www.freeswitchsolutions.com [2] http://www.cudatel.com [3] http://www.freeswitch.org [4] http://wiki.freeswitch.org [5] http://www.cluecon.com [6] http://lists.freeswitch.org/mailman/listinfo/freeswitch-users [7] http://lists.freeswitch.org/mailman/options/freeswitch-users [8] tel:%28573%29%20612-1412
participants (5)
-
Francis
-
Ken Rice
-
Michael Jerris
-
Nathan Neulinger
-
Steven Ayre