Issue with changing phone SIP port
Hi guys, I ran into the following problem recently: Using a softphone from a computer behind a NAT I register it with FreeSWITCH. It registers with a certain port in the Contact header. FreeSWITCH stores this port in the user's registration info and uses it from then on to send messages to the phone. However, for some reason FreeSWITCH initially sends back an "Unauthorized" response. After that some phones seem to send REGISTER again but with a*different port *. This only happen if the phone is behind a NAT. If FreeSWITCH is on the same network as the phone, the phone keeps the same port. FreeSWITCH ignores that and keeps trying to contact the phone on the old port and of course fails. Only some phones seem to change their port after registration. They include 3CXPhone, X-Lite. Phones that don't do this are MicroSIP and Mizu. I have a wireshark capture file of the session from the softphone machine if anyone would like, I'll be happy to email it or publish it. So, I have three questions: 1. Why does FreeSWITCH initially send "Unauthorized" reply? 2. Does anyone know why some phones change their port during registration from behind a NAT? 3. Should I file a Jira ticket to have FreeSWITCH change UA's registered contact info when the UA sends a message with a different Contact header? Thank you *Oleg*
Hi， Try add ‘sip-force-contact’ to your user <variable name="sip-force-contact" value="NDLB-connectile-dysfunction"/> Spring He . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Polylink Holdings, Inc. 391 Guiping Road, STE701, Tower B New Cao He Jing Int'I Business Center Shanghai, 200233 China Main +86.21.5465.6777 ext. 654 Fax +86.21.5465.4222 Email spring.he@polylink.net<mailto:robert@polylink.net> 发件人: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] 代表 Oleg Stolyar 发送时间: 2013年6月4日 4:32 收件人: FreeSWITCH Users Help 主题: [Freeswitch-users] Issue with changing phone SIP port Hi guys, I ran into the following problem recently: Using a softphone from a computer behind a NAT I register it with FreeSWITCH. It registers with a certain port in the Contact header. FreeSWITCH stores this port in the user's registration info and uses it from then on to send messages to the phone. However, for some reason FreeSWITCH initially sends back an "Unauthorized" response. After that some phones seem to send REGISTER again but with a different port. This only happen if the phone is behind a NAT. If FreeSWITCH is on the same network as the phone, the phone keeps the same port. FreeSWITCH ignores that and keeps trying to contact the phone on the old port and of course fails. Only some phones seem to change their port after registration. They include 3CXPhone, X-Lite. Phones that don't do this are MicroSIP and Mizu. I have a wireshark capture file of the session from the softphone machine if anyone would like, I'll be happy to email it or publish it. So, I have three questions: 1. Why does FreeSWITCH initially send "Unauthorized" reply? 2. Does anyone know why some phones change their port during registration from behind a NAT? 3. Should I file a Jira ticket to have FreeSWITCH change UA's registered contact info when the UA sends a message with a different Contact header? Thank you Oleg
1. Why does FreeSWITCH initially send "Unauthorized" reply?
It's required. SIP authentication is similar to HTTP authentication, it's based on challenge response. The first request fails and the response contains a nonce. The 2nd request sends a digest of the password combined with that nonce. That means you authenticate without sending your password over the internet plaintext and since the nonce is time-limited without that digest being able to be reused by an attacker. If you see yourself calling into FS without that then you are either a) authenticating via IP address not password or b) calling into a SIP profile that doesn't require authentication (eg one for receiving calls). 2. Does anyone know why some phones change their port during registration
from behind a NAT?
That could be your NAT router changing the port mapping between requests (each REGISTER and INVITE is a separate SIP dialog). SIP with NAT can work, but will be messy. Mostly because not everything supports it, supports it well, or does it in the same way. You can also encounter situations where the phone and router are both trying to workaround the NAT issues which causes more problems than it solves. Generally FS does a good job of working around many of the issues, and has a few NDLB options for handling devices that don't handle NAT well. See http://wiki.freeswitch.org/wiki/NAT_Traversal For starters you should disable SIP ALG on your router and enable STUN in the SIP client, if it's supported. 3. Should I file a Jira ticket to have FreeSWITCH change UA's registered
contact info when the UA sends a message with a different Contact header?
But what would it change it to? For handling broken devices there are some NDLB options, some do try rewriting the Contact to where the packet came from. That's not correct in all cases, but perhaps is in many. http://wiki.freeswitch.org/wiki/NDLB -Steve On 3 June 2013 21:32, Oleg Stolyar <ostolyar@netflix.com> wrote:
Hi guys,
I ran into the following problem recently:
Using a softphone from a computer behind a NAT I register it with FreeSWITCH. It registers with a certain port in the Contact header. FreeSWITCH stores this port in the user's registration info and uses it from then on to send messages to the phone.
However, for some reason FreeSWITCH initially sends back an "Unauthorized" response. After that some phones seem to send REGISTER again but with a*different port *. This only happen if the phone is behind a NAT. If FreeSWITCH is on the same network as the phone, the phone keeps the same port.
FreeSWITCH ignores that and keeps trying to contact the phone on the old port and of course fails.
Only some phones seem to change their port after registration. They include 3CXPhone, X-Lite. Phones that don't do this are MicroSIP and Mizu.
I have a wireshark capture file of the session from the softphone machine if anyone would like, I'll be happy to email it or publish it.
So, I have three questions: 1. Why does FreeSWITCH initially send "Unauthorized" reply? 2. Does anyone know why some phones change their port during registration from behind a NAT? 3. Should I file a Jira ticket to have FreeSWITCH change UA's registered contact info when the UA sends a message with a different Contact header?
Thank you *Oleg*
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Steven, thank you for the detailed response! I'll check out NDLB and look further into how the ports are changing. The strange thing is that it happens with some but not all softphones and that the message going to the wrong port nevertheless gets to my computer through the router and is only rejected here - rather than in the router. This is evidenced by wireshark running on my computer. I'll let you know if I find anything useful after investigating further. Thanks again! Thank you *Oleg* On Mon, Jun 3, 2013 at 8:57 PM, Steven Ayre <steveayre@gmail.com> wrote:
1. Why does FreeSWITCH initially send "Unauthorized" reply?
It's required. SIP authentication is similar to HTTP authentication, it's based on challenge response. The first request fails and the response contains a nonce. The 2nd request sends a digest of the password combined with that nonce. That means you authenticate without sending your password over the internet plaintext and since the nonce is time-limited without that digest being able to be reused by an attacker.
If you see yourself calling into FS without that then you are either a) authenticating via IP address not password or b) calling into a SIP profile that doesn't require authentication (eg one for receiving calls).
2. Does anyone know why some phones change their port during registration
from behind a NAT?
That could be your NAT router changing the port mapping between requests (each REGISTER and INVITE is a separate SIP dialog).
SIP with NAT can work, but will be messy. Mostly because not everything supports it, supports it well, or does it in the same way. You can also encounter situations where the phone and router are both trying to workaround the NAT issues which causes more problems than it solves.
Generally FS does a good job of working around many of the issues, and has a few NDLB options for handling devices that don't handle NAT well. See http://wiki.freeswitch.org/wiki/NAT_Traversal
For starters you should disable SIP ALG on your router and enable STUN in the SIP client, if it's supported.
3. Should I file a Jira ticket to have FreeSWITCH change UA's registered
contact info when the UA sends a message with a different Contact header?
But what would it change it to?
For handling broken devices there are some NDLB options, some do try rewriting the Contact to where the packet came from. That's not correct in all cases, but perhaps is in many. http://wiki.freeswitch.org/wiki/NDLB
-Steve
On 3 June 2013 21:32, Oleg Stolyar <ostolyar@netflix.com> wrote:
Hi guys,
I ran into the following problem recently:
Using a softphone from a computer behind a NAT I register it with FreeSWITCH. It registers with a certain port in the Contact header. FreeSWITCH stores this port in the user's registration info and uses it from then on to send messages to the phone.
However, for some reason FreeSWITCH initially sends back an "Unauthorized" response. After that some phones seem to send REGISTER again but with a* different port*. This only happen if the phone is behind a NAT. If FreeSWITCH is on the same network as the phone, the phone keeps the same port.
FreeSWITCH ignores that and keeps trying to contact the phone on the old port and of course fails.
Only some phones seem to change their port after registration. They include 3CXPhone, X-Lite. Phones that don't do this are MicroSIP and Mizu.
I have a wireshark capture file of the session from the softphone machine if anyone would like, I'll be happy to email it or publish it.
So, I have three questions: 1. Why does FreeSWITCH initially send "Unauthorized" reply? 2. Does anyone know why some phones change their port during registration from behind a NAT? 3. Should I file a Jira ticket to have FreeSWITCH change UA's registered contact info when the UA sends a message with a different Contact header?
Thank you *Oleg*
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On Jun 3, 2013, at 11:57 PM, Steven Ayre <steveayre@gmail.com> wrote:
1. Why does FreeSWITCH initially send "Unauthorized" reply?
It's required. SIP authentication is similar to HTTP authentication, it's based on challenge response. The first request fails and the response contains a nonce. The 2nd request sends a digest of the password combined with that nonce. That means you authenticate without sending your password over the internet plaintext and since the nonce is time-limited without that digest being able to be reused by an attacker.
If you see yourself calling into FS without that then you are either a) authenticating via IP address not password or b) calling into a SIP profile that doesn't require authentication (eg one for receiving calls).
This is not 100% correct. If the other end already has a nonce, it can send the auth headers in the request and not be challenged.
2. Does anyone know why some phones change their port during registration from behind a NAT?
That could be your NAT router changing the port mapping between requests (each REGISTER and INVITE is a separate SIP dialog).
SIP with NAT can work, but will be messy. Mostly because not everything supports it, supports it well, or does it in the same way. You can also encounter situations where the phone and router are both trying to workaround the NAT issues which causes more problems than it solves.
Generally FS does a good job of working around many of the issues, and has a few NDLB options for handling devices that don't handle NAT well. See http://wiki.freeswitch.org/wiki/NAT_Traversal
For starters you should disable SIP ALG on your router and enable STUN in the SIP client, if it's supported.
3. Should I file a Jira ticket to have FreeSWITCH change UA's registered contact info when the UA sends a message with a different Contact header?
But what would it change it to?
For handling broken devices there are some NDLB options, some do try rewriting the Contact to where the packet came from. That's not correct in all cases, but perhaps is in many. http://wiki.freeswitch.org/wiki/NDLB
-Steve
I have noticed the same behaviour on behind-nat devices. It really is the router's causing the mess here. There are 2 workarounds - the nldb way with the connectile disfunction( this breaks at least one thing - SIMPLE messaging) and decreasing the session timers or the keepalives to the UAs. This will keep the portholes in tact. Both have pros and cons. And i still would suggest leaving stun enabled. On Jun 4, 2013 9:28 PM, "Michael Jerris" <mike@jerris.com> wrote:
On Jun 3, 2013, at 11:57 PM, Steven Ayre <steveayre@gmail.com> wrote:
1. Why does FreeSWITCH initially send "Unauthorized" reply?
It's required. SIP authentication is similar to HTTP authentication, it's based on challenge response. The first request fails and the response contains a nonce. The 2nd request sends a digest of the password combined with that nonce. That means you authenticate without sending your password over the internet plaintext and since the nonce is time-limited without that digest being able to be reused by an attacker.
If you see yourself calling into FS without that then you are either a) authenticating via IP address not password or b) calling into a SIP profile that doesn't require authentication (eg one for receiving calls).
This is not 100% correct. If the other end already has a nonce, it can send the auth headers in the request and not be challenged.
2. Does anyone know why some phones change their port during registration
from behind a NAT?
That could be your NAT router changing the port mapping between requests (each REGISTER and INVITE is a separate SIP dialog).
SIP with NAT can work, but will be messy. Mostly because not everything supports it, supports it well, or does it in the same way. You can also encounter situations where the phone and router are both trying to workaround the NAT issues which causes more problems than it solves.
Generally FS does a good job of working around many of the issues, and has a few NDLB options for handling devices that don't handle NAT well. See http://wiki.freeswitch.org/wiki/NAT_Traversal
For starters you should disable SIP ALG on your router and enable STUN in the SIP client, if it's supported.
3. Should I file a Jira ticket to have FreeSWITCH change UA's registered
contact info when the UA sends a message with a different Contact header?
But what would it change it to?
For handling broken devices there are some NDLB options, some do try rewriting the Contact to where the packet came from. That's not correct in all cases, but perhaps is in many. http://wiki.freeswitch.org/wiki/NDLB
-Steve
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
But why would the *softphone* change the port it's using as the *source* in the middle of the registration? This is based on wireshark data running on the phone's computer. Thank you *Oleg* On Tue, Jun 4, 2013 at 2:47 PM, Daniel Ivanov <sertys@gmail.com> wrote:
I have noticed the same behaviour on behind-nat devices. It really is the router's causing the mess here. There are 2 workarounds - the nldb way with the connectile disfunction( this breaks at least one thing - SIMPLE messaging) and decreasing the session timers or the keepalives to the UAs. This will keep the portholes in tact. Both have pros and cons. And i still would suggest leaving stun enabled. On Jun 4, 2013 9:28 PM, "Michael Jerris" <mike@jerris.com> wrote:
On Jun 3, 2013, at 11:57 PM, Steven Ayre <steveayre@gmail.com> wrote:
1. Why does FreeSWITCH initially send "Unauthorized" reply?
It's required. SIP authentication is similar to HTTP authentication, it's based on challenge response. The first request fails and the response contains a nonce. The 2nd request sends a digest of the password combined with that nonce. That means you authenticate without sending your password over the internet plaintext and since the nonce is time-limited without that digest being able to be reused by an attacker.
If you see yourself calling into FS without that then you are either a) authenticating via IP address not password or b) calling into a SIP profile that doesn't require authentication (eg one for receiving calls).
This is not 100% correct. If the other end already has a nonce, it can send the auth headers in the request and not be challenged.
2. Does anyone know why some phones change their port during registration
from behind a NAT?
That could be your NAT router changing the port mapping between requests (each REGISTER and INVITE is a separate SIP dialog).
SIP with NAT can work, but will be messy. Mostly because not everything supports it, supports it well, or does it in the same way. You can also encounter situations where the phone and router are both trying to workaround the NAT issues which causes more problems than it solves.
Generally FS does a good job of working around many of the issues, and has a few NDLB options for handling devices that don't handle NAT well. See http://wiki.freeswitch.org/wiki/NAT_Traversal
For starters you should disable SIP ALG on your router and enable STUN in the SIP client, if it's supported.
3. Should I file a Jira ticket to have FreeSWITCH change UA's registered
contact info when the UA sends a message with a different Contact header?
But what would it change it to?
For handling broken devices there are some NDLB options, some do try rewriting the Contact to where the packet came from. That's not correct in all cases, but perhaps is in many. http://wiki.freeswitch.org/wiki/NDLB
-Steve
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
"decreasing the session timers or the keepalives to the UAs" That definitely suggests that the issue is the NAT router losing its port mapping and assigning a new one. Keepalives are one way to force it to stay open. Explicit port mapping or UPnP may be another. -Steve On 4 June 2013 22:47, Daniel Ivanov <sertys@gmail.com> wrote:
I have noticed the same behaviour on behind-nat devices. It really is the router's causing the mess here. There are 2 workarounds - the nldb way with the connectile disfunction( this breaks at least one thing - SIMPLE messaging) and decreasing the session timers or the keepalives to the UAs. This will keep the portholes in tact. Both have pros and cons. And i still would suggest leaving stun enabled. On Jun 4, 2013 9:28 PM, "Michael Jerris" <mike@jerris.com> wrote:
On Jun 3, 2013, at 11:57 PM, Steven Ayre <steveayre@gmail.com> wrote:
1. Why does FreeSWITCH initially send "Unauthorized" reply?
It's required. SIP authentication is similar to HTTP authentication, it's based on challenge response. The first request fails and the response contains a nonce. The 2nd request sends a digest of the password combined with that nonce. That means you authenticate without sending your password over the internet plaintext and since the nonce is time-limited without that digest being able to be reused by an attacker.
If you see yourself calling into FS without that then you are either a) authenticating via IP address not password or b) calling into a SIP profile that doesn't require authentication (eg one for receiving calls).
This is not 100% correct. If the other end already has a nonce, it can send the auth headers in the request and not be challenged.
2. Does anyone know why some phones change their port during registration
from behind a NAT?
That could be your NAT router changing the port mapping between requests (each REGISTER and INVITE is a separate SIP dialog).
SIP with NAT can work, but will be messy. Mostly because not everything supports it, supports it well, or does it in the same way. You can also encounter situations where the phone and router are both trying to workaround the NAT issues which causes more problems than it solves.
Generally FS does a good job of working around many of the issues, and has a few NDLB options for handling devices that don't handle NAT well. See http://wiki.freeswitch.org/wiki/NAT_Traversal
For starters you should disable SIP ALG on your router and enable STUN in the SIP client, if it's supported.
3. Should I file a Jira ticket to have FreeSWITCH change UA's registered
contact info when the UA sends a message with a different Contact header?
But what would it change it to?
For handling broken devices there are some NDLB options, some do try rewriting the Contact to where the packet came from. That's not correct in all cases, but perhaps is in many. http://wiki.freeswitch.org/wiki/NDLB
-Steve
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
There's am entire chapter of the FreeSWITCH 1.2 book dedicated to NAT/PAT... it might be worth the investment for you to pick up a copy. The e version is pretty affordable and gets delivered very fast ;-) -Ray On Jun 3, 2013 4:40 PM, "Oleg Stolyar" <ostolyar@netflix.com> wrote:
Hi guys,
I ran into the following problem recently:
Using a softphone from a computer behind a NAT I register it with FreeSWITCH. It registers with a certain port in the Contact header. FreeSWITCH stores this port in the user's registration info and uses it from then on to send messages to the phone.
However, for some reason FreeSWITCH initially sends back an "Unauthorized" response. After that some phones seem to send REGISTER again but with a*different port *. This only happen if the phone is behind a NAT. If FreeSWITCH is on the same network as the phone, the phone keeps the same port.
FreeSWITCH ignores that and keeps trying to contact the phone on the old port and of course fails.
Only some phones seem to change their port after registration. They include 3CXPhone, X-Lite. Phones that don't do this are MicroSIP and Mizu.
I have a wireshark capture file of the session from the softphone machine if anyone would like, I'll be happy to email it or publish it.
So, I have three questions: 1. Why does FreeSWITCH initially send "Unauthorized" reply? 2. Does anyone know why some phones change their port during registration from behind a NAT? 3. Should I file a Jira ticket to have FreeSWITCH change UA's registered contact info when the UA sends a message with a different Contact header?
Thank you *Oleg*
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (6)
-
Daniel Ivanov
-
Michael Jerris
-
Oleg Stolyar
-
Raymond Chandler
-
Steven Ayre
-
何小春Spring