NAT issue with registration responses going to the wrong port
Hi gang, Got a strange problem with a NAT'd device that's trying to connect to FS. The first REGISTER arrives, without auth, and FS responds with 401 Unauthorized to the correct port on the external IP address of the firewall. However when the second attempt to REGISTER, this time with auth, comes in, FS responds with 200 OK to the local SIP port specified on the device. The device obviously doesn't get the 200 OK so keeps attempting to register. Any ideas? Tried sip-force-contact but that doesn't seem to help. Alex
Sip trace.. TPORT_LOG=1 ./freeswitch On Jul 7, 2008, at 7:46 AM, Alex Kinch wrote:
Hi gang,
Got a strange problem with a NAT'd device that's trying to connect to FS. The first REGISTER arrives, without auth, and FS responds with 401 Unauthorized to the correct port on the external IP address of the firewall. However when the second attempt to REGISTER, this time with auth, comes in, FS responds with 200 OK to the local SIP port specified on the device. The device obviously doesn't get the 200 OK so keeps attempting to register.
Any ideas? Tried sip-force-contact but that doesn't seem to help.
Alex
Brian West sip:brian@freeswitch.org
Certainly.. Here's one I made earlier. Can do a more up to date and in depth one if you want more. recv 411 bytes from udp/[78.105.3.165]:54650 at 11:53:47.177619: REGISTER sip:78.129.213.17 SIP/2.0 Via: SIP/2.0/UDP 192.168.1.14:5060;rport;branch=z9hG4bK-17288995091520442185 From: <sip:1000@78.129.213.17>;tag=14010403471368437451 To: <sip:1000@78.129.213.17> Call-ID: 14569447621195546119@192.168.1.14 CSeq: 1 REGISTER Contact: <sip:1000@192.168.1.14:5060> Max-Forwards: 70 User-Agent: Rainbow R2821 VL[SIP-V3.3] SN/001870300007 Expires: 600 Content-Length: 0 sent 644 bytes to udp/[78.105.3.165]:54650 at 11:53:47.182659: SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 192.168.1.14 : 5060 ;rport=54650;branch=z9hG4bK-17288995091520442185;received=78.105.3.165 recv 661 bytes from udp/[78.105.3.165]:54650 at 11:53:47.515660: REGISTER sip:78.129.213.17 SIP/2.0 Via: SIP/2.0/UDP 192.168.1.14:5060;branch=z9hG4bK343144464537279199 From: <sip:1000@78.129.213.17>;tag=14010403471368437451 To: <sip:1000@78.129.213.17> Call-ID: 14569447621195546119@192.168.1.14 CSeq: 2 REGISTER Contact: <sip:1000@192.168.1.14:5060> Authorization: Digest username="1000", realm="78.129.213.17", nonce="3b442f98-becc-45eb-b079-21b6ce5e657e", uri="sip:78.129.213.17", response="7558e0a1325c375d6921c1be6a701d82", algorithm=MD5, qop=auth, cnonce="234abcc436e2667097e7fe6eia53e8dd", nc=00000001 Max-Forwards: 70 User-Agent: Rainbow R2821 VL[SIP-V3.3] SN/001870300007 Expires: 600 Content-Length: 0 sent 549 bytes to udp/[78.105.3.165]:5060 at 11:53:47.517710: SIP/2.0 200 OK Via: SIP/2.0/UDP 192.168.1.14:5060;branch=z9hG4bK343144464537279199;received=78.105.3.165 On 7 Jul 2008, at 14:44, Brian West wrote:
Sip trace..
TPORT_LOG=1 ./freeswitch
On Jul 7, 2008, at 7:46 AM, Alex Kinch wrote:
Hi gang,
Got a strange problem with a NAT'd device that's trying to connect to FS. The first REGISTER arrives, without auth, and FS responds with 401 Unauthorized to the correct port on the external IP address of the firewall. However when the second attempt to REGISTER, this time with auth, comes in, FS responds with 200 OK to the local SIP port specified on the device. The device obviously doesn't get the 200 OK so keeps attempting to register.
Any ideas? Tried sip-force-contact but that doesn't seem to help.
Alex
Brian West sip:brian@freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Looks like you're running some older configs.. Make sure you have these options on your sip profile: <param name="apply-nat-acl" value="rfc1918"/> <param name="aggressive-nat-detection" value="true"/> And the latest acl.conf.xml installed. Rinse and repeat! /b On Jul 7, 2008, at 8:58 AM, Alex Kinch wrote:
Certainly.. Here's one I made earlier. Can do a more up to date and in depth one if you want more.
Brian West sip:brian@freeswitch.org
I thought that may be the case, which is why last week I wiped my dev box and started again :) Aggressive nat detection is in the internal.xml profile, as is apply- nat-acl. the relevent section of acl.conf.xml is: <list name="rfc1918" default="deny"> <node type="allow" cidr="10.0.0.0/8"/> <node type="allow" cidr="172.16.0.0/12"/> <node type="allow" cidr="192.168.0.0/16"/> </list> So it's all like it should be. What I can't figure out is how come FS manages to get the reply to one of the registers through to the right port but the second one goes completely wrong? Incidently if I map 5060 on the external IP through to port 5060 on the device's internal IP it works fine, but that's not quite the point :) Alex On 7 Jul 2008, at 15:10, Brian West wrote:
Looks like you're running some older configs..
Make sure you have these options on your sip profile:
<param name="apply-nat-acl" value="rfc1918"/> <param name="aggressive-nat-detection" value="true"/>
And the latest acl.conf.xml installed.
Rinse and repeat!
/b
On Jul 7, 2008, at 8:58 AM, Alex Kinch wrote:
Certainly.. Here's one I made earlier. Can do a more up to date and in depth one if you want more.
Brian West sip:brian@freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi again Brian, As per our IRC chat I've taken a full sip trace and chucked it on pastebin: http://pastebin.freeswitch.org/4752 Port 6666 is set in the device as it's local SIP port, and it appears although FS manages to send 401 to the right port in response to the REGISTER without any auth it screws up after that. Thanks, Alex On 7 Jul 2008, at 15:10, Brian West wrote:
Looks like you're running some older configs..
Make sure you have these options on your sip profile:
<param name="apply-nat-acl" value="rfc1918"/> <param name="aggressive-nat-detection" value="true"/>
And the latest acl.conf.xml installed.
Rinse and repeat!
/b
On Jul 7, 2008, at 8:58 AM, Alex Kinch wrote:
Certainly.. Here's one I made earlier. Can do a more up to date and in depth one if you want more.
Brian West sip:brian@freeswitch.org
_______________________________________________ Freeswitch-users mailing list Freeswitch-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
For the sake of our Archives the first register has the rport option in the via. The second register after the 401 doesn't have rport thats why its sending to the wrong port. Your phone is broken but you can fix it with NDLB-force-rport=true on the sip profile. Which might break interop with some other phones... you're better off having a "broken_rport" profile then making the busted phones register to that profile. /b On Jul 7, 2008, at 11:07 AM, Alex Kinch wrote:
Hi again Brian,
As per our IRC chat I've taken a full sip trace and chucked it on pastebin: http://pastebin.freeswitch.org/4752
Port 6666 is set in the device as it's local SIP port, and it appears although FS manages to send 401 to the right port in response to the REGISTER without any auth it screws up after that.
Thanks, Alex
Brian West sip:brian@freeswitch.org
participants (2)
-
Alex Kinch
-
Brian West