Freeswitch as STUN server?
Hello To solve the issue of opening UDP ports dynamically on the firewall that protects a remote SIP client located elsewhere on the Net, the most used solution is to have the client use STUN to open UDP ports, learn its public IP address, and then re-use those UDP ports to register with the IP PBX and let SIP/RTP packets in through the firewall. While not actively handing calls, STUN-capable SIP clients send keep-alive datagrams regularly to keep the UDP ports open on their firewall. Unfortunately, symmetric NAT firewalls don't allow re-using UDP ports to work with another host. So I was wondering if Freeswitch could run as STUN server or if someone knew of a good open-source STUN server that I could install on the same host as the Freeswitch server? http://img545.imageshack.us/img545/3580/ippbxstun.png Would this solve the issue? If not, I guess the alternatives are trying UPnP, NAT-PMP, or IAX, and if all else fails, running OpenVPN and configure both end-points to pass all SIP/RTP packets through this TCP tunnel. Thank you for any feedback. -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Freeswitch-as-STUN-server-tp57... Sent from the freeswitch-users mailing list archive at Nabble.com.
On 4 November 2010 02:15, GillesToo <codecomplete@free.fr> wrote:
So I was wondering if Freeswitch could run as STUN server or if someone knew of a good open-source STUN server that I could install on the same host as the Freeswitch server?
Debian has this package: scrooge:~# apt-cache show stun Package: stun Priority: optional Section: net Installed-Size: 176 Maintainer: Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org> Architecture: i386 Version: 0.96.dfsg-5 Depends: libc6 (>= 2.6-1), libgcc1 (>= 1:4.2-20070516), libstdc++6 (>= 4.2-20070516) Filename: pool/main/s/stun/stun_0.96.dfsg-5_i386.deb Size: 41292 MD5sum: b8d9baaddbaf74016b6a0af3bdfd8545 SHA1: 8675d417af0e2d9076e91e46a82a99e3e728d45e SHA256: ccb8fc9ad634b2ff98ebcc5d97eb2864df8a1c634109ef2fb641a7d2a2fb3a34 Description: Server daemon and test client for STUN The STUN protocol (Simple Traversal of UDP through NATs) is described in the IETF RFC 3489, available at http://www.ietf.org/rfc/rfc3489.txt. It's used to help clients behind NAT to tunnel incoming calls through. This server is the counterpart to help the client identify the NAT and have it open the proper ports for it. . Homepage: http://www.vovida.org/applications/downloads/stun/ Tag: interface::commandline, interface::daemon, network::{client,server,service,vpn}, protocol::{ip,udp,voip}, role::program, scope::utility, use::transmission === cut === Unfortunately the version in Debian/lenny seems to have this brain dead assumption that you want it to bind to exactly two different IP addresses (for increased reliability or something). I don't have any additional public IPv4 addresses to spare. At least that was the problem I encountered when I installed it before. I might have been doing something wrong. Also the home page mentioned above is useless. -- Brian May <brian@microcomaustralia.com.au>
The two IPs are necessary to determine if this is a full-cone nat or not. From the RFC: To determine if it's behind a full-cone NAT, the client can send a STUN Binding Request with flags that tell the STUN server to send a response from a different IP address and port than the request was received on. In other words, if the client sent a Binding Request to IP address/port A/B using a source IP address/port of X/Y, the STUN server would send the Binding Response to X/Y using source IP address/port C/D. If the client receives this response, it knows it is behind a full cone NAT. I guess it isn't strictly required, but you won't be able to support all stun requests and nat topologies if only bound to 1 public IP. On Wed, Nov 3, 2010 at 7:02 PM, Brian May <brian@microcomaustralia.com.au>wrote:
On 4 November 2010 02:15, GillesToo <codecomplete@free.fr> wrote:
So I was wondering if Freeswitch could run as STUN server or if someone knew of a good open-source STUN server that I could install on the same host as the Freeswitch server?
Debian has this package:
scrooge:~# apt-cache show stun Package: stun Priority: optional Section: net Installed-Size: 176 Maintainer: Debian VoIP Team <pkg-voip-maintainers@lists.alioth.debian.org
Architecture: i386 Version: 0.96.dfsg-5 Depends: libc6 (>= 2.6-1), libgcc1 (>= 1:4.2-20070516), libstdc++6 (>= 4.2-20070516) Filename: pool/main/s/stun/stun_0.96.dfsg-5_i386.deb Size: 41292 MD5sum: b8d9baaddbaf74016b6a0af3bdfd8545 SHA1: 8675d417af0e2d9076e91e46a82a99e3e728d45e SHA256: ccb8fc9ad634b2ff98ebcc5d97eb2864df8a1c634109ef2fb641a7d2a2fb3a34 Description: Server daemon and test client for STUN The STUN protocol (Simple Traversal of UDP through NATs) is described in the IETF RFC 3489, available at http://www.ietf.org/rfc/rfc3489.txt. It's used to help clients behind NAT to tunnel incoming calls through. This server is the counterpart to help the client identify the NAT and have it open the proper ports for it. . Homepage: http://www.vovida.org/applications/downloads/stun/ Tag: interface::commandline, interface::daemon, network::{client,server,service,vpn}, protocol::{ip,udp,voip}, role::program, scope::utility, use::transmission
=== cut ===
Unfortunately the version in Debian/lenny seems to have this brain dead assumption that you want it to bind to exactly two different IP addresses (for increased reliability or something). I don't have any additional public IPv4 addresses to spare.
At least that was the problem I encountered when I installed it before. I might have been doing something wrong.
Also the home page mentioned above is useless. -- Brian May <brian@microcomaustralia.com.au>
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -Rupa
Thanks guys for the infos. Actually, after posting, I figured that running the STUN server and Freeswitch on the same server is not the magical solution I though it was, since a symmetric NAT firewall will also prevent reusing a UDP port if the remote port is different (which it would, one to send datagrams to the STUN server, and another port to send datagrams to Freeswitch). I've searched for a Windows GUI STUN client so the user could first run this to check what type of firewall he has, but didn't find any. Vovida's http://sourceforge.net/projects/stun/ STUN client is command-line, and the http://sofia-sip.sourceforge.net/ Sofia project doesn't offer binaries, much less Windows binaries. Maybe there are STUN servers out there that display results on a web page? I'll read up on the alternatives to make SIP work even with symmetrical NAT firewalls. Thank you. -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Freeswitch-as-STUN-server-tp57... Sent from the freeswitch-users mailing list archive at Nabble.com.
participants (3)
-
Brian May
-
GillesToo
-
Rupa Schomaker