nate-mode -nonat apply-nat-acl documentation
OK -nonat turns off NAT detection, but I don't know if this applies to external SIP clients behind NAT? =============================================================================================== There are clearly 2 separate cases where NAT detection may be needed and some way to enable each one independent of the other. =============================================================================================== The following explores my confusion: apply-nat-acl If value is rfc1918 enable 'nat-mode' if IP matches - OK but what exactly is nat-mode? And what is value="nat.auto" ? How does it relate to auto-nat? Does any of this do anything if I'm running with -nonat ? Is running with -nonat the opposite of nat-mode? nat-mode could mean several things and I can't find it defined anywhere. There is also -nonatmap which allows NAT detection but avoids UPnP/NAT-PMP In my situation, I have FS situated behind a firewall and have the proper ports DNATed. I'm running with -nonat and this works, and should not create any problems. BUT there could be situations where I am out of town and need to connect to the server from behind some NAT that I have no control over. Thus there are two separate situations that might want NAT detection - FS behind NAT and a SIP client behind NAT. ext-rtp-ip, ext-sip-ip, rtp-ip, and sip-ip Should tell FS what it needs to know about the server end - but I'm not finding clarity on what a sane setup would be for the possibility of an external SIP client behind NAT. ,.,. I think the best way to document this is to come up with a few scenarios and show a sane set up for each one. We can assume in all cases that phones on both sides of NAT need to register and if the server is on the LAN side of a NAT there could be need for a double transit of NAT. 1 - FS server on a LAN with ports DNATed by firewall - static IP - Phones on LAN and phones registering from Internet 2 - FS on public IP by phones on the other side of a NAT firewall need to register as well as phones on bare internet 3 - FS server on LAN with firewall on dynamic IP 4 - Just so we are on the same page: DNAT (Destination network address translation) DNAT is a technique for transparently changing the destination IP address of an en route packet and performing the inverse function for any replies. This use of DNAT is also called port forwarding. I'm trying to document this for myself and finding it similar to walking in a swamp each step is getting me bogged down. -------------------------------------------------------------------------------- Karl Schmidt EMail Karl@xtronics.com Transtronics, Inc. WEB http://secure.transtronics.com 3209 West 9th Street Ph (785) 841-3089 Lawrence, KS 66049 FAX (785) 841-0434 Inflation is taxation without legislation. Milton Friedman --------------------------------------------------------------------------------
Karl, I agree with you on the documentation part. Unfortunately, I'm not able to give you the answers. I had difficulties getting my own setup working when I was changing my setup (included a vpn). In the end I figured it out myself with wireshark, but the documentation is (at least to me) not that clear on the subject. Maybe because of two reasons: [1] The average FS user has already a fair amount of knowledge on the subject; [2] The average FS user has the same kind of setup, which is documented enough. -- EL
On 08/20/2013 06:30 PM, EL wrote:
Karl,
I agree with you on the documentation part. Unfortunately, I'm not able to give you the answers. I had difficulties getting my own setup working when I was changing my setup (included a vpn). In the end I figured it out myself with wireshark, but the documentation is (at least to me) not that clear on the subject.
Maybe because of two reasons: [1] The average FS user has already a fair amount of knowledge on the subject; [2] The average FS user has the same kind of setup, which is documented enough.
I'm not complaining - This is some complex code and it could be very hard for those closest to it to document it. (Hard to see the forest for all the trees in the way). The bit that I can't figure out is what controls the two cases of NAT helpers (server end vs client behind NAT ). I could be that I should turn all the NAT stuff off - most of the SIP clients can do stun or other tricks to get past NAT. If I could just get some of the FS terms defined and know if using the nat parameters turns any of this on or off, I could even write it up. I've been searching the mailing list with: http://www.google.com/search?q=site:lists.freeswitch.org%2Fpipermail%2Ffrees... but I'm not making much progress. -------------------------------------------------------------------------------- Karl Schmidt EMail Karl@xtronics.com Transtronics, Inc. WEB http://secure.transtronics.com 3209 West 9th Street Ph (785) 841-3089 Lawrence, KS 66049 FAX (785) 841-0434 Truth is mighty and will prevail. There is nothing wrong with this, except that it ain't so. --Mark Twain --------------------------------------------------------------------------------
participants (2)
-
EL
-
Karl Schmidt