SIP NAT CONTRACK Module with Netfilter in kernel 2.4.x

SIP NAT CONTRACK Module with Netfilter in kernel 2.4.x

[Huy Vu Pham]

Dear Netfilter Devel list,
I got problem very strange with Netfilter in linux kernel 2.4.x.

I apply contrack/nat SIP protocol
(http://openwrt.alphacore.net/patches/buildroot/317-netfilter-nat-sip
)  with HELPER module to capture all RTP packets.
(
#Out from WAN site: eth1
iptables -t mangle -A POSTROUTING -o eth1 -p UDP -m helper --helper
sipd00 -j MARK --set-mark 0x20
#Out from LAN site: eth0
iptables -t mangle -A POSTROUTING -o eth0 -p UDP -m helper --helper
sipd00 -j MARK --set-mark 0x21
)

My test case like this:
SIP PHONE A (Outside NAT) ----- NAT BOX (Have SIP ALG) ------- SIP
PHONE B (Inside NAT).

1. Reboot NAT BOX, A call B. SIP MODULE can capture all RTP packets,
Before RTP timeout, I make the call from B to A also OK.

2. Reboot NAT BOX, B call A. SIP MODULE "CAN NOT" capture any RTP packets.
Before RTP timeout, I make the call from A to B also got the same problem.

What is difference between case (1) and case(2)?

I already tested with kernel from 2.4.20 to 2.4.32. The problem is the same.

Thanks,

Re: SIP NAT CONTRACK Module with Netfilter in kernel 2.4.x

[Patrick McHardy]

Huy Vu Pham wrote:
> Dear Netfilter Devel list,
> I got problem very strange with Netfilter in linux kernel 2.4.x.
> 
> I apply contrack/nat SIP protocol
> (http://openwrt.alphacore.net/patches/buildroot/317-netfilter-nat-sip
> )  with HELPER module to capture all RTP packets.
> (
> #Out from WAN site: eth1
> iptables -t mangle -A POSTROUTING -o eth1 -p UDP -m helper --helper
> sipd00 -j MARK --set-mark 0x20
> #Out from LAN site: eth0
> iptables -t mangle -A POSTROUTING -o eth0 -p UDP -m helper --helper
> sipd00 -j MARK --set-mark 0x21
> )
> 
> My test case like this:
> SIP PHONE A (Outside NAT) ----- NAT BOX (Have SIP ALG) ------- SIP
> PHONE B (Inside NAT).
> 
> 1. Reboot NAT BOX, A call B. SIP MODULE can capture all RTP packets,
> Before RTP timeout, I make the call from B to A also OK.
> 
> 2. Reboot NAT BOX, B call A. SIP MODULE "CAN NOT" capture any RTP packets.
> Before RTP timeout, I make the call from A to B also got the same problem.
> 
> What is difference between case (1) and case(2)?

The SIP helper currently only tracks one direction. I wanted to fix
it for some time, but didn't get to it yet.