From: Erik Schorr <erik-lists@arpa.org>
To: cc <cc@kdtc.net>
Cc: netfilter@vger.kernel.org
Subject: Re: SIP 5060 traffic
Date: Tue, 31 May 2011 08:39:18 -0700 [thread overview]
Message-ID: <4DE50BA6.3030609@arpa.org> (raw)
In-Reply-To: <20110531090945.M97668@kdtc.net>
For proper nat of SIP/RTP traffic, you'll probably need to load the
ip_conntrack_sip (now nf_conntrack_sip) and ip_nat_sip (nf_nat_sip)
modules, as well as have the following rules at the top of your INPUT
and FORWARD chains to permit all traffic related to tracked SIP sessions:
$ipt -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$ipt -I FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
The SIP conntrack module will track sessions on 5060/udp and enable
related return and RTP traffic through the firewall. the SIP nat module
should properly translate the addresses/ports in the SIP headers as they
traverse the firewall, based on how the packets get forwarded.
On 05/31/2011 02:17 AM, cc wrote:
> Hi,
>
> I have a LAN NET and a DMZ NET. I have a SIP phone within the LAN
> trying to connect to a proxy at an external site, say A.
>
> Can someone point out if I'm missing anything?
>
> Rules:
>
> $IPT -A FORWARD -o $INET_ETH -p udp --dport 5060 -j ACCEPT
> $IPT -t nat -A POSTROUTING -o $INET_ETH -p udp --dport 5060 \
> -j SNAT --to-source $INET_IP
>
> When I do a tcpdump, I can see traffic from the LAN go through my
> bastion Firewall that routes to my external-facing firewall.
> But there is no traffic coming back from the outside.
>
> 17:05:19.831000 IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto:
> UDP (17), length: 367) LAN_IP.5060> A_SITE.5060: SIP, length: 339
>
> There's no corresponding entry that has traffic going the other way:
> i.e.:
>
> IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto: UDP (17),
> length: 367) A_SITE.5060> LAN_IP.5060: SIP, length: 339
>
> I'm a bit confused. Any clarifications appreciated.
>
> Thanks
>
> Ed
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Erik Schorr KD6AUT
Advocate and Consultant
VMware/Iptables/Exim/Perl
prev parent reply other threads:[~2011-05-31 15:39 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-05-31 9:17 SIP 5060 traffic cc
2011-05-31 14:55 ` Usuário do Sistema
2011-05-31 15:39 ` Erik Schorr [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DE50BA6.3030609@arpa.org \
--to=erik-lists@arpa.org \
--cc=cc@kdtc.net \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.