SIP 5060 traffic

SIP 5060 traffic

[cc]

Hi,

I have a LAN NET  and a DMZ NET.  I have a SIP phone within the LAN
trying to connect to a proxy at an external site, say A.

Can someone point out if I'm missing anything?  

Rules:

$IPT -A FORWARD -o $INET_ETH -p udp --dport 5060 -j ACCEPT
$IPT -t nat -A POSTROUTING -o $INET_ETH -p udp --dport 5060 \
             -j SNAT --to-source $INET_IP

When I do a tcpdump, I can see traffic from the LAN go through my
bastion Firewall that routes to my external-facing firewall.
But there is no traffic coming back from the outside.

17:05:19.831000 IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto:
UDP (17), length: 367) LAN_IP.5060 > A_SITE.5060: SIP, length: 339

There's no corresponding entry that has traffic going the other way: 
i.e.:

IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto: UDP (17),
length: 367) A_SITE.5060 > LAN_IP.5060: SIP, length: 339

I'm a bit confused.  Any clarifications appreciated.

Thanks

Ed

Re: SIP 5060 traffic

[Usuário do Sistema]

I think you have talk with other side ( support at the SIP Server
issue ). you can ask about the packages arriving on SIP server.

you can look in log too to more details about packages drops.


as it's UDP connection try:

$IPT -A FORWARD -i $INET_ETH -p udp --sport 5060 -j ACCEPT



good luck










2011/5/31 cc <cc@kdtc.net>:
> Hi,
>
> I have a LAN NET  and a DMZ NET.  I have a SIP phone within the LAN
> trying to connect to a proxy at an external site, say A.
>
> Can someone point out if I'm missing anything?
>
> Rules:
>
> $IPT -A FORWARD -o $INET_ETH -p udp --dport 5060 -j ACCEPT
> $IPT -t nat -A POSTROUTING -o $INET_ETH -p udp --dport 5060 \
>             -j SNAT --to-source $INET_IP
>
> When I do a tcpdump, I can see traffic from the LAN go through my
> bastion Firewall that routes to my external-facing firewall.
> But there is no traffic coming back from the outside.
>
> 17:05:19.831000 IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto:
> UDP (17), length: 367) LAN_IP.5060 > A_SITE.5060: SIP, length: 339
>
> There's no corresponding entry that has traffic going the other way:
> i.e.:
>
> IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto: UDP (17),
> length: 367) A_SITE.5060 > LAN_IP.5060: SIP, length: 339
>
> I'm a bit confused.  Any clarifications appreciated.
>
> Thanks
>
> Ed
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: SIP 5060 traffic

[Erik Schorr]

For proper nat of SIP/RTP traffic, you'll probably need to load the 
ip_conntrack_sip (now nf_conntrack_sip) and ip_nat_sip (nf_nat_sip) 
modules, as well as have the following rules at the top of your INPUT 
and FORWARD chains to permit all traffic related to tracked SIP sessions:

$ipt -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$ipt -I FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

The SIP conntrack module will track sessions on 5060/udp and enable 
related return and RTP traffic through the firewall.  the SIP nat module 
should properly translate the addresses/ports in the SIP headers as they 
traverse the firewall, based on how the packets get forwarded.

On 05/31/2011 02:17 AM, cc wrote:
> Hi,
>
> I have a LAN NET  and a DMZ NET.  I have a SIP phone within the LAN
> trying to connect to a proxy at an external site, say A.
>
> Can someone point out if I'm missing anything?
>
> Rules:
>
> $IPT -A FORWARD -o $INET_ETH -p udp --dport 5060 -j ACCEPT
> $IPT -t nat -A POSTROUTING -o $INET_ETH -p udp --dport 5060 \
>               -j SNAT --to-source $INET_IP
>
> When I do a tcpdump, I can see traffic from the LAN go through my
> bastion Firewall that routes to my external-facing firewall.
> But there is no traffic coming back from the outside.
>
> 17:05:19.831000 IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto:
> UDP (17), length: 367) LAN_IP.5060>  A_SITE.5060: SIP, length: 339
>
> There's no corresponding entry that has traffic going the other way:
> i.e.:
>
> IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto: UDP (17),
> length: 367) A_SITE.5060>  LAN_IP.5060: SIP, length: 339
>
> I'm a bit confused.  Any clarifications appreciated.
>
> Thanks
>
> Ed
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html


-- 
Erik Schorr KD6AUT
Advocate and Consultant
VMware/Iptables/Exim/Perl