From: Erik Schorr <erik-lists@arpa.org>
To: cc <cc@kdtc.net>
Cc: netfilter@vger.kernel.org
Subject: Re: SIP 5060 traffic
Date: Tue, 31 May 2011 08:39:18 -0700 [thread overview]
Message-ID: <4DE50BA6.3030609@arpa.org> (raw)
In-Reply-To: <20110531090945.M97668@kdtc.net>
For proper nat of SIP/RTP traffic, you'll probably need to load the
ip_conntrack_sip (now nf_conntrack_sip) and ip_nat_sip (nf_nat_sip)
modules, as well as have the following rules at the top of your INPUT
and FORWARD chains to permit all traffic related to tracked SIP sessions:
$ipt -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$ipt -I FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
The SIP conntrack module will track sessions on 5060/udp and enable
related return and RTP traffic through the firewall. the SIP nat module
should properly translate the addresses/ports in the SIP headers as they
traverse the firewall, based on how the packets get forwarded.
On 05/31/2011 02:17 AM, cc wrote:
> Hi,
>
> I have a LAN NET and a DMZ NET. I have a SIP phone within the LAN
> trying to connect to a proxy at an external site, say A.
>
> Can someone point out if I'm missing anything?
>
> Rules:
>
> $IPT -A FORWARD -o $INET_ETH -p udp --dport 5060 -j ACCEPT
> $IPT -t nat -A POSTROUTING -o $INET_ETH -p udp --dport 5060 \
> -j SNAT --to-source $INET_IP
>
> When I do a tcpdump, I can see traffic from the LAN go through my
> bastion Firewall that routes to my external-facing firewall.
> But there is no traffic coming back from the outside.
>
> 17:05:19.831000 IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto:
> UDP (17), length: 367) LAN_IP.5060> A_SITE.5060: SIP, length: 339
>
> There's no corresponding entry that has traffic going the other way:
> i.e.:
>
> IP (tos 0x0, ttl 127, id 1595, offset 0, flags [none], proto: UDP (17),
> length: 367) A_SITE.5060> LAN_IP.5060: SIP, length: 339
>
> I'm a bit confused. Any clarifications appreciated.
>
> Thanks
>
> Ed
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Erik Schorr KD6AUT
Advocate and Consultant
VMware/Iptables/Exim/Perl
prev parent reply other threads:[~2011-05-31 15:39 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-05-31 9:17 SIP 5060 traffic cc
2011-05-31 14:55 ` Usuário do Sistema
2011-05-31 15:39 ` Erik Schorr [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DE50BA6.3030609@arpa.org \
--to=erik-lists@arpa.org \
--cc=cc@kdtc.net \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox