SIP with firewall / NAT using Asterisk - Virtual Number Provider | DID Numbers | Call Forwarding - Virtual-PhoneNumbers.com
BIGTheme.net • Free Website Templates - Downlaod Full Themes

SIP with firewall / NAT using Asterisk

Network Address Translation (NAT) is a common practice used in networks, and it doesn't play well with VoIP. Solving this problem requires an understanding of NAT, VoIP and your VoIP setup. The following focuses on the SIP protocol for VoIP using Asterisk, but problems and solutions are applicable to most other situations.

 

NAT can cause problems in several places. If one of the PBXes is behind a NAT gateway, the other PBX will not be able to contact it without some additional network setup. If one or more of the phones are behind a NAT gateway, the other phone will be trying to send audio to a non-routable address. This results in failed calls or missing audio.

The alternative to a re-invite is to have the PBX relay the voice packets between the two endpoints.

SIP client is behind a NAT gateway connecting to a server on the Internet

The client creates the translation entry for the SIP traffic when it first registers. As long as there is frequent communication between the two hosts, such as one packet per minute, the channel will stay open. The only configuration needed is to have the client use its external address in all SDP packets. On clients that support it, enable STUN (Simple Traversal of UDP through NAT), so the client can determine the external address dynamically, or enter it manually. Asterisk doesn't support STUN at this time, so all NAT configuration must be done manually. The following commands in /etc/asterisk/sip.conf set up the NAT properly:

[general]

localnet=192.168.0.0/255.255.0.0   // or your subnet

externip=x.x.x.x                   // use your address

[YOURREMOTEPEER]                   // your peer's name

nat=yes

qualify=yes                       // force keepalives

With this configuration, Asterisk uses the address defined by externip for all calls to the peers configured with nat=yes. The addition of qualify=yes causes Asterisk to test the connection frequently so that the NAT translations are not removed from the firewall. With these two commands, there always will be a communications channel between Asterisk and the peer, and Asterisk will use the outside address when sending SDP messages.

Multiple SIP phones and an Asterisk server behind a NAT gateway

Calls between the phones will work fine because NAT is not needed. For calls between you and other systems on the Internet there will be problems. Unless you register to the remote side as a client (as done in the previous example), you will not be able to receive SIP messages, so you will not be able to accept calls. Second, the address information in the call setup will point to the internal address of the phone, and the one-way audio problems mentioned previously will crop up.

The easiest solution to this is to avoid NAT entirely. If you have a public IP address available for your call server, use it. If your Asterisk server is connected to both the Internet and the internal network, the SIP port is reachable from both the inside and the outside, and the only problem is ensuring RTP flows properly. The PBX server does not need to be configured to route between the interfaces or provide masquerading; it simply needs to bridge the inbound and outbound voice calls.

As I mentioned earlier, the PBX either can stay in the voice path or get out of the way. In the latter case, the PBX tells both endpoints about each other after which the endpoints talk directly. However, Asterisk could have a call setup with both endpoints and relay the RTP packets on behalf of each endpoint. The inside host would be talking to the inside address, and the outside host would be talking to the outside address. The only configuration required to achieve this in sip.conf is to disable re-invites:

[general]

canreinvite=no              // force relaying

This configuration works well because the Asterisk server can speak freely to the Internet to send and receive calls. It also can talk to the internal phones, and by some simple bridging, completely ignore NAT.

As it turns out, this relaying behavior also is required when the Asterisk server has only a private address. The RTP ports will have to be forwarded on the firewall too. RTP chooses random port numbers based on configured limits. Before the ports can be configured, they should be limited in range. Configuring the firewall rules is much easier if the range of ports is known beforehand.

The range of ports to be used for RTP is defined in rtp.conf. The following configuration will limit Asterisk's choice of RTP ports from 10000 to 20000:

[general]

rtpstart=10000         // first port to use

rtpend=20000           // last port to use, rounded up if odd

Asterisk will need several RTP ports to operate properly. Only even ports are actually used, and disabling of re-invites causes two connections to be built per call. These ports and the SIP port must then be forwarded in by the firewall. The iptables syntax is:

iptables -t nat -A PREROUTING -i eth0 -p udp \

-m udp --dport 10000:10100 -j DNAT \

--to-destination 192.168.1.10

iptables -t nat -A PREROUTING -i eth0 -p udp \

-m udp --dport 5060 -j DNAT \

--to-destination 192.168.1.10

Replace eth0 with the outside interface of your firewall and 192.168.1.10 with the address of your Asterisk server. These rules tell the Linux kernel to translate the destination address of any UDP packets in the given range that are entering the outside interface. This must happen at the PREROUTING stage as opposed to the POSTROUTING stage, because the destination address is being translated. At this point, any SIP or RTP packet from the Internet will be forwarded to the internal Asterisk server for processing.

When a remote station makes a call to Asterisk, the SIP packet will be forwarded in because of the iptables rules. Asterisk will stay in the media stream because of the canreinvite=no command and it will use the external address of the firewall in any SDP packets because of the NAT commands. Finally, the media stream will be forwarded to the Asterisk server because of the combination of iptables RTP forwarding and port ranges defined in rtp.conf.

Up to this point, the configuration has focused on getting Asterisk working behind a NAT gateway, with some extra details to make the phones relay through Asterisk. There are, of course, more general solutions.

If you can avoid NAT in the first place, it is in your best interests to do so because it avoids all the problems encountered so far.

The Asterisk gateway can have a very restrictive firewall policy applied to it – you just need to allow UDP 5060 for SIP and whatever port range is defined in rtp.conf. In this configuration, Asterisk can contact both the internal phones and the rest of the Internet.

If SIP is not a requirement, and you are using Asterisk, consider using the IAX protocol. IAX tunnels both the control traffic and the voice traffic over a single UDP conversation that can be port-forwarded, filtered or translated easily. This method is limited to a static set of tunnels, which is sufficient if you are connecting some PBXes over the Internet or connecting to a long-distance provider.

Sometimes the above solutions are not available to you. In that case, it might be advisable to move to a full-featured SIP proxy and use Asterisk only for voice applications, such as voice mail. SIP Express Router (SER) is a powerful SIP server that handles NAT well and is used by several high-volume services, including Free World Dialup. SER's job is only in setting up calls between endpoints, so it must rely on other applications, such as specialized media proxies, to handle RTP streams if needed.

The step beyond a SIP proxy is a Session Border Controller (SBC), which is like a VoIP firewall. The SBC can intercede in either the signaling or RTP paths to add extra features, such as signaling protocol or codec translation, all while enforcing security policies. These are almost exclusively commercial products.

Order Your DID Number Now

Sign up in 3 easy steps

Select virtual number location

Select forwarding destination

(See rates)1
(Read more) 1

Destination details

Accept incoming calls from as many local numbers as you need. Use our mobile applications and enjoy unlimited incoming calls and call forwarding at no additional cost. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System Feature

Unlimited Calls

Accept incoming calls from as many local numbers as you need. Use our mobile applications and enjoy unlimited incoming calls and call forwarding at no additional cost. Learn more

Make outgoing calls (outbound calls) with dial tone access (DISA). Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Outgoing Calls

Place outgoing calls (outbound calls) with dial tone access (DISA). Learn more

Send voicemails to one or more email addresses. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System Feature

Unified Voicemail

Send voicemails to one or more email addresses. Voicemails are sent to any email address you specify automatically so you can get back to your clients faster. Learn more

Set notifications for events within your call-flow, including SMS and email. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Notification

Set notifications for events within your call-flow, including SMS and email. Learn more

Assemble calls into a queue when experiencing high call volumes or facing short staff. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Queue

Assemble calls into a queue when experiencing high call volumes or facing short staff. Learn more

Blacklist unwanted callers (global filter available). Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Blacklist

Blacklist unwanted callers (global filter available). Learn more

Our offer is not Internet or VOIP based which means there are no internet or data costs. Just plain and simple call forwarding. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

No Data Usage

Our offer is not Internet or VOIP based which means there are no internet or data costs. Just plain and simple call forwarding.

Get detailed call history reports for all your virtual phone number that details all your calls received, duration and statuses. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Detailed Call History

Get detailed call history reports for all your numbers that details all your calls received, duration and statuses.

Forward calls to an array of contact devices, including landline, mobile, softphone, any VoIP provider, SIP, H.323 or IAX - Virtual Phone Number (DID Number), Call Forwarding PBX Phone System Feature

Forward Calls

Forward calls to an array of contact devices, including landline, mobile, softphone, any VoIP provider, SIP, H.323 or IAX. Learn more

Transfer calls to configured extensions, menus and voicemail boxes with IVR. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System Feature

Voice Menu

Transfer calls to configured extensions, menus and voicemail boxes with IVR. Set up your voice menu and direct calls to different numbers based on the selection. (e.g. Press 1 for sales and 2 for support). Learn more

Record and playback automated messages by uploading files or using a phonetic transcription service like speech-to-text. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System Feature

Playback

Record and playback automated messages by uploading files or using a phonetic transcription service like speech-to-text. Learn more

Record and forward phone calls to email as attachments. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Call Recording

Record and forward phone calls to email as attachments. Learn more

Receive incoming calls and make outgoing calls from your Android or iOS (iPhone) smartphone. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Mobile App

Receive incoming calls and make outgoing calls from your Android or iOS (iPhone) smartphone. Learn more

Never miss a call and create rules for your virtual phone number to ring to multiple mobiles either at once or when ‘busy’ or ‘no answer’. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Multi Ring

Never miss a call and create rules for your virtual phone number to ring to multiple mobiles either at once or when ‘busy’ or ‘no answer’.

Our virtual phone number is not internet based you will enjoy crystal clear audio signal as if your clients were calling on your direct line. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Superb Voice Quality

As our service is not internet based you will enjoy crystal clear audio signal as if your clients were calling on your direct line.

We don’t hook you into long term contracts. Our service is month to month and you may cancel at any time. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

No Contracts

We don’t hook you into long term contracts. Our service is month to month and you may cancel at any time.

Forward incoming calls to multiple end-point users sequentially or simultaneously - Virtual Phone Number (DID Number), Call Forwarding PBX Phone System Feature

Incoming Calls

Forward calls to multiple end-point users sequentially or simultaneously. Learn more

Specify “Ring” and “Hunt” groups, otherwise known as “Find Me Follow Me” - Virtual Phone Number (DID Number), Call Forwarding PBX Phone System Feature

Time-of-Day Routing

Specify where calls should be routed at specific periods of the day and/or specific days of the week. Specify “Ring” and “Hunt” groups, otherwise known as “Find Me Follow Me.” Learn more

Host conferences in private call rooms (PIN required). Virtual Phone Number (DID Number), Call Forwarding PBX Phone System Feature

Conference Calls

Host conferences in private call rooms (PIN required). Use your Virtual Phone Number as a Conference Call facility. Learn more

Route incoming calls based on the caller’s ID or a specific number set (i.e. area code). Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Caller Routing

Route incoming calls based on the caller’s ID or a specific number set (i.e. area code). Learn more

Receive fax transmissions and immediately forward to email. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Fax (Fax2Email)

Receive fax transmissions and immediately forward to email. Learn more

PBXww sip device registration and internal extension dialing. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

Internal Dialing

Register SIP devices and configure internal extension dialing.

No more hassles with waiting for installations of physical landlines and waiting weeks for installation problems. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

No Installations

No more hassles with waiting for installations of physical landlines and waiting weeks for installation problems.

Traveling Abroad? When you reach your international destination just update your forwarding number and you’re set.. Virtual Phone Number (DID Number), Call Forwarding PBX Phone System

International Support

Traveling Abroad? When you reach your international destination just update your forwarding number and you’re set.

Client's Feedback

  • I just wanted to pass on my thanks for the excellent service I received from one of your staff - a gentleman named Caleb N. Based on past experi...
    Audai Louri
    Nov 15 2016, 3:35 (AM)
  • great service!! i like it
    balhadj
    Oct 13 2016, 5:22 (PM)
  • I'm very satisfied
    Emil Wasilewski
    Sep 28 2016, 12:06 (PM)
  • instant support we would like to refer with all of my business friends
    jinesh
    Aug 16 2016, 3:22 (PM)
  • Great service, the number got activate within a minute and i am enjoying the services . very fast and reliable thank you virtual phone numbers .com
    Ritesh
    Aug 01 2016, 12:08 (PM)
  • The support was very good and very fast answers. Thanks!
    Salajan
    Jul 26 2016, 7:53 (PM)
  • I had great supportive chat with Judy from the PreSales team... it was great, and had answers to all my questions for the presales concerns and...
    Moh Moneim
    Jul 26 2016, 6:08 (PM)
  • Jude M. was extremely friendly and helpful. The virtual phone number support is amazing. All my problems are solved!
    So Lok Yi
    Jul 19 2016, 8:19 (AM)
  • fantastic support - Jude was very patient helped me all the way - could'nt ask for any more - Looking forward to making this a serious tool for our...
    CMac
    Jun 07 2016, 6:17 (PM)
  • Perfect Service. They help me to migrate my Hong Kong Company Number from another company which was stopping service in few days. And now is all...
    Zoe S.r.l.s.
    Jun 03 2016, 5:00 (PM)
    www.zoewebsolutions.it

Member Access