Asterisk Network

Asterisk 11+ 支持 ICE

portdesc
5060/udpsip
5060/tcpsip
4569/udpIAX2
5036/udpIAX
10000-20000/udpRTP
2727/udpMGCP
nmap 192.168.1.1 -P0 -p 5060 -sU

NAT#

caseasterisk roleothernat
#1client natoutside sipyes
#2client natinside sipno
#3server natoutside clientyes
#4server natoutside client natyes
#5server natinside clientno
#6clientoutside sipno
#7clientinside sipyes - #3
#8server natoutside clientno
#9server natinside clientyes
  1. SIP outside proxy
  2. OK
  3. 1:1 端口转发
  4. 端口转发 + 客户端 STUN
  5. OK
  6. OK
  7. 同 #3
  8. OK
  9. nat=yes, qualify=xxx, 客户端可以 stun 辅助

配置#

sip.conf#

  • asterisk nat support
  • asterisk 1.8 nat support
  • symmetric RTP
  • Asterisk will always send RTP packets from the same port number it expects to receive them on.
tip
  • 建议只在 general 配置 nat 相关选项
    • 不同的 nat 配置可能相互影响

基础服务

[general]
port = 5060
bindaddr = 0.0.0.0
context = error
qualify = no
srvlookup = yes
[general]
; 区分 inside 和 outside
; 判断是否 NAT
localnet=192.168.0.0/255.255.0.0
; SIP 和 SDP 使用的静态地址 - 端口默认为 udpbindaddr
; hostname 启动时查询一次
; externip
externaddr = 12.34.56.78:9900
; externtcpport = 9900
; externtlsport = 12600
; 同 externaddr - 每隔 externrefresh(默认 10s) 查询一次 hostname
externhost = hostname[:port]
externrefresh = 10
; no - use rport if remote request
; force_rport - 强制 rport - 默认
; yes - force_rport + comedia RTP
; comedia - no + comedia RTP
; comedia - connection-oriented media
nat = force_rport
; 修改 audio, video, text 等 SDP 地址
media_address =

nat#

  • nat=yes
    • Asterisk 忽略 SIP, SDP 头中的地址信息, 直接返回给发送者的 IP 地址和端口
    • 强制 RFC 3581， 开启 对称 RTP
  • net=never - 2004 年 7 月 29 添加
    • 用于 UA/客户端 不支持 rport 常见
    • 之后添加 route 选项 - 添加参数控制是否支持
natrfc3581Symmetric RTP
yesforceenable
noenabledisable
force_rportforcedisable
comediaenableenable

FAQ#

tcpdump#

# UDP
tcpdump -n dst portrange 10000-11000
tcpdump -i bond3 udp port 5060 or udp portrange 10000-20000

wireshark#

ssh 192.168.1.2 sudo tcpdump -U -s0 'port 5060 or udp portrange 10000-20000' -i eth0 -w - | wireshark -k -i -

nftables 转发#

# SIP
iifname "wan0" udp dport 5060 counter dnat to 192.168.1.2
iifname "wan0" tcp dport 5060 counter dnat to 192.168.1.2
# RTP
iifname "wan0" udp dport 10000-20000 counter dnat to 192.168.1.2
# IAX
iifname "wan0" udp dport 4569 counter dnat to 192.168.1.2
iifname "wan0" udp dport 5036 counter dnat to 192.168.1.2
# MGCP
iifname "wan0" udp dport 2727 counter dnat to 192.168.1.2

IPTables 转发#

# SIP
iptables -A INPUT -p udp -m udp --dport 5060 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 5060 -j ACCEPT
# IAX2- the IAX protocol
iptables -A INPUT -p udp -m udp --dport 4569 -j ACCEPT
# IAX
iptables -A INPUT -p udp -m udp --dport 5036 -j ACCEPT
# RTP
iptables -A INPUT -p udp -m udp --dport 10000:20000 -j ACCEPT
# MGCP
iptables -A INPUT -p udp -m udp --dport 2727 -j ACCEPT
Edit this page