no audio if libresbc is behind firewall/NAT

[bilbobg]

Hi there,

I'm experimenting with libresbc and I have the following setup:

Public-IP (User) ---> firewall/NAT (with 1 to 1 NAT to libresbc private address, 94.156.34.168 < - > 10.80.80.12) ---> Private IP (kamailio) ---> Loopback IP (freeswitch) ----> Private IP (freeswitch) ----> Private IP (core).

with 3 netalias address spaces and 3 sipprofiles:

inbound (10.80.80.12:5060) --> access_service (localhost:5060 to localhost:5080) --> core (127.0.0.1:5080) --> outbound (10.80.80.12:5090)

(configuration is very similar to what is described here) but with a firewall in front.

On the libresbc I have enabled Access control. SIP signaling traffic is going without a problem. The issues is with RTP and I think I know why it is not flowing but I'm not sure is it a bug or configuration issue :-)

RTP address and port are advertised in the SIP/SDP packets. I have inbound netalias which sets libresbc to listen to his internal address and advertise his public address. I use this netalias as rtp_address in the core sipprofile, but as you can see in the picture it uses the 'listen' address in the SDP packets, not the 'advertise' as I was expecting. I'm expecting in the SDP packets to see libresbc public IP address.

When I access the libresbc from a client behind the firewall in the same IP subnet as libresbc the audio is working 100%.

Of course I can expose libresbc directly in the Internet and this will solve the issue but I prefer to keep it behind a firewall.

Any idea/suggestions will be great :)

inbound netalias:

{
    "name": "inbound",
    "addresses": [
        {
            "member": "libresbc",
            "listen": "10.80.80.12",
            "advertise": "94.156.34.168"
        }
    ],
    "desc": "inbound interface",
    "engagements": [
        "access:service:access_libresbc",
        "sipprofile:external",
        "sipprofile:core"
    ]
}

core_netalias:

{
    "name": "core_netalias",
    "addresses": [
        {
            "member": "libresbc",
            "listen": "127.0.0.1",
            "advertise": "94.156.34.168"
        }
    ],
    "desc": "",
    "engagements": [
        "sipprofile:core"
    ]
}

core sipprofile:

{
    "name": "core",
    "desc": "core profile",
    "user_agent": "LibreSBC",
    "sdp_user": "LibreSBC",
    "local_network_acl": "loopback.auto",
    "enable_100rel": false,
    "ignore_183nosdp": true,
    "sip_options_respond_503_on_busy": true,
    "disable_transfer": false,
    "manual_redirect": false,
    "enable_3pcc": false,
    "enable_compact_headers": false,
    "dtmf_type": "rfc2833",
    "media_timeout": 1800,
    "rtp_rewrite_timestamps": false,
    "realm": "linkmobility.com",
    "context": "core",
    "sip_port": 5080,
    "sip_address": "core_netalias",
    "rtp_address": "inbound",
    "tls": false,
    "tls_only": false,
    "sips_port": 5061,
    "tls_version": "tlsv1.2",
    "engagements": []
}

netstat -tulpen

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name    
tcp        0      0 10.80.80.12:5090        0.0.0.0:*               LISTEN      0          41871      3375/freeswitch     
tcp        0      0 10.80.80.12:5060        0.0.0.0:*               LISTEN      0          40959      3415/kamailio       
tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      107        41047      3254/redis-server 1 
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      0          41370      3358/python3        
tcp        0      0 127.0.0.1:8021          0.0.0.0:*               LISTEN      0          41877      3375/freeswitch     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          13744      383/sshd            
tcp        0      0 127.0.0.1:5080          0.0.0.0:*               LISTEN      0          41865      3375/freeswitch     
tcp        0      0 10.80.80.12:5080        0.0.0.0:*               LISTEN      0          42983      3375/freeswitch     
tcp        0      0 0.0.0.0:8443            0.0.0.0:*               LISTEN      0          13649      384/nginx: master p 
tcp6       0      0 ::1:6379                :::*                    LISTEN      107        41048      3254/redis-server 1 
tcp6       0      0 :::4369                 :::*                    LISTEN      0          12014      1/init              
tcp6       0      0 :::22                   :::*                    LISTEN      0          13755      383/sshd            
udp        0      0 127.0.0.1:323           0.0.0.0:*                           0          13490      373/chronyd         
udp        0      0 127.0.0.1:5060          0.0.0.0:*                           0          40957      3382/kamailio       
udp        0      0 10.80.80.12:5060        0.0.0.0:*                           0          40956      3382/kamailio       
udp        0      0 127.0.0.1:5080          0.0.0.0:*                           0          41864      3375/freeswitch     
udp        0      0 10.80.80.12:5080        0.0.0.0:*                           0          42982      3375/freeswitch     
udp        0      0 10.80.80.12:5090        0.0.0.0:*                           0          41870      3375/freeswitch     
udp6       0      0 ::1:323                 :::*                                0          13491      373/chronyd         

[hnimminh]

Hi @bilbobg

• Does your firewall open for UDP/RTP traffic?
• There is a built-in nftables in libresbc, have you whitelist the IP for RTP?

[bilbobg]

yes, the firewall is open for UDP/RTP traffic and 'yes' I have whitelisted the client IP addresses in the firewall.

{
    "whiteset": [
        "31.13.xxx.xxx",
        "94.155.xxx.xxx"
    ],
    "blackset": []
}

[hnimminh]

it would be easier for me if check on pcap file, if you don't mind please send me via the email.

[bilbobg]

sure!

[hnimminh]

Hi @bilbobg
I just update the fix on the master, if you have a time can try and confirm the issue has gone?
ansible-playbook playbooks/deployment.yml -i inventories/production -l "<machine-name>" -t "libre"

[hnimminh]

this will be fixed by #55