LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 01-30-2008, 06:36 AM   #1
browny_amiga
Member
 
Registered: Dec 2001
Location: /mnt/UNV/Mlkway/Earth/USA/California/Silicon Valley
Distribution: Kubuntu 10.04, Debian Squeeze, Windoze 7
Posts: 512

Rep: Reputation: 35
Question cannot get SIP Phone to work over iptables firewall


Hi there

I am using a iptables firewall based on Debian Etch and so far have been running against a wall getting my Gigaset C470 IP running.
I can make it ring on both sides, so it registers fine on port 5060 with the sip provider server, but then there is no audio going through, from neither side to the other.
I know that you need the module ip_conntrack_sip loaded on the iptables machine, but so far that has helped nothing. Finding out which ports SIP uses is a needle in the haystack. Using fwbuilder to configure iptables, I have opened SIP, RTP and RTCP ports, tried to forward them directly to the device (through the NAT tab in fwbuilder, which is how you should do it, right?)

I know that the NAT is to blame, since I have connected the phone directly on the public internet address and that worked like a charm.
Is there any way I can tackle this problem, get a point where I can start finding the problem step by step?

I have 2 pictures, showing the firewall config, policy and nat rules, but don't know how to attach them here.

thanks in advance for any pointers

Markus
 
Old 01-31-2008, 04:47 PM   #2
blackhole54
Senior Member
 
Registered: Mar 2006
Posts: 1,896

Rep: Reputation: 61
Quote:
Originally Posted by browny_amiga View Post
Finding out which ports SIP uses is a needle in the haystack.
You should be able to identify the ports by using iptables/netfilter to log what is going on. You might already be logging the dropped packets (check /var/log/syslog). If not, or if that is not enough info,

Code:
iptables -A <INPUT | OUTPUT>  <matching conditions> -j LOG
will log packets on the selected chain (INPUT or OUTPUT) that match the <matching conditions>. If no conditions are used, then all packets get logged.

Please note the following:
  • You must be root to run the iptables command
  • I showed the command with -A (append), but -I (insert) might be more appropriate or easier. (See iptable's man page)
  • The packet must still be traversing the given chain to get logged. If it has already been ACCEPTed or DROPped by a previous rule, it won't get logged.
  • This may be obvious, but just in case ... the log shows source port as SPT and destination port as DPT
I hope this gets you started.
 
Old 02-11-2008, 07:54 PM   #3
browny_amiga
Member
 
Registered: Dec 2001
Location: /mnt/UNV/Mlkway/Earth/USA/California/Silicon Valley
Distribution: Kubuntu 10.04, Debian Squeeze, Windoze 7
Posts: 512

Original Poster
Rep: Reputation: 35
Smile

Thanks for the tips. I have given it up and couldn't find a solution. There is not even a documentation for SIP-phones, which ports they are using and which protocols. Sadly, this is the reason why you find many people in the net saying that they switched to skype, "that just works". Skype might be a security hazard, but it surely does work.
That SIP was not designed to work over NAT is no help, 99% of all users use NAT and waiting for IPV6 will make us all get grew hair before it happens. I always smile at the ignorance when I hear a so called decision maker manager state that "Haven't heard anything about IPV6 much, therefore it can't be taking hold"
You cannot feed managers with facts, they only eat marketing.
And what you did not hear about from several sources obviously can't be worth any consideration. ;-)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VOIP phone for windows that understands sip, anybody? oskar General 4 07-12-2009 02:00 AM
Help 4 SIP based IP phone arsalan Programming 2 01-29-2008 01:01 AM
My dream WiFi mobile SIP phone challenge dkblinux98 Linux - General 4 10-22-2006 08:51 PM


All times are GMT -5. The time now is 11:48 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration