we’ve seen Problems behind a MT in masqerading mode with sip.
The x-sip-lite client behind the MT can call and the called person
can hear the caller but the caller can not hear the called person.
Seems the NAT detection and STUN of X-Lite and MT Masquerading
do not cooperate. Using and configuring X-Tunnel manually works.
But I think it should work with STUN alone (that’s the purpose of STUN).
Skype works out of the box.
Firewall is very simple.
Some rules in the input chain for blocking access to the MT and:
[admin@xx] > ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=wlan1 action=masquerade
So it’s no solution for the moment until ROS 3 leaves Beta State.
For this scenario the customer behind the MT has to tell me what
IP is used by an IP-Telephone and I have to assign an additional
official IP for each telephone.
Hmm. No good way.
Any Idea why STUN is not working. STUN shouldn’t need a
helper application. Maybe I have to change settings to make
it work?
Xten reports it has found a Nat of type: “Port Restricted Cone”
Sip behind masq nat to an asterisk server from xlite works fine. You need to ensure that you have nat=yes and qualify=yes in you sip.conf on the asterisk server. This way, asterisk will ignore the ip/port in the sip msg and will use the ip/port from which the sip msg originated. You do need the asterisk server to not be behind masq nat.
Sip behind masq nat to an asterisk server from xlite works fine. You need to ensure that you have nat=yes and qualify=yes in you sip.conf on the asterisk server. This way, asterisk will ignore the ip/port in the sip msg and will use the ip/port from which the sip msg originated. You do need the asterisk server to not be behind masq nat.
Doing it this way should be fine. The key is that you can only have ONE end of the SIP pair behind NAT! Typically, the phone end will need to be behind NAT, so you need to make sure that your Asterisk (or other SIP server) has a non-NAT ip address. Not 1-1 NAT or anything fancy like that. It can NOT be natted, period.