My router 951Ui-2HnD RouterOS 6.43.4
It connected to the Internet via ether1 static external IP (let’s say <EXT_IP>). Local subnet: 10.21.32.0/24
Next, it connetcts to the remote PPTP server. My router gets ip 10.70.12.93 and remote server: 10.70.12.1 (VPN). There is SIP server behind this VPN with ip 10.70.2.10.
I’ve added the rules and the route:
/ip firewall mangle add action=mark-routing chain=prerouting dst-address=10.70.2.0/24 new-routing-mark=to_SIP passthrough=yes
/ip firewall nat add action=masquerade chain=srcnat out-interface=pptp-out1 routing-mark=to_SIP
/ip route add distance=1 dst-address=10.70.2.0/24 gateway=pptp-out1 routing-mark=to_LAPP
Ofcource there is default NAT (masquerade) and default route on ether1.
I can connect via ssh to remote SIP server, ping it, run iperf tests and so on without any troubles:
16:09:56.105491 IP 10.70.12.93 > 10.70.2.10: ICMP echo request, id 512, seq 2874, length 40
16:09:56.105568 IP 10.70.2.10 > 10.70.12.93: ICMP echo reply, id 512, seq 2874, length 40
But when I try to register via SIP from my PC it brokes:
16:09:59.063458 IP <EXT_IP>.5060 > 10.70.2.10.5060: SIP: REGISTER sip:10.70.2.10 SIP/2.0
16:09:59.064077 IP 10.70.2.10.5060 > <EXT_IP>.5060: SIP: SIP/2.0 401 Unauthorized
When I’'m dumping traffic on my PC’s interface or on Routerboard’s bridge SIP packets looks fine (correct src_ip and dst_ip), but when I do it either on pptp-out1 or the SIP server - SIP REGISTER packets are with <EXT_IP> as their src_ip.
Moreover, when I use iperf to generate UDP traffic to 10.70.2.10:5060 - everything is fine with src_ip. Also, I can register from my phone to 10.70.2.10 (ofc being behind same NAT).
Iperf’s traffic:
16:12:46.013775 IP 10.70.12.93.42902 > 10.70.2.10.5060: SIP
16:12:46.265065 IP 10.70.12.93.42902 > 10.70.2.10.5060: SIP
16:12:46.514557 IP 10.70.12.93.42902 > 10.70.2.10.5060: SIP
Trying to register from PC and same time registering from phone:
16:43:49.915302 IP <EXT_IP>.5060 > 10.70.2.10.5060: SIP: REGISTER sip:10.70.2.10 SIP/2.0
16:43:49.915627 IP 10.70.2.10.5060 > <EXT_IP>.5060: SIP: SIP/2.0 401 Unauthorized
16:43:52.118341 IP 10.70.12.93.46779 > 10.70.2.10.5060: SIP: REGISTER sip:10.70.2.10;transport=UDP SIP/2.0
16:43:52.119141 IP 10.70.2.10.5060 > 10.70.12.93.46779: SIP: SIP/2.0 401 Unauthorized
16:43:52.124384 IP 10.70.12.93.46779 > 10.70.2.10.5060: SIP: REGISTER sip:10.70.2.10;transport=UDP SIP/2.0
16:43:52.127909 IP 10.70.2.10.5060 > 10.70.12.93.46779: SIP: SIP/2.0 200 OK
In the past I had no such problems in the similar configurations (BUT it was on 6.43.1 RouterOS)
I have completely no idea how to force Routerboard not to use <EXT_IP> in these cases and why does that even happened. I will be SO happy if anyone hepls me to resolve this issue.
And sorry for my poor english.