VoIP Mailing List Archives

[dcunningham at voisoni...]

Hi,


We have a Kamailio and Asterisk cluster, both machines being on a real 103.x IP address and also on a 172.x OpenVPN address.


The problem is that when Kamailo receives a call from the VPN and forwards it to the Asterisk server on it's 103.x address, Asterisk never sees the call.


If Kamailio receives a call from the VPN and forwards the call to the Asterisk server on it's 172.x address then it works. However, if the call isn't from the VPN then forwarding it to the 172.x address doesn't work. So basically the problem is going between the real network and the VPN.


The question is, how can we make this work when calls are received on either network on the Kamailio server and are forwarded to Asterisk?

Using ngrep on the Asterisk server we see that it does receive the INVITE, but Asterisk's logging shows no sign it at all. We guess it's a Linux networking issue rather than Asterisk's fault, but don't know where to fix it. We do have net.ipv4.ip_forward = 1 on both the Kamailio and Asterisk servers.


Thanks in advance for any help.


The ngrep on the Asterisk server:

U 2014/01/17 13:15:15.599557 172.x.x.x:5060 -> 103.y.y.y:5060
INVITE sip:9067268@103.y.y.y:5060;transport=udp SIP/2.0.
Record-Route: <sip:172.x.x.x;lr=on>.
Via: SIP/2.0/UDP 172.x.x.x;branch=z9hG4bK50c7.f49ceb73.0.
Via: SIP/2.0/UDP 192.z.z.z:5062;rport=5062;branch=z9hG4bK806710997.
From: "9067271" <sip:9067271@172.x.x.x>;tag=198791249.
To: <sip:9067268@172.x.x.x>.
Call-ID: 1905625787@192.z.z.z.
...

172.x.x.x is the Kamailio server's VPN address
103.y.y.y is the Asterisk server's real address
192.z.z.z is the calling phone's LAN address



--
David Cunningham, Voisonics
http://voisonics.com/
USA: +1 213 221 1092
UK: +44 (0) 20 3298 1642
Australia: +61 (0) 2 8063 9019

[paul.belanger at polyb...]

On Sun, Jan 19, 2014 at 9:51 PM, David Cunningham
<dcunningham@voisonics.com> wrote:

[dcunningham at voisoni...]

Hi Paul,


The ngrep on the Asterisk server does show it being received. Have you any idea what would prevent it getting from the network stack to Asterisk on that machine?




On 21 January 2014 05:30, Paul Belanger <paul.belanger@polybeacon.com (paul.belanger@polybeacon.com)> wrote:

[duncan at e-simple.co.nz]

On 21/01/2014, at 10:24 am, David Cunningham <dcunningham@voisonics.com (dcunningham@voisonics.com)> wrote:

[dcunningham at voisoni...]

Hi Duncan,


The Asterisk machine also has a VPN IP address, so it has a route for 172.x addresses to go to tun0 VPN interface.




On 21 January 2014 08:30, Duncan Turnbull <duncan@e-simple.co.nz (duncan@e-simple.co.nz)> wrote:

[EWieling at nyigc.com]

Make sure you do NOT have any *bindaddr options set in your sip.conf. If you do, you are telling Asterisk to not allow the OS to pick the source IP and hence the routing.

The *bindaddr options are seldom useful.

-----Original Message-----
From: asterisk-users-bounces@lists.digium.com [mailto:asterisk-users-bounces@lists.digium.com] On Behalf Of David Cunningham
Sent: Monday, January 20, 2014 5:15 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Asterisk not receiving call from VPN address

Hi Duncan,


The Asterisk machine also has a VPN IP address, so it has a route for 172.x addresses to go to tun0 VPN interface.




On 21 January 2014 08:30, Duncan Turnbull <duncan@e-simple.co.nz> wrote:


On 21/01/2014, at 10:24 am, David Cunningham <dcunningham@voisonics.com> wrote:


Hi Paul,


The ngrep on the Asterisk server does show it being received. Have you any idea what would prevent it getting from the network stack to Asterisk on that machine?





Have you got a static route on asterisk or your default gateway showing how to get back to the 172. addresses i.e. pointing to the vpn box for 172 addresses?

Cheers Duncan



On 21 January 2014 05:30, Paul Belanger <paul.belanger@polybeacon.com> wrote:


On Sun, Jan 19, 2014 at 9:51 PM, David Cunningham
<dcunningham@voisonics.com> wrote:
> Hi,
>
> We have a Kamailio and Asterisk cluster, both machines being on a real 103.x
> IP address and also on a 172.x OpenVPN address.
>
> The problem is that when Kamailo receives a call from the VPN and forwards
> it to the Asterisk server on it's 103.x address, Asterisk never sees the
> call.
>
> If Kamailio receives a call from the VPN and forwards the call to the
> Asterisk server on it's 172.x address then it works. However, if the call
> isn't from the VPN then forwarding it to the 172.x address doesn't work. So
> basically the problem is going between the real network and the VPN.
>
> The question is, how can we make this work when calls are received on either
> network on the Kamailio server and are forwarded to Asterisk?
>
> Using ngrep on the Asterisk server we see that it does receive the INVITE,
> but Asterisk's logging shows no sign it at all. We guess it's a Linux
> networking issue rather than Asterisk's fault, but don't know where to fix
> it. We do have net.ipv4.ip_forward = 1 on both the Kamailio and Asterisk
> servers.
>
> Thanks in advance for any help.
>
> The ngrep on the Asterisk server:
>
> U 2014/01/17 13:15:15.599557 172 <tel:15.599557%20172> .x.x.x:5060 -> 103.y.y.y:5060
> INVITE sip:9067268@103.y.y.y:5060;transport=udp SIP/2.0.
> Record-Route: <sip:172.x.x.x;lr=on>.
> Via: SIP/2.0/UDP 172.x.x.x;branch=z9hG4bK50c7.f49ceb73.0.
> Via: SIP/2.0/UDP 192.z.z.z:5062;rport=5062;branch=z9hG4bK806710997.
> From: "9067271" <sip:9067271@172.x.x.x>;tag=198791249.
> To: <sip:9067268@172.x.x.x>.
> Call-ID: 1905625787@192.z.z.z.
> ...
>
> 172.x.x.x is the Kamailio server's VPN address
> 103.y.y.y is the Asterisk server's real address
> 192.z.z.z is the calling phone's LAN address
>

Sounds like a routing problem opposed to an application issue. You'll
have to fire up tcpdump on Kamailio and see what happens to the
packet. The look at the local routing tables to see where it is
getting routed. If Asterisk is not receiving the patch, then Kamailio
is not routing it properly.

You'll be able to see everything once you have a pcap of the call.

--
Paul Belanger | PolyBeacon, Inc.
Jabber: paul.belanger@polybeacon.com | IRC: pabelanger (Freenode)
Github: https://github.com/pabelanger | Twitter: https://twitter.com/pabelanger

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com <http://www.api-digital.com/> --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users





--
David Cunningham, Voisonics
http://voisonics.com/
USA: +1 213 221 1092 <tel:%2B1%20213%20221%201092>
UK: +44 (0) 20 3298 1642 <tel:%2B44%20%280%29%2020%203298%201642>
Australia: +61 (0) 2 8063 9019 <tel:%2B61%20%280%29%202%208063%209019>

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users



--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users





--
David Cunningham, Voisonics
http://voisonics.com/
USA: +1 213 221 1092
UK: +44 (0) 20 3298 1642
Australia: +61 (0) 2 8063 9019


--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

[paul.belanger at polyb...]

On Mon, Jan 20, 2014 at 4:24 PM, David Cunningham
<dcunningham@voisonics.com> wrote:

[dcunningham at voisoni...]

Hi Eric,

Thanks for the suggestion. It was on bindaddr of 0.0.0.0, but we tried removing that too, and Asterisk still doesn't see anything.




On 21 January 2014 09:18, Eric Wieling <EWieling@nyigc.com (EWieling@nyigc.com)> wrote:

[dcunningham at voisoni...]

Hi Paul,


Using ngrep/tcpdump shows the packet clearly going from the Kamailio server and arriving at the Asterisk server. This is why it's a mystery that Asterisk doesn't see the call coming in. We tried removing the firewall (so iptables -L shows no rules at all) but that didn't help unfortunately.




On 21 January 2014 15:29, Paul Belanger <paul.belanger@polybeacon.com (paul.belanger@polybeacon.com)> wrote:

[duncan at e-simple.co.nz]

On 21/01/2014, at 6:40 pm, David Cunningham <dcunningham@voisonics.com (dcunningham@voisonics.com)> wrote:

[dcunningham at voisoni...]

Hi Duncan,


Thank you for your reply. Here's the netstat:

[root]# netstat -udpln | grep asterisk
udp        0      0 0.0.0.0:5000                0.0.0.0:*                               6672/asterisk      
udp        0      0 0.0.0.0:4520                0.0.0.0:*                               6672/asterisk      
udp        0      0 0.0.0.0:5060                0.0.0.0:*                               6672/asterisk      
udp        0      0 0.0.0.0:4569                0.0.0.0:*                               6672/asterisk      


Here's the tcpdump (tcpdump udp port 5060 -A -n -nn -i tun0) from the Kamailio server:

17:13:17.103771 IP 103.x.x.x.5060 > 172.y.y.y.5060: SIP, length: 1228
E.......@.>/g.v.............INVITE sip:*1@172.y.y.y:5060;transport=udp SIP/2.0
Record-Route: <sip:103.x.x.x;lr=on>
Via: SIP/2.0/UDP 103.x.x.x;branch=z9hG4bK584f.d0387c07.0
Via: SIP/2.0/UDP 192.168.1.40:5060;received=203.z.z.z;rport=5060;branch=z9hG4bK274588850
From: <sip:9067273@103.x.x.x>;tag=1880695235
To: <sip:*1@103.x.x.x>
Call-ID: 1898224288


Here's the tcpdump (tcpdump udp port 5060 -A -n -nn -i tun0) from the Asterisk server:

17:13:17.093676 IP 103.x.x.x.5060 > 172.y.y.y.5060: SIP, length: 1228
E.......?.?/g.v.............INVITE sip:*1@172.y.y.y:5060;transport=udp SIP/2.0
Record-Route: <sip:103.x.x.x;lr=on>
Via: SIP/2.0/UDP 103.x.x.x;branch=z9hG4bK584f.d0387c07.0
Via: SIP/2.0/UDP 192.168.1.40:5060;received=203.z.z.z;rport=5060;branch=z9hG4bK274588850
From: <sip:9067273@103.x.x.x>;tag=1880695235
To: <sip:*1@103.x.x.x>
Call-ID: 1898224288







On 21 January 2014 16:56, Duncan Turnbull <duncan@e-simple.co.nz (duncan@e-simple.co.nz)> wrote:

[lmoore at omninet.net.au]

Have you checked your localnet=, deny=, permit=, contactdeny= &
contactpermit= settings?

My 2c worth.

On 20/01/2014 10:51 AM, David Cunningham wrote:

[dcunningham at voisoni...]

Hi Larry,


Thanks for the reply. We have all of those settings left out of our sip.conf, so this should allow everything, right?




On 21 January 2014 17:38, Larry Moore <lmoore@omninet.net.au (lmoore@omninet.net.au)> wrote:

[duncan at e-simple.co.nz]

Cool

That looks like it is arriving at Asterisk - are you sure asterisk is not getting it? If you turn on sip debug in asterisk can you see the SIP packets? It maybe asterisk is ignoring them or replying to them but its going out an interface you hadn’t thought of, I have had that a few times.


I should have mentioned to print out your route table and ifconfig. Asterisk can reply on a different address to the original destination especially if it came through a tunnel. Often it will be the tunnel interface address. Usually then we set the secondary address as the outbound proxy on the phone so the phone will also respond to it.


Cheers Duncan


On 21/01/2014, at 7:18 pm, David Cunningham <dcunningham@voisonics.com (dcunningham@voisonics.com)> wrote:

[lmoore at omninet.net.au]

Is Kamalio running on the same system as Asterisk?

On 21/01/2014 2:41 PM, David Cunningham wrote: