I am implementing a SIP Proxy that should be able to redirect all RTP traffic between two clients that can't reach each other. To implement that, I decided to manipulate the negotiated addresses in the SIP/SDP messages and use iptables rules to redirect the RTP traffic.
The problem happens if the source sending the RTP packets changes. In this case the iptables take 30 seconds to start redirecting the traffic from the new source.
To explain in details what I am trying to do, suppose I've got two SIP clients and my Proxy:
- SIP client of Bob is running at 192.168.1.1
- SIP client of Alice is running at 192.168.2.1
- The Proxy is running at 192.168.3.1.
- Bob and Alice 's networks can't reach each other. The Proxy knows both Bob and Alice networks.
Bob call Alice, informing, in the its SIP/SDP message, that he will be listening to RTP traffic at 192.168.1.1:8000. The Proxy then changes this address to 192.168.3.1:15000 and forward the new SIP/SDP message to Alice. Now, all RTP traffic from Alice will be send to the Proxy. To redirect this traffic back to Bob, the Proxy add the following rules to iptables:
iptables -t nat -A OUTPUT -d 192.168.3.1 -p UDP --dport 15000 -j DNAT --to 192.168.1.1:8000 iptables -t nat -A PREROUTING -d 192.168.3.1 -p UDP --dport 15000 -j DNAT --to 192.168.1.1:8000 iptables -t nat -A POSTROUTING -d 192.168.1.1 -p UDP --dport 8000 -j SNAT --to 192.168.3.1:15000
Now, suppose that the source RTP stream changes. For some reason now the machine running the Proxy is generating the RTP traffic instead of Alice.
The iptables rules do not need to change. Iptables should be able to redirect this new RTP traffic using the OUTPUT rule above. But, it takes 30 seconds to iptables start redirecting the traffic to Bob.
After some research I've found that this problem might be caused by conntrack table, that must wait its entry "Alice->Bob" expire before add a new entry "Proxy->Bob". And I could confirm that when I looked at /proc/net/ip_conntrack.
My rules do not specify the source, because I not always have it and it could change dynamically without telling the Proxy. So, I can't delete conntrack entries manually using conntrack-tools as I read in other posts.
Any ideas on how to handle this problem?