Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

SIP was not built with NAT routers in mind, and I'd like to get to the bottom of this issue to check what needs to be done on all devices so it works with NAT routers, and understand in what context it just can't be used and I should check more NAT-friendly alternatives like IAX.

A picture being worth a thousand words, here's the layout I need to use:

http://img62.imageshack.us/img62/4077/sipandnatrouters.jpg

  1. The PBX server is located in the private LAN behind a NAT router connected to the Internet (I know it'd be easier if it were located in the public network, but this router doesn't support DMZ's so the server has to be in the private network)

  2. A couple of (soft|hard)phones are located on the same LAN and connected to the PBX server, along with a PSTN gateway (Linksys 3102 or a Digium PCI card)

  3. Remote users using (soft|hard)phones are located somewhere on the Net with dynamic IP's and are also located behind NAT routers

  4. I may or may not have control over the local NAT router where the PBX server is located, but I have no control over the remote NAT routers, either because the users don't have the computer knowledge to map ports or because the routers are off-limit (eg. web cafés, hotel LAN's, etc.)

Is it possible to configure the PBX server, the (soft|hard)phones, and the PSTN gateway so that the all conversations work fine, no matter the endpoints (POTS caller/local phone, POTS caller/remote phone, local phones, remote phone/local phone)?

In which cases may I expect problems, and are there solutions?

FWIW, I'm leaning toward using Freeswitch, but I could end up using Asterisk if there are technical advantages to it in this context.

Thank you for any info.

share|improve this question

2 Answers 2

Mike has pretty much covered the core issues very well. However to add to what he has said, If your NAT router supports being a VPN server that would be one backup method for people behind really broken NAT routers or SIP ALGs.

Another option is to run Openvpn (or other vpn server) on the FS box and port forward the traffic through to the FS box.

SNOM 370 phones for example have firmware images that can do OpenVPN connections.

share|improve this answer

Without the full control of the router in front of FreeSwitch such scenario won't be possible.

You need to tell the router to forward all packets to FreeSwitch machine ever if there is no NAT association - it can be done with DMZ or UPNP (which is supported by FS).

There is some info available at FreeSwitch Wiki

But the best to have a Static REAL IP address on FreeSwitch machine.

P.S. I'm multi years Asterisk user and currently moving all services toward FreeSwitch because of it's stability, community and features.

share|improve this answer
    
When you already mentioned FreeSwich, Can I ask what do you use for front end app for cinfiguring and maintan FreeSwich, Thanks in advanced –  adopilot Nov 21 '09 at 13:19
    
It's self written system. Uses mod_xml_curl and event socket. –  Mike Nov 27 '09 at 9:27
    
Thanks Mike for the reply. In the case where I have control over the NAT router protecting the FreeSwitch server (so I can map ports either statically or dynamically with UPnP), the issue is whether road warriors with IP (soft|hard)phones connecting through open networks (ie. no control over whatever firewall stands in their way to the Net) can reliably connect to the remote FreeSwitch server, and send/receive voice data through RTP. Is this a common issue, or a baseless fear? –  OverTheRainbow Dec 2 '09 at 6:04
1  
Sure, any firewall can limit the SIP traffic by filtering for example on port 5060 or filtering whole UDP range leaving only DNS to work, and you can do nothing with this, but this is rare. Also often I face with some 'too smart' CPE NAT Routers that try to 'fix' the SIP signaling and modify incoming/outgoing messages and broking whole FS NAT traversal logic - but runing FS on port other than 5060 or using SIP TLS usually fixes all problems like that.. –  Mike Dec 9 '09 at 10:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.