| Is SIP ALG a good solution for NAT? Hello,
Having Asterisk and some SIP clients in a private LAN between a NAT router is doable but a bit of a pain:
1. On the Asterisk server, I must use a small and fixed range of ports for RTP, and the Asterisk configuration must be configured carefully (tell Asterisk that it's located behind a NAT, what is its public IP, SIP clients must not use STUN, etc.)
2. On the router, I must open ports for SIP and RTP manually
3. If some SIP client registers from outside on the Net and calls a local SIP client, all RTP packets go through Asterisk
So I was wondering if having an SIP ALG on the NAT router would make it easier to use a telephony server and SIP clients in the private LAN:
»img46.imageshack.us/img46/6264/sipalg.png
If you've tried some NAT router that has an SIP ALG, would you recommend it, or is the "manual" way above the recommend solution (I know that moving the Asterisk server in front of the router in the public part makes things easier)?
Thank you. |
|
OmagicQPosting in a thread near you
join:2003-10-23
Bakersfield, CA
kudos:1 Reviews:
 ·voip.ms
·callwithus
·Callcentric
| SIP ALG's in most consumer grade routers is broken. Most providers recommend turning them off because they break more than they fix. I can't think of a router with a working sip alg off the top of my head.
--
Dovahkiin, Dovahkiin naal ok zin los vahriin wah dein vokul mahfaeraak ahst vaal!
Ahrk fin norok paal graan fod nust hon zindro zaan Dovahkiin, fah hin kogaan mu draal! |
|
PX EliezerPremium
join:2008-08-09
Hutt River
kudos:12 | Exactly.
See here, one fellow even calls SIP ALG as evil.
»wiki.freeswitch.org/wiki/ALG |
|
|
|
| reply to vincentdelpo
I've tried it on a couple of Netgear routers. Doesn't work for me with voip.ms. |
|
Mangowww.toao.net
join:2008-12-25
Alberta
kudos:8 | reply to OmagicQ
Even Tomato - which makes a fantastic router in my opinion - has a horrible SIP ALG. Frankly I don't know why people put energy into it, if it's going to work this poorly. |
|
RonR
join:2003-10-10
Ash Flat, AR | said by Mango:Even Tomato - which makes a fantastic router in my opinion - has a horrible SIP ALG.
Where is there any SIP ALG option in Tomato firmware?
I've been using Tomato firmware for many many years and it handles SIP/VoIP excellently. |
|
OZOPremium
join:2003-01-17
kudos:2 | reply to vincentdelpo
said by vincentdelpo:1. On the Asterisk server, I must use a small and fixed range of ports for RTP, and the Asterisk configuration must be configured carefully (tell Asterisk that it's located behind a NAT, what is its public IP, SIP clients must not use STUN, etc.) It's strange to see the last suggestion - "SIP clients must not use STUN". Perhaps it's because very cheap NAT routers may not support loopback correctly? Otherwise - using STUN servers makes setup more universal and automatic.
I'm using FreeSWITCH (SIP server, similar to Asterisk) on LAN behind NAT router (ZyWALL 5) with all other SIP clients connected from different WAN/LAN segments, using WAN IP's, provided by remote STUN servers. And it works very well even in direct media mode. No port forwarding is required (setup uses UPnP). ALG is turned off.
--
Keep it simple, it'll become complex by itself... |
|
Bink
join:2006-05-14
Denver, CO
kudos:4 | reply to vincentdelpo
New to this forum and have been lurking for the past few days in preparation for my new VoIP service. That said, in seeing the opinions of SIP ALGs just now, any difference in opinion when it comes to Siproxd, »siproxd.sourceforge.net ?
Thanks. |
|
Mangowww.toao.net
join:2008-12-25
Alberta
kudos:8 | reply to RonR
It's in Conntrack/Netfilter, but it only appears in some builds of Tomato. Indeed, Tomato is an excellent router for VoIP, when SIP ALG is disabled. |
|
 XCOMdigitalnUllPremium
join:2002-06-10
Spring, TX | reply to Bink
Bink,
siproxd works and works very well. I have used it in the past.
in the other hand my mom told me that sip alg is the devil.
--
[nUll@dcypher ~]$ |
|
RonR
join:2003-10-10
Ash Flat, AR | reply to Mango
said by Mango:It's in Conntrack/Netfilter, but it only appears in some builds of Tomato. Indeed, Tomato is an excellent router for VoIP, when SIP ALG is disabled.
I see a SIP checkbox under Tracking / NAT Helpers, but I have a hard time believing that's the dreaded SIP ALG. I've been running this version (TeddyBear) for over a year with that box checked and I haven't had a single router related hiccup with 3 ATA's hung off of it. |
|
Mangowww.toao.net
join:2008-12-25
Alberta
kudos:8 Reviews:
·voip.ms
·Anveo
 ·Shaw
·FreePhoneLine
 ·TELUS
·Callcentric
·callwithus
·LINGO
| Good point. All I know about that option is that it makes SIP connections time out after an hour, and not respect the UDP Timeout settings. This is bad if you're affected by the Tomato bug that causes NAT associations to be mangled. I'm not sure what else it does, if anything. |
|
RonR
join:2003-10-10
Ash Flat, AR | said by Mango:Good point. All I know about that option is that it makes SIP connections time out after an hour, and not respect the UDP Timeout settings. This is bad if you're affected by the Tomato bug that causes NAT associations to be mangled. I'm not sure what else it does, if anything.
Could this problem have been fixed in v1.28? I was on a 1 hour and 42 minute call yesterday (using SipBri no less) and everything stayed glued together perfectly. |
|
Mangowww.toao.net
join:2008-12-25
Alberta
kudos:8 Reviews:
·voip.ms
·Anveo
·Shaw
·FreePhoneLine
·TELUS
·Callcentric
·callwithus
·LINGO
| I don't think I explained that clearly. I didn't mean phone conversations would cut off after an hour. When your phone registers with a VoIP server, the router keeps the "NAT hole" open for typically the length of the Assured UDP timeout. This way, the VoIP server may deliver incoming calls to you. As long as the phone's registration interval is less than the Assured UDP Timeout, everything will work properly.
With SIP Helper turned on, the router will not respect the Assured UDP Timeout and instead uses 3600 seconds. This means that your phone has one hour to re-register and will possibly make Linksys devices workish with their default settings.
The reason this is not optimal is that if for example your ISP changes your public IP address, it could potentially take an hour before you can receive incoming calls, or worse, it could require human intervention to reboot things if you're affected by the bug I mentioned before.
Obviously if things work well for you then there's no need to tinker with anything. My point was that my opinion is the same as the general opinion in this thread - leave my SIP alone!
m. 
--
Recommended ATA Settings | e164 - make your DID accessible via SIPBroker! |
|
OmagicQPosting in a thread near you
join:2003-10-23
Bakersfield, CA
kudos:1 Reviews:
·voip.ms
·callwithus
·Callcentric
| reply to vincentdelpo
Does anyone know if IAX gets mangled by a SIP ALG or not? I'm wondering if it might be an option for people who are stuck behind isp provided/provisioned routers with no admin access to turn it off.
(Jedi mind trick) These aren't the packers you're looking for...(/jedi mind trick)
--
Dovahkiin, Dovahkiin naal ok zin los vahriin wah dein vokul mahfaeraak ahst vaal!
Ahrk fin norok paal graan fod nust hon zindro zaan Dovahkiin, fah hin kogaan mu draal! |
|
 TrevIP Telephony GuruPremium
join:2009-06-29
Victoria, BC
kudos:3 | said by OmagicQ:Does anyone know if IAX gets mangled by a SIP ALG or not? I'm wondering if it might be an option for people who are stuck behind isp provided/provisioned routers with no admin access to turn it off.
IAX is different in almost every way, so it would be completely immune to SIP "helpers."
--
Wondering what I do? Find out at »www.digitalcon.ca |
|
| reply to vincentdelpo
said by OmagicQ:SIP ALG's in most consumer grade routers is broken. Thanks for the feedback. I'll just forget about SIP ALG, then.
said by OZO:It's strange to see the last suggestion - "SIP clients must not use STUN". Perhaps it's because very cheap NAT routers may not support loopback correctly? Otherwise - using STUN servers makes setup more universal and automatic. I said this because I thought (haven't tried, though) that enabling STUN on an SIP client where the SIP server is also located in the private LAN (ie. behind the NAT router) will just break things.
I have a couple more questions:
1. Does Asterisk now support STUN, so that I would no longer have to open ports manually on the router for SIP + RTP?
2. Is there a way to have the two SIP clients (local and remote) send RTP packers to each other so that the SIP server doesn't spend resources on this?
3. Am I correct in understanding that UPnP is a protocol that lets UPnP clients connect to the NAT router to have it open ports automatically?
4. What is "direct media mode"? RTP packets flowing directly between the two SIP clients? Will this work with the two sitting on either sides of the NAT router, and the SIP server will stay in the loop just to monitor SIP messages (close call, put call on hold, etc.)?
Thank you. |
|
Reviews:
·TekSavvy Cable
·voip.ms
| reply to vincentdelpo
Since we're on this topic, I was wondering if you guys could help me with my DLINK DIR-625 settings.
I am experiencing problems with my voip.ms account. Often times, like today for instance, I received calls several times and each time I picked up the phone, it would get disconnected. I called back the number after a pause and I get a busy tone. I then receive a voice mail (no voice) but some background noise after every two seconds. I am sure the person trying to call me did not leave a message. This has happened several times and it is really frustrating me now.
I guess it is my router but I am not sure. I have used voip.ms's tickets and so far they haven't been able to help me out. They're trying to troubleshoot it.
Here is the screenshot to my router's firewall page:
»i39.tinypic.com/206hd84.png
Thanks guys! |
|
OZOPremium
join:2003-01-17
kudos:2 | reply to vincentdelpo
It's very rare to see someone runs its own STUN server. I still not have one, even though I want to do it on my local Windows server. But there is no simple and free package, that does just that...
Answering your questions:
1. I don't run Asterisk, I use FreeSWITCH instead
2. It's called "direct media mode" (one of the terms used)
3. Yes, you are. One of the functions of UPnP is to allow clients to open and forward ports on NAT router. Check for that feature support on your particular hardware
4. Yes, it is. There are two different streams of data (and related protocols) - SIP (initiation and control of the call), RTP (media stream, usually only sound stream). Direct media mode is when SIP clients stream media directly between them and do not through SIP server. The latter is used for SIP protocol only. In that mode (support is required) you may run SIP clients independently of any NAT (or multiple NATs) in the middle. But again, because the SIP protocol was not initially designed to be used with a NAT (a huge omission, IMO), there should be a special setup. STUN (ICE, local UPnP etc) could help to automate it.
--
Keep it simple, it'll become complex by itself... |
|
PX EliezerPremium
join:2008-08-09
Hutt River
kudos:12 Reviews:
·voip.ms
·callwithus
·Callcentric
·Vitelity VOIP
·Optimum Voice
·Gizmo5
| reply to erfans
said by erfans:Since we're on this topic, I was wondering if you guys could help me with my DLINK DIR-625 settings.
On the UDP Endpoint Filtering, and also the TCP Endpoint Filtering, try changing both of those to "Address Restricted" instead of "Port and Address Restricted".
That works for me on my D-Link DGL 4100 routers.
EDIT: Here's a nice explanation of why this is sometimes useful.
NAT Endpoint Filtering
The NAT Endpoint Filtering options control how the router's NAT manages incoming connection requests to ports that are already being used.
Endpoint Independent
Once a LAN-side application has created a connection through a specific port, the NAT will forward any incoming connection requests with the same port to the LAN-side application regardless of their origin. This is the least restrictive option, giving the best connectivity and allowing some applications (P2P applications in particular) to behave almost as if they are directly connected to the Internet.
Address Restricted
The NAT forwards incoming connection requests to a LAN-side host only when they come from the same IP address with which a connection was established. This allows the remote application to send data back through a port different from the one used when the outgoing session was created.
Port And Address Restricted
The NAT does not forward any incoming connection requests with the same port address as an already establish connection.
Note that some of these options can interact with other port restrictions. Endpoint Independent Filtering takes priority over inbound filters or schedules, so it is possible for an incoming session request related to an outgoing session to enter through a port in spite of an active inbound filter on that port. However, packets will be rejected as expected when sent to blocked ports (whether blocked by schedule or by inbound filter) for which there are no active sessions. Port and Address Restricted Filtering ensures that inbound filters and schedules work precisely, but prevents some level of connectivity, and therefore might require the use of port triggers, virtual servers, or port forwarding to open the ports needed by the application. Address Restricted Filtering gives a compromise position, which avoids problems when communicating with certain other types of NAT router (symmetric NATs in particular) but leaves inbound filters and scheduled access working as expected. |
|
