VOIP Tech Chat → [General] Verizon wireless blocking sip packets going to port 50

Tried to send a sip packet from my Android phone (via verizon 3G) to my asterisk server(udp port 5060). The packet never got to the asterisk. Instead, I got back a "500 Internal Server Error". Anyone have this problem?

Verizon has a SIP ALG in the path. It doesn't normally block packets, but some detail in the headers of your (presumably REGISTER) request may have confused it. Possibly, a header in the reply may give a clue as to what is wrong.

IMO, the easier fix may be to change bindport on your Asterisk to something other than 5060. If that's not practical, e.g. you have many existing external extensions that would be difficult to reconfigure, try setting up iptables to forward some other external port to internal port 5060. With the latter approach, you'll need to set up outbound proxy on the client, because Asterisk won't know it's being contacted on the alternate port, and will still use port 5060 in Contact headers.

Thx for your reply. Ports other 5060 work fine and I have no problem setting up port forwarding to make it work. The more interesting things is to find out what could cause their ALG to drop the parket. Any idea?

I doubt that you'll get any help from Verizon. If there is no clue in the 500 response, I suppose you could take some random shots at the problem, e.g. trying a different SIP app, turning NAT mapping on (or off), switching from server domain name to numeric IP address (or vice-versa), binding the client to local port 5060 (or not), etc. If you can tether, see if an external softphone / ATA / IP phone fares any better.

Possibly, by looking at the 500 response, you can determine the maker of the ALG and get some support from them.

Problem solved. Verizon ALG wants a routable address/port to be in the via and contact. The rport parameter does not do it. A routable address/port can be obtained from a stun server. I guess this is a bad implementation of the ALG which is supposed to do that address translation automatically without the need to query a public stun server.

P.S. I do have control the source code of the app.