Re: GNUGK proxy in a NATed network / extern to intern call failure :(

"Simon Horne" <s.horne@xxxxxxxxxxxxxx> · Wed, 11 May 2011 10:38:05 +1000

Frederic

Looking at the setup I cannot see why the gatekeeper would not route the call. 
If it’s possible, can you post the level 4 trace?

Simon

From: Frédéric URBAN [mailto:frederic.urban@xxxxxxxxxxxxxxxxxx] 
Sent: 11 May 2011 04:02
To: openh323gk-users@xxxxxxxxxxxxxxxxxxxxx
Subject:  GNUGK proxy in a NATed network / extern to intern call failure :(

Hello guys,

We decided to move some H323 endpoints (Tandberg MXP 6000 & Cisco C40) from the public network we have to our internel NATed network. The goal is to grab some more available public ipv4 address before going on ipv6...

I decided to use GnuGK on a "Ubuntu Linux 10.04 Server" Box to register thoses terminals inside the NATed network on a dedicated system with one IP inside the NATed network and one IP outside (on a public network with one public address). No NAT or network layer routing is done on this computer since i'm using the proxy mode. If i'm right, the proxy is doing some kind of layer 5-6-7 routing, in userspace. No pure network routing is done.

After a short configuration, with GK routing, h245 routing and proxy enabled on the private network, everything work (all signalisation and RTP are correctly proxied by the GK) except the following case: "Call from outside to inside through the proxy GK".

To proceed i've a Tandberg MXP 6000 connected somewhere else with a public adresse, unregistered on the gatekeeper which call the following string: 19780@<IP of the Gatekeeper>.
19780 refer to a Cisco C40 H323_ID, i've set the same value for E.164 This equipement is correctly registered on the GK.

After the E164 rewrite of 19780@<External IP of the Gatekeeper> to 19780 the log trace level 4 say: 

ProxyChannel.cxx(1926) Q931s No destination for unregistered call 02 2b d8 03 b2 69 f5 1a 04 93 f6 f7 64 cd 82 93 from <IP of a External  Endpoint>:2640

Finally the H225 CALL SETUP fail with return H225 error code 20 which is "Subscriber Absent" (in the H225 RELEASE COMPLETE frame). This was confirmed while reading a tcpdump capture with Wireshark.

Correct me if i'm wrong, but the gatekeeper is unable to route the call because something is missing... I expected that it has everything needed to route the call correctly. In the registration table it should find the related IP for 19780. Maybe i'm to newbie in the H323 understanding, if so i'm sorry :) I should have forget something in the call routing, but I don't really know where to begin.

Note: the C40 is not the probleme, i've the same behavior while trying to call from outside another Tandberg MXP6000 or a XMeeting H323 client.

Thanks for the help you could provide, the opensource project really looks solid and cleanly built.
Fred.

Netstat -atunp return:

fred@gk:~$ sudo netstat -atunp
tcp        0      0 GK INTERNAL IP:7000    0.0.0.0:*               LISTEN      5034/gnugk
tcp        0      0 GK INTERNAL IP:1720    0.0.0.0:*               LISTEN      5034/gnugk
tcp        0      0 GK EXTERNAL IP:7000      0.0.0.0:*               LISTEN      5034/gnugk
tcp        0      0 GK EXTERNAL IP:1720      0.0.0.0:*               LISTEN      5034/gnugk
tcp        0      0 127.0.0.1:7000          0.0.0.0:*               LISTEN      5034/gnugk
tcp        0      0 127.0.0.1:1720          0.0.0.0:*               LISTEN      5034/gnugk
...
udp        0      0 GK INTERNAL IP:1718    0.0.0.0:*                           5034/gnugk
udp        0      0 GK EXTERNAL IP:1718      0.0.0.0:*                           5034/gnugk
udp        0      0 127.0.0.1:1719            0.0.0.0:*                           5034/gnugk
udp        0      0 GK INTERNAL IP:1719    0.0.0.0:*                           5034/gnugk
udp        0      0 GK EXTERNAL IP:1719      0.0.0.0:*                           5034/gnugk
udp        0      0 127.0.0.1:1719          0.0.0.0:*                           5034/gnugk

Gatekeeper.ini:

fred@gk:~$ cat /etc/gatekeeper.ini
[Gatekeeper::Main]
Fortytwo=42
Name=OpenH323GK

[RoutedMode]
GKRouted=1 # The GK route...
H245Routed=1 
RemoveH245AddressOnTunneling=1
AcceptNeighborsCalls=1 
AcceptUnregisteredCalls=1 # We accept call from everywhere without being registered to our GK
SupportNATedEndpoints=1 # All of our equipements are in a private network RFC1918
DropCallsByReleaseComplete=1 
CallSignalPort=1720 # Accept remote Endpoint to call the GK.

[Proxy]
Enable=1
T120PortRange=40000-40999
RTPPortRange=50000-59999

[RasSrv::ARQFeatures]
ArjReasonRouteCallToGatekeeper=1
RemoveTrailingChar=#
RoundRobinGateways=1

[RoutingPolicy]
default=explicit,internal,parent,neighbor

[RasSrv::RRQAuth]
default=confirm

[GkStatus::Auth]
rule=allow

[Gatekeeper::Auth]
default=allow

------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay
_______________________________________________________

Posting: mailto:Openh323gk-users@xxxxxxxxxxxxxxxxxxxxx
Archive: http://sourceforge.net/mailarchive/forum.php?forum_name=openh323gk-users
Unsubscribe: http://lists.sourceforge.net/lists/listinfo/openh323gk-users
Homepage: http://www.gnugk.org/