Re: SIP, NAT, and load balancing problems

Linux Advanced Routing and Traffic Control

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 12/12/06 08:44, François Delawarde wrote:
I have a linux machine with a SIP server (Asterisk) and 2 WAN interfaces (NATed) configured to do load balancing. I experienced problems with the SIP/RTP protocols and load balancing, because when initiating a call to an external SIP Host, a new RTP flow starts from the server to the Host, that sometimes uses another default route (due to the nexthop configuration). As i have two different public IPs, the external host gets confused while receiving flows from different IPs, and doesn't work (or sometimes we only have one-way communication).

IMHO this is what I would expect SIP VoIP traffic to do in this scenario.

What I basicly want is to force all traffic from my SIP server to pass by a unique WAN interface (eth2), or to find a solution that would force multiple sessions from the same IP to use the same WAN interface. Reading various forums and mailing lists, I decided to try to do "output re-routing" to all traffic sent to the wrong interface:

(5060 is SIP port and 10000-20000 are the possible RTP ports)

<snip>

The redirection is working, but the source port is changed by the MASQUERADE, and this doesn't work with SIP/RTP, which contain reply information (ip/port) inside its packets.

If Asterisk is running directly on the firewall box, why are you even MASQUERADEing or SNATing the packets? Why not have Asterisk bind directly to the external IP? This way MASQUERADE will not get in your way as far as changing the ports on you.

Even with SNAT or MASQUERADE rules, the source IP of the packet is not changed when using these ROUTE targets, the router connected to eth2 then drops the packets.

Sorry, I have not worked with the ROUTE target so I can not help.

Below you can find my network configuration (rules, routes and addresses). Anyone has an idea of how i could resolve this problem?

I'm looking, but for some reason I can not find it.  ;)

Some things to consider:
 - Set up a routing table just for Asterisk.
 - Identify Asterisk traffic via MARKed packets.
- MARK the packets based on the OWNER match extension. To do this Asterisk would need to run as it's own user, which should not be a problem.



Grant. . . .
_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

[Index of Archives]     [LARTC Home Page]     [Netfilter]     [Netfilter Development]     [Network Development]     [Bugtraq]     [GCC Help]     [Yosemite News]     [Linux Kernel]     [Fedora Users]
  Powered by Linux