Hello all,
I have a linux machine with a SIP server (Asterisk) and 2 WAN interfaces
(NATed) configured to do load balancing. I experienced problems with the
SIP/RTP protocols and load balancing, because when initiating a call to
an external SIP Host, a new RTP flow starts from the server to the Host,
that sometimes uses another default route (due to the nexthop
configuration). As i have two different public IPs, the external host
gets confused while receiving flows from different IPs, and doesn't work
(or sometimes we only have one-way communication).
__________
| |-eth1---|Router ISP 1|---WAN 1
LAN---eth0-|SIP Server|
|__________|-eth2---|Router ISP 2|---WAN 2
What I basicly want is to force all traffic from my SIP server to pass
by a unique WAN interface (eth2), or to find a solution that would force
multiple sessions from the same IP to use the same WAN interface.
Reading various forums and mailing lists, I decided to try to do "output
re-routing" to all traffic sent to the wrong interface:
(5060 is SIP port and 10000-20000 are the possible RTP ports)
1. using FWMARK and iproute2:
iptables -t mangle -A OUTPUT -o eth1 -p udp --sport 5060 -j MARK
--set-mark 0x101
iptables -t mangle -A OUTPUT -o eth1 -p udp --sport 10000:20000 -j MARK
--set-mark 0x101
ip rule add prio 101 fwmark 0x101 table 101
ip route add default via 192.168.2.1 dev eth2 src 192.168.2.2 table 101
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
The redirection is working, but the source port is changed by the
MASQUERADE, and this doesn't work with SIP/RTP, which contain reply
information (ip/port) inside its packets.
2. iptables ROUTE target:
iptables -t mangle -A OUTPUT -o eth1 -p udp --dport 5060 -j ROUTE --oif
eth2 --gw 192.168.2.1 --continue
iptables -t mangle -A OUTPUT -o eth1 -p udp --dport 10000:20000 -j ROUTE
--oif eth2 --gw 192.168.2.1 --continue
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
Even with SNAT or MASQUERADE rules, the source IP of the packet is not
changed when using these ROUTE targets, the router connected to eth2
then drops the packets.
Below you can find my network configuration (rules, routes and
addresses). Anyone has an idea of how i could resolve this problem?
Thanks,
François.
